Aletho News

ΑΛΗΘΩΣ

Sniffing Out Privacy Issues That May Be In Our future

By Jay Stanley | ACLU Speech, Privacy and Technology Project | May 11, 2012

MIT’s Technology Review has an article today on research that is underway to make extremely sensitive and rapid molecular sensors—aka “artificial noses”—that are so thin they could even be integrated into paper or textiles.

The use of particle detectors and chemical sensors to identify tiny amounts of chemicals or odors is an area that we’ve been keeping an eye on for a while—something we file under “possible future privacy-invasive technologies.” As Technology Review describes it, this technology

rapidly detects volatile organic compounds (VOCs)—gases in our surrounding environment that are produced by a wide variety of sources, everything from household paints to a person’s own skin. Many do not have an odor, but an electronic sensor could alert a user to the presence of harmful chemicals or perhaps indicate that something is off-kilter with a user’s health.

The main context in which Americans have encountered chemical sensors so far is in bomb detection—mainly at the airport when they or their belongings are swabbed and tested for traces of explosives. A “puffer machine” that blows air on passengers standing inside a booth was also tested for a while but found to be so far impractical for mass deployment. We’ve never had a problem with particle detectors; as long as they are tuned only to look for explosives, they do not raise substantial privacy concerns, as explosives are not something people normally have. (We have pointed out that there can be questions about their effectiveness, and the importance of treating people who “alarm” properly given that false negatives are probable.)

But such deployments may be only the beginning. Here are some other chemical detection efforts that we have seen already:

• DHS has been working on a scheme to place chemical sensors in cell phones so that every American becomes a roaming chemical sensor able to alert the authorities to the release of chemical toxins resulting from accidents or terrorist plots.

• Companies are selling sensitive drug-sniffing products that go way beyond breathalyzers, such as contactless hand-held scanners that claim to be able to detect trace amounts of drugs on virtually all surfaces, including skin and clothing.

• DHS is also researching the use of body odor as a unique identifier or “odor fingerprint.” In theory, if that panned out, cheap and pervasive sensors could identify you everywhere you go.

• As part of the same project, DHS is also researching their use “as an indicator of deception”—in short, they are pursuing that perennial chimera, a lie detector. While lie detection is a fool’s errand, it’s possible that odor detectors could reveal very crude facts about people’s emotional state.

• Researchers are developing techniques for detecting medical conditions including cancer, asthma, and many other diseases by detecting “trace amounts of distinctive biomarkers in their breath.” (Sounds great in the hands of your doctor; used secretly during a job interview or bank loan application, not so much.)

• Under a pilot program spearheaded by the White House’s “drug czar” in 2006, the government tested sewage from treatment plants in the Washington, D.C. area to measure the amount of trace cocaine that was present. This was done in an effort to estimate the level of drug use in those communities. It did not reveal anything about specific individuals.

The breadth of activity in this area makes it clear that if this technology continues to advance rapidly and becomes cheap and widespread as so many other technologies have in recent years, we will be facing an entirely new set of privacy issues. A whole new range of facts about ourselves (health conditions; emotional state; drug, alcohol and pharmaceutical use; our identity) could become open to unwelcome scrutiny by others (government, employers, insurance companies, nosy neighbors).

Sometimes such technologies get scary very fast; other times they don’t turn out to be a problem. We’ll be watching closely.

May 12, 2012 Posted by | Civil Liberties, Full Spectrum Dominance, Timeless or most popular | , , , , | Leave a comment

License Plate Tracking Spreads beyond Criminal Suspects

By Noel Brinkerhoff | AllGov | May 08, 2012

From Tennessee to the District of Columbia, police are using mobile and stationary surveillance cameras to collect and store license plates of residents who have committed no crime—so that they can be found if they ever do.

In Tennessee, police utilize cameras mounted atop patrol cars that can capture thousands of license numbers each day. The information is then loaded into an ever-expanding database, which can help officers locate a vehicle in the event its owner is suspected of criminal behavior. The program is now expanding to include stationary cameras mounted next to busy roads.

“I’m sure that there’s going to be people out there that say this is an invasion of privacy,” Detective James Kemp of Gallatin County told The Tennessean. But “the possibilities are endless there for solving crimes. It’s just a multitude of information out there—to not tap into it to better protect your citizens, that’s ludicrous.”

In Washington D.C., local police make use of 250 cameras set up around the city that can capture license plates. Last year they claimed that the cameras led to an average of one arrest a day. DC reportedly has the highest concentration of cameras per square mile in the United States for spotting criminals on the move or just ordinary citizens going about their lives.

Jay Stanley, senior policy analyst for the American Civil Liberties Union’s technology and liberty program, expressed concern over D.C.’s “large database of innocent people’s comings and goings.” He told The Washington Post: “The government has no business collecting that kind of information on people without a warrant.”

Others predict that the technology will be declared constitutional because license plates are displayed in public, so there is no invasion of privacy.

To Learn More:

May 8, 2012 Posted by | Civil Liberties, Full Spectrum Dominance, Video | , , , , | Leave a comment

Analysis: Little Caution Used in U.S. Drone Assassinations

By Sherwood Ross | May 7, 2012

Although President Obama’s top counter-terrorism adviser says caution is exercised when making drone attacks, official US announcements often state that suspects are killed. This very word betrays the fact that every drone attack is a crime because it is illegal in any civilized society to kill suspects. The Pentagon and CIA killings are murder, pure and simple. (Only last week, Washington announced it killed four “suspected militants” by drone attack in Pakistan, resulting in a formal protest from Islamabad “strongly condemning” the killings. “Such attacks are in total contravention of international law and established norms of interstate relations,” the Pakistan statement underscored.)

Moreover, the Washington Post quoted a Pakistani government official who reminded: “When a duly elected democratic Parliament says three times not to do this, and the U.S. keeps doing it, it undermines democracy.”

Presidential adviser John Brennan told a group of academicians at the Woodrow Wilson Center, “We only authorize a strike if we have a high degree of confidence that innocent civilians will not be injured or killed, except in the rarest of circumstances,” Charlie Savage of The New York Times reports in the April 30th edition.

But Brennan acknowledged “instances when — despite the extraordinary precautions we take — civilians have been accidentally injured, or worse, killed in these strikes. It is exceedingly rare, but it has happened. When it does, it pains us and we regret it deeply, as we do any time innocents are killed in war.”

Exceedingly rare? As Juan Cole of the University of Michigan observed in The Nation magazine, the Britain-based Bureau of Investigative Journalism(BIJ) found “not only are civilians routinely killed by U.S. drone strikes in northern Pakistan” but “often people rushing to the scene of a strike to help the wounded are killed by a second launch.” Presumably, some of these victims may include medical personnel and relatives.

The BIJ estimates the US has killed some 3,000 people in 319 drone strikes. Of these, 600 were civilian bystanders and approximately one in four of those were children.

“At the very time Brennan made his speech, there emerged further confirmation of CIA “signature strikes’ that were launched at people who allegedly may be engaged in a pattern of activity that could somehow suggest their involvement in some form of terrorism on the basis of dubious intelligence,” said Francis Boyle, the distinguished professor of international law at the University of Illinois, Champaign.

“These “signature strikes’ are indiscriminate and thus illegal and war crimes. And the fact that all these drone strikes constitute widespread and systematic war crimes mean they also constitute Crimes against Humanity as defined by the Rome Statute for the International Criminal Court and customary international criminal law,” Boyle added.

“Obama, Brennan, Petraeus and the CIA operatives involved must be held criminally accountable for these war crimes and Crimes against Humanity in Pakistan, Yemen, and Somalia, inter alia,” said Boyle, author of “Tackling America’s Toughest Questions” (Clarity).

Obama, who presents himself as the doting father of two daughters, is systematically and criminally taking the lives of other parents’ children in his blind passion to destroy his enemies. He has radically stepped up drone attacks over his predecessor, George W. Bush, and makes no apologies for their commission. The drones are now so “hot” in the Pentagon arsenal that manufacturers cannot keep pace with the demand for them. The US has 7,000 unmanned aerial vehicles, Cole writes, which it has deployed in strikes in six countries under direction of the CIA and Pentagon.

Cole points out the drone strikes are largely carried out in places where no war has been declared; neither has any Status of Forces Agreement been signed. “They operate outside the framework of the Constitution, with no due process or habeas corpus, recalling pre-modern practices of the English monarchy, such as declaring people outlaws, issuing bills of attainder against individuals who offend the crown and trying them in secret Star Chamber proceedings.”

“The only due process afforded those killed from the air is an intelligence assessment, possibly based on dubious sources and not reviewed by a judge,” Cole writes. “There is no consistency, no application of the rule of law. Guilt by association and absence of due process are the hallmarks of shadow government.”

Of the 3,000 slayings in Pakistan by drone strikes, writes Bill Van Auken, only 170 victims have been identified as “known militants.”

According to Van Auken, Brennan told his Woodrow Wilson Center audience, “The constitution empowers the president to protect the nation from any imminent threat of attack” but that assertion “is a lie.” Van Auken explained, “As US officials acknowledged, Sunday’s attack in Pakistan was directed at elements who were allegedly preparing not to attack the US, but rather to resist the US military occupation of Afghanistan.”

The accelerating drone strikes are only one aspect of the emerging covert operations that were once a minor arrow in the national security quiver, The Nation writer Cole states, but today are “the cutting edge of American power.”

“Drone strikes, electronic surveillance and stealth engagements by military units such as the Joint Special Operations Command, as well as dependence on private corporations, mercenary armies and terrorist groups, are now arguably more common as tools of US foreign policy than conventional warfare or diplomacy,” Cole writes.

May 7, 2012 Posted by | Civil Liberties, Full Spectrum Dominance, Illegal Occupation, Militarism, Subjugation - Torture, Timeless or most popular, War Crimes | , , , , , | Leave a comment

What Really Happened at the Montréal May Day Protest?

From Peaceful Protest to Police Brutality

By Andrew Gavin Marshall | The Media Co-op | May 2, 2012

The police line as they are about to charge
The police line as they are about to charge

On May 1, 2012, thousands of students and other protesters took to the streets for the Anti-Capitalist rally in downtown Montréal. I attended the protest with a couple friends, and having read the “news” emanating from the “stenographers of power” (the mainstream media), it’s important to set the record straight about what happened here in Montréal.

The Montreal Gazette reported the events with the headline, “Police respond as May Day anti-capitalist protesters turn violent in Montreal.” This exact story and headline were carried across the English-speaking media fresh for the morning’s papers: with the Vancouver Sun, the Province, the Calgary Herald, the Regina Leader-Post, the Edmonton Journal, and the Ottawa Citizen.

The story, as they tell it, goes like this: it started peacefully just after 5 p.m. (this part is true!), and then it “was declared illegal by police at two minutes after 6 p.m. following violent clashes.” A police spokesperson (who apparently is the only person the media chose to interview for their article) said that, “injuries to a citizen, police officers and vandalism on cars and property were the reasons for declaring the march illegal.” The article then blamed “black-clad youth [who] were seen hurling rocks at store windows,” after which the police began to launch flash grenades, and the riot police moved in after 6 p.m. “using batons to disperse the crowd.” At 7:10 p.m., “a full hour after declaring the demonstration illegal, police announced that anyone who refused to leave would be arrested.”

Peaceful beginnings
Peaceful beginnings

The CBC went with the headline, “More than 100 arrests in Montreal May Day riot.” CTV reported that of the 100+ arrests that took place, “75 were for unlawful assembly, while the remaining 34 were for criminal acts.”

So, arrested for “unlawful assembly”: what does that mean? It means that when the police unilaterally declare a protest to be “illegal,” everyone who is there is “unlawfully assembling,” and thus, mass and indiscriminate arrests can be made. In Part 1, Section 2 of the Canadian Charter of Rights and Freedoms, it is stated that “[e]veryone has the following fundamental freedoms”: conscience, religion, thought, belief, expression, media, communication, association, and “freedom of peaceful assembly.”

Having been at the protest from its beginning, I can say that it was a peaceful march. While there were individual acts of vandalism (the worst I saw was drawing on a bank’s window with a black marker), if police action were to be taken, it should be to arrest the specific vandal. Instead, they implemented collective punishment for exercising our “fundamental freedoms.”

The protest began in the Old Port of the city of Montréal, and made it’s way down rue Notre-Dame, up St-Laurent, and down to the financial district. The mood was good, people were in high spirits, with music, drums, the occasional fire cracker, young and old alike.

What Really Happened at the Montréal May Day Protest?

As we entered the financial district, the presence of the riot police became more apparent. When the protest made it to McGill College Ave. – crossing a wide intersection – as the march continued in its consistently peaceful path, the riot police quickly assembled alone the street below us. The crowd quickly became nervous as the protest was declared “illegal.” Before I could even take a photo of the police down the street in a long line, they began charging the crowd. Protesters dropped their signs and began up the street toward McGill University, while another section branched off along the intended direction, and others scattered.

The march had been successfully split, and the small factions were then being isolated and surrounded. Suddenly, riot police were everywhere, marching up the street like storm troopers, police cars, vans, horses, motorcycles, and trucks were flying by. As one faction of the protest continued down another street, the riot police followed behind, while another massive onslaught of riot police went around to block off the protesters from the other side. When the police first charged, I had lost one of my friends simply by looking away for a moment. After having found each other up the street, we watched as the protest which descended down the street was surrounded by police from nearly every side. It was then that we saw flash grenades and tear gas being launched at the crowd of people. There was a notable smell that filled the air.

As we stood, shocked and disturbed by what had just happened, we made our way toward McGill to see where other protesters were headed when we saw a group of riot police “escort” three young protesters whom they had arrested behind a police barricade at the HSBC (protecting the banks, of course!).

Onward and Upward
Onward and Upward

Up the street, and across from McGill, one protester who had run to get on the bus was chased down by several riot police who then threw him face-first onto the pavement, and as a crowd quickly gathered around (of both protesters and pedestrian onlookers), the police formed a circle around the man and told everyone to “get back!” and then they began marching toward us, forcing the crowd of onlookers to scatter as well. The police then took the young man over to where the other protesters were being “collected” at the HSBC.

There was one young girl, with the notable red square patch on her jacket (the symbol of the Québec student movement) who had to be taken away on a stretcher into an ambulance. We don’t know what happened to her.

As more and more police gathered, we decided it was time to leave, walking down the street through which the police had chased the protesters, remnants of signs, red patches, and other debris spilled across the streets; the remains of a peaceful protest ended with police violence.

The first sign of trouble
The first sign of trouble

This has become all too common in Montréal and across Québec, as the student protest enters its twelfth week, having had over 160 protests, an average of 2-3 per day. As the demonstrations take place, the police have used obscure and unconstitutional city by-laws in both Montréal and Québec City which are so vague in their descriptions that any peaceful assembly or march can be declared illegal. Those who are indiscriminately arrested are fined $500, and if arrested again, are charged between $3,500 and $10,500.

It is clear that the State has decided – unilaterally – that freedom of speech and freedom of assembly do not conform to their specific “by-laws,” and are clamping down on students and protesters in order to quiet and crush the student strike and the emerging social movement which is being referred to as the ‘Maple Spring’. The national media, for its part, has decided to demonize the students, the protesters, and the people; taking the word of a “police spokesperson” over everyone else. Having been at the protest, however, I must question whether these so-called “journalists” were at the same event, because we witnessed two entirely different scenarios.

We entered the march in good spirits, and the police ended it in violence and repression, leaving us standing still, scattered, and disturbed; but our spirits are not crushed, our resolve is only growing stronger, and for each act of violence the police and State impose upon the people, we begin to see them for what they truly are, and thus, what is truly at stake: our very freedom, itself!

Heading down the financial district

Heading down the financial district

The Charge! (it's blurry because we all had to run)
The Charge! (it’s blurry because we all had to run)

this "march" replaced the one they dispersed
this “march” replaced the one they dispersed

protecting the bank
protecting the bank

What Really Happened at the Montréal May Day Protest?

arresting protesters
arresting protesters

throwing protester face-down on the ground
throwing protester face-down on the ground

Girl taken away on stretcher
Girl taken away on stretcher

Also posted by AGMarshall:

The Québec Student Strike: From ‘Maple Spring’ to Summer Rebellion?

What Really Happened at the Montréal May Day Protest?

Canada’s Economic Collapse and Social Crisis

Student Strikes, Debt Domination, and Class War in Canada

Of Prophets, Power, and the Purpose of Intellectuals

The Purpose of Education: Social Uplift or Social Control?

The “Crisis of Democracy” and the Attack on Education

May 3, 2012 Posted by | Civil Liberties, Deception, Full Spectrum Dominance, Mainstream Media, Warmongering | , , , , , , , | Leave a comment

Hollywood’s Trolls

By Mitch Stoltz | EFF | May 1, 2012

Our movie industry has created some memorable monsters on screen. But Hollywood, and the major music labels, also helped create a very real kind of monster – copyright trolls who coerce settlements from Internet subscribers using intimidation and our out-of-whack copyright laws. Last Friday, EFF Senior Staff Technologist Seth Schoen took the witness stand in AF Holdings v. Does to explain to a federal judge why BitTorrent users should be able to hold on to their constitutional rights when targeted by trolls. Although some courts have put the brakes on the trolls’ schemes, there’s no Hollywood ending in sight yet.  As the entertainment industries continue to push for ever-stronger copyright through treaties, private agreements, Congress and state legislatures, it’s time to ask – how will Hollywood help protect us from the trolls?

The current crop of copyright trolls sue anywhere from 20 to 5,000 “John Doe” defendants in a single lawsuit, pinned to a list of Internet Protocol addresses that they claim to have seen downloading copyrighted movies using BitTorrent. Then, with the courts’ permission, they send subpoenas to Internet service providers for the names and addresses of subscribers.  The trolls then send threatening letters, demanding settlement payments to “make this go away” or face being dragged into court – often in a faraway state. Over 200,000 U.S. residents have been caught up in these suits, with many undoubtedly settling simply to end the harassment.

The trolls are, of course, following a trail blazed by the major music labels through the Recording Industry Association of America.  Beginning around 2003, they sued about 35,000 people, using the courts’ subpoena powers as a private investigation service to find names and addresses.  The RIAA ended its lawsuit campaign in 2008, apparently realizing the damage that suing its own fans had done to the industry’s image.

It was perhaps inevitable that the vacuum would be filled by opportunists with no public image to protect.  Since 2008, troll lawyers have sued about six times more people than the RIAA ever did, and pursued them even more aggressively, probably netting millions in settlements. Some have faced court settlements for cutting corners in court procedure, and one was even caught practicing law without a license. But this scheme wouldn’t be a viable business model without the draconian imbalances of U.S. copyright law and legal precedent that the entertainment industries and their lobbyists have pushed through Congress and the courts.

For starters, the statutory penalty for sharing even one copyrighted work – say one song – is as much as $150,000. It’s no surprise that many people choose to settle for several thousand dollars rather than risk a bankrupting court judgment – even if they broke no law. The entertainment industries insist that we need these gargantuan penalties to deter infringement, but the same “statutory damages” provisions are the knobby club in the hands of the trolls.

Then there’s the legal doctrine of “secondary liability.” The movie and recording industries are constantly pressing for broader liability for intermediaries, Internet sites and services, and makers of tools and software.  Copyright trolls use these concepts to disregard actual copyright infringers and instead go after the owners of Internet accounts, who are often easier to find. The trolls suggest, using the rhetoric of secondary liability, that merely allowing others to use one’s Internet connection, or operating an open Wi-Fi node, makes one liable for any copyright infringement. This isn’t the law, but the trolls don’t warn their marks about that. Often, even those who understand secondary liability, or can afford hiring a lawyer, choose to pay a settlement for someone else’s alleged infringement rather than risk a lengthy and expensive trial, even if they would prevail.

Then there’s the very concept of lawsuits aimed at dozens or thousands of “John Doe” Internet account holders. Plaintiffs in these suits often group together Internet users from all over the country and obtain their identities from ISPs by court order. Doing this requires trampling on jurisdiction rules that keep people from being unfairly forced to defend themselves far from home, joinder rules that guarantee every defendant is treated as an individual, and the First Amendment, which gives us a right to communicate anonymously.  The RIAA’s lawsuit campaign also disregarded these legal safeguards. After the RIAA opened this door, the trolls lumbered in.

Finally, the entertainment industries have spent decades, and millions of lobbying and advertising dollars, to promote the simple but flawed idea that if copyright law promotes creativity, then ever-more-extreme copyright law will promote even more. According to this philosophy, the importance of preventing even the most inconsequential copyright infringement justifies chilling free speech, unmasking anonymous Internet users, wholesale regulation of the Internet … and setting loose the trolls. This worldview was on full display at a hearing last week in the D.C. federal district court, when ISPs, assisted by the EFF, tried to quash subpoenas for Internet users’ identities. EFF’s Seth Schoen matched wits with pornography financier AF Holdings’s expert on the workings of BitTorrent and Internet forensics, and the plaintiff’s attorney defended his litigation tactics as an acceptable way to “stop piracy.”

Although there will always be people willing to use the legal system as part of a shakedown, copyright trolls are a monster created in Hollywood. Naturally, the entertainment industry’s spokespeople, lobbyists, and other mouthpieces don’t discuss how the laws, treaties, court precedents, and private enforcement agreements they spend millions to promote will be misused by opportunists. But when the next SOPA, PIPA, ACTA, TPP, graduated response agreement, or state-level copyright bill comes along, let’s ask Hollywood and its allies how they plan to keep trolls confined to the big screen.

May 2, 2012 Posted by | Civil Liberties, Full Spectrum Dominance | , , , , | Leave a comment

Drones: The Nightmare Scenario

By Jay Stanley, Senior Policy Analyst, ACLU Speech, Privacy and Technology Project | May 2, 2012

In our drones report, we discuss the coming onslaught of domestic drones and the weak state of the privacy laws that should protect us, and we outline our recommendations for protections that Congress and local governments should put in place.

But if nothing is done, how might things go? Let’s take a look at how police drone use could unfold:

  1. The FAA’s new rules go into effect. Acting under orders from Congress, the FAA in coming months and years will significantly loosen the regulations that have been holding back broader deployment of drones. Starting later this year, for example, the FAA must allow any “government public safety agency” to operate any small drone (under 4.4 pounds) as long as certain conditions are met.
  1. More and more police departments begin using them. The FAA’s new rules allow for the release of pent-up demand among police departments for cheap aerial surveillance. Ownership of drones quickly becomes common among departments large and small. Organizations are formed by police drone operators, who exchange tips and advice. We also begin to hear about their deployment by federal agencies, other than on the border.
  1. We start to hear stories about how they’re being used. Most departments and agencies are relatively careful at first, and we begin to hear stories about drones being put to use in specific, mostly unobjectionable police operations such as raids, chases, and searches supported by warrants.
  1. Drone use broadens. Fairly quickly, however, we begin to hear about a few departments deploying drones for broader, more general uses: drug surveillance, marches and rallies, and generalized monitoring of troubled neighborhoods.
  1. Private use is banned. A terrorist like the pilot who crashed his plane into an IRS building in Texas uses an explosives-laden drone to try to attack a public facility. In response, the government clamps down on private use of the technology. The net result is that the government can use it for surveillance but individuals cannot use it to watch the government.
  1. Drones become able to mutually coordinate. Multiple drones deployed over neighborhoods can be linked together, and communicate and coordinate with each other (see this video for an early taste of what that could look like). This allows a swarm of craft to form a single, distributed wide-area surveillance system such as that envisioned by the “Gorgon Stare” program.
  1. The analytics gets better. At the same time, drones and the computers behind them become more intelligent and capable of analyzing the video feeds they are generating. They gain the ability to automatically track multiple vehicles and bodies as they move around a city or town, with different drones handing off the tracking to each other just as a mobile phone network passes a signal from one cell to another as a user rides down the highway.
  1. Flight durations grow. Technology improvements (involving blimps, perhaps, or solar-power innovations) allow for drones to stay aloft for longer periods more cheaply, which becomes key in permitting their use for persistent surveillance.
  1. The cycle accelerates. The advancing technology incentivizes agencies to buy even more drones, which in turn spurs more technology development, and the cycle becomes self-perpetuating.
  1. Laws are further loosened. As drones get smarter and more reliable and very good at sensing and avoiding other aircraft, FAA restrictions are further loosened, permitting even autonomous flight.
  1. Pervasive tracking becomes common. Despite opposition, a few police departments begin deploying drones 24/7 over certain areas. The media covers the controversy but Congress takes no action, and eventually it becomes old news, and the practice spreads until many or most American towns and cities are subject to the practice.
  1. Technologies are combined. Drone video cameras and tracking analytics are combined or synched up with other technologies such as face recognition, gait recognition, license-plate scanners, and cell phone location data.
  1. The data is mined. With individuals’ comings and goings routinely monitored, databases are able build up records of where people live, work, and play—what friends they visit, bars they drink at, doctors they visit, what houses of worship, or political events, or sexually oriented establishments they go to—and who else is at those places at the same time. Computers comb through this data looking for “suspicious patterns,” and when the algorithms kick up an alarm, the person involved becomes the subject of much more extensive surveillance.

Ultimately, such surveillance leads to an oppressive atmosphere where people learn to think twice about everything they do, knowing that it will be recorded, charted, scrutinized by increasingly intelligent computers, and possibly used to target them.

I’m not sure how realistic this scenario is. Perhaps it is far-fetched (I hope so). But the questions to ask are: which of the above steps is unlikely to take place, and why? And if we don’t end up in the situation described, how close will we get?

May 2, 2012 Posted by | Civil Liberties, Full Spectrum Dominance, Timeless or most popular | , , , , , , , | Leave a comment

Time to Make Warrantless Home Video Surveillance Extinct

By Hanni Fakhoury | EFF | May 2, 2012

It seems that the government’s thirst for high tech surveillance can’t be quenched. First, came the NSA’s warrantless wiretap program. Then it was CISPA. Now, its warrantless video surveillance in the home. And just like we stood up against the NSA and CISPA, yesterday we told the Ninth Circuit Court of Appeals that invasive warrantless home video surveillance violates the Fourth Amendment.

Ricky Wahchumwah, a tribal member of the Yakima Nation, was suspected of selling bald and gold eagle feathers, as well as the feathers and pelts of other migratory birds, in violation of federal law. As part of its investigation, an undercover agent from the U.S. Fish and Wildlife Service went to Wahchumwah’s house, pretending to be interested in buying feathers and pelts. Wahchumwah let him in his house, not knowing that the agent was secretly recording everything with a tiny video camera hidden in his clothes. The agent proceeded to capture two hours of video of Wachumwah’s home, including interactions between Wachumwah and his partner and children, and was even left alone by Wachumwah for periods of time, who did not suspect he was being recorded.

Charged with violating the Bald and Golden Eagle Protection Act and the Lacey Act, Wahchumwah moved to suppress the video evidence as an unreasonable search under the Fourth Amendment. The trial judge denied his motion, ruling that since Wahchumwah let the agent into his house, and the agent could testify to everything he saw in the house, Wahchumwah had no expectation of privacy. Wahchumwah appealed this decision to the Ninth Circuit, and we filed an amicus brief supporting him.

As we explain in our brief, a video camera can capture far more detail than a human eye. And unlike the human mind, a video camera doesn’t forget. After all, if an officer’s observations were sufficient, there would be no need for the video camera in the first place. Building on the Supreme Court’s landmark decision in United States v. Jones, which ruled the Fourth Amendment prohibited the warrantless use of GPS surveillance to monitor a person’s car on public roads for 28 days, we make two main arguments.

First, the initial appellate opinion in Jones issued by the D.C. Circuit (at the time called United States v. Maynard) explained that although a person may reveal discrete parts of his movements when driving in public, “the whole of one’s movements over the course of a month is not actually exposed to the public because the likelihood anyone will observe all those movements is effectively nil.” While the Supreme Court affirmed the D.C. Circuit under a trespass theory instead, the D.C. Circuit’s astute point applies equally to video surveillance. Even if Wahchumwah permitted the undercover agent into his home, it would be extremely unlikely that Wahchumwah, or anyone else, would expect that his house guest was secretly video recording every little detail. And that meant even if Wahchumwah consented to the agent entering his house, he certainly did not consent to secret video surveillance.

Second, as Justice Sotomayor said in her concurring opinion in Jones, the fact that technology allows the government to cheaply and efficiently aggregate data in ways that were impractical in the past has the potential to “alter the relationship between citizen and government in a way that is inimical to democratic society.” While it is technically possible to follow someone for 28 days continuously, it is expensive and difficult. GPS technology now allows the government to track someone wherever they go and as long as they want, all from the comforts of the police station. A video camera does the same thing. Sure, its possible for someone to enter a house and write down everything they remembered seeing hours later when they leave the house. But a video camera is capable of aggregating an enormous amount of data that would be difficult for human senses to replicate. When a video camera secretly enters the home, it can capture things like the mail on your coffee table, the books on a shelf, or the pictures on your wall. And the whole point of a camera is to record and save for another day, allowing the government to not have to rely on the human mind’s tendency to forget. It can rewind again and again to examine every minute detail of the house.

In the past, such intensive video surveillance was reserved for serious, violent crimes. Today, its being used by Fish and Wildlife officers to investigate misdemeanors. A search warrant requirement strikes the right balance between the government’s need to investigate crime, and the public’s right to privacy — particularly in the home, the most private of all places. Hopefully, the Ninth Circuit will reverse the trial court, and eradicate this invasive warrantless surveillance once and for all.

Attached Documents

EFF Wahchumwah Amicus Brief

May 2, 2012 Posted by | Civil Liberties, Full Spectrum Dominance, Wars for Israel | , , , | Leave a comment

Austrian Activists Push Back Against EU Data Retention Directive

By Rebecca Bowe | EFF |  April 30, 2012

No sooner did a mandatory data retention law go into effect in Austria this month than thousands of Austrians banded together in a swift opposition campaign to overturn it. The Austrian law originated as the misshapen offspring of the 2006 European Data Retention Directive. Led by AK Vorrat Austria, a working group against mandatory data retention, the pushback against this mass-surveillance law demonstrates that opposition remains alive and well six years after the European Union adopted the infamous Directive.

The  Austrian data retention law compels all ISPs and telcos operating in Austria to retain everyone’s incoming and outgoing phone numbers, IP addresses, location data, and other key telecom and Internet traffic data. The information is collected for all citizens, rather than just those suspected criminal activity. In many cases, the data is handed over to law enforcement.

Austrian activists took advantage of a two-year delay of the implementation of this ill-conceived Directive in their country by mapping out their opposition strategy in advance. They sought to leverage a two tier strategy to beat back the Data Retention Directive at the European level, and to fight against the  Austrian data retention law at the national level.

One day before the law entered into force, Austrian activists organized funeral marches to protest this anti-privacy, anti-anonymity, anti-free expression law.

Now, just weeks after the Directive officially went into effect, its future hangs in the balance as a pair of efforts calling for its reversal speed toward Austria’s Constitutional Court. Austrian activists are seeking to overturn the legality of the Austrian law with a mass complaint filed with Austria’s Constitutional Court. With nearly 7,000 supporters formally signed on and 18,000 declaring their intent to join, that effort that is shaping up to be “the biggest complaint in the history of the republic,” according to European Digital Rights (EDRi), a coalition of 32 privacy and civil rights organizations working in the European Union, including EFF. AK Vorrat Austria initially announced that it hoped to bring 1,000 individuals together to sign onto the complaint – and surpassed that goal in two days’ time.

But activists aren’t stopping there. On a parallel track, AK Vorrat Austria has already gathered 100,000 signatures for a citizens’ initiative calling for their government to work towards the abolishment of the EU Directive. The signatures are enough to meet the required threshold to force the issue to be considered by the National Council, Austria’s legislative branch of government.

This isn’t the first time this Directive has sparked an uproar in Europe. When it first became clear that the EU was going to cave to governmental lobbying interests from the U.S. and UK and enact a sweeping law that would effectively legitimize mass surveillance, the Freedom not Fear movement responded with massive street protests in Germany and across Europe.

The opposition continues, and is only growing. Courts in Romania, Germany, and the Czech Republic have declared their national laws derived from the EU Directive to be unconstitutional, while a court in Ireland has referred a case to the European Court of Justice—the highest Court in Europe for matters related to European Union law—questioning the legality of the overall EU Data Retention Directive. The European Data Protection Supervisor Peter Hustinx has called the Directive “the most privacy-invasive instrument ever adopted by the EU in terms of scale and the number of people it affects.” Despite all this, the European Commission is still defending it even though it has not been able to provide any evidence that the Directive is necessary, and therefore legal, in the European Union.

Austrian Association for Internet users (VIBE!AT), the Ludwig Boltzmann Institute of Human Rights and several other Austrian activists are encouraging all concerned Austrians  to join this fight. Austrians can join the mass complaint against the Austrian data retention law by filling out the declaration form by May 18, available at verfassungsklage.at.

Meanwhile, all Austrians age 16 and older should support the citizens’ initiative online at zeichnemit.at (in German) to call for the abolishment of the EU data retention directive. Take Action: Sign the citizens’ initiative now. Tell the Austrian government to fight for the repeal of the European Data Retention Directive in Brussels.

May 1, 2012 Posted by | Civil Liberties, Full Spectrum Dominance | , , , , , , | Leave a comment

ACTA in the EU: We Can’t Call it Dead Yet

By Gwen Hinze | EFF | April 30, 2012

The Anti-Counterfeiting Trade Agreement (ACTA) was dealt a major blow on April 12 when MEP David Martin, the European Parliament’s rapporteur for the agreement and member of the Committee responsible for delivering the recommendation [doc] to European Parliament to adopt or reject the agreement, announced that he would be recommending a “no” vote. While the prospects of the European Parliament ratifying the agreement seems to have fortunately lessened, it does not mean that it’s a fait accompli that the European Parliament will reject ACTA. As we’ve noted before, ACTA is a plurilateral agreement designed to broaden and extend existing intellectual property enforcement laws to the Internet. It was negotiated in secret by a handful of countries, in a process that intentionally bypassed the checks and balances of existing international IP norm-setting bodies without any meaningful input from national parliaments, policymakers, or their citizens. In our second post on the ACTA State of Play, we’ll look at what’s happening in Europe and why we should all be keeping a close eye on what’s happening in Brussels. (For those interested in US developments, please see our previous post here).

While the EU and 22 of its 27 member states signed ACTA in January, the European Parliament must vote to adopt it for it to become part of European Union law. A complex process is underway involving five European Parliamentary committees. The first step involves four committees: the Committee on Civil Liberties, Justice and Home Affairs (LIBE), the Committee on Industry, Research and Energy (ITRE), the Legal Affairs Committee (JURI), and the Development Committee (DEVE). Each must each review ACTA according to their Committee’s particular subject matter expertise, and deliver an opinion to the fifth and lead Committee, the International Trade Committee (INTA).

The INTA Committee plays the key role of recommending ACTA’s adoption or rejection to European Parliament. While INTA’s opinion is highly influential, it is not binding. The final step in the ratification process is a plenary vote of the Members of European Parliament. MEPs must decide whether to adopt or reject ACTA in its entirety; no amendments are allowed. The vote is currently scheduled for early July, but it may occur later. Here are two great infographics from the European Parliament and from French organizations La Quadrature du Net and Owni.eu which illustrate the whole process.

Apart from this process at the EU level, individual EU member states must decide whether or not to ratify ACTA. This is because the agreement requires countries to put in place broader criminal sanctions for those who infringe IP, and for those who aid and abet them. EU law is not harmonized in relation to criminal penalties for IP infringement. Criminal laws are within the exclusive legislative power of the individual EU member states and so they must ratify ACTA for those provisions to be given effect. Five member states have now suspended ratification of ACTA (Latvia, Poland, Czech Republic, Slovakia, the Netherlands and Bulgaria) and Germany has said that it will wait to see how the European Parliament votes before deciding to ratify.

There are many moving pieces in this puzzle and they each exert different levels of influence on the European Parliament’s vote. The European Commission referred ACTA to the European Court of Justice, the highest court in Europe, on February 22 for an opinion on its compliance with EU law. The European Parliament’s INTA Committee, at the instigation of MEP David Martin, the current Rapporteur of ACTA within the European Parliament, considered but rejected its own referral of ACTA to the European Court of Justice in March. If this had gone ahead, it would have delayed the European Parliament’s plenary vote beyond July. The European Data Protection Supervisor issued an opinion [pdf] on the European Parliament’s proposed accession to ACTA on April 24 that obliquely criticized ACTA by noting that it permits measures for indiscriminate monitoring of communications that would be disproportionate for small scale infringements. Specifically, it includes voluntary cooperative enforcement measures that would permit ISPs to process personal data beyond what is permitted under EU law, and lacks the necessary limitations and safeguards to protect EU citizens’ personal data under EU law.

On April 12, the Rapporteur of ACTA within the European Parliament, MEP David Martin of the INTA Committee, announced that he would be recommending that the European Parliament vote no on ACTA, but suggested that the Commission could negotiate an alternative proposal. His recommendation concluded that:

Your rapporteur therefore recommends that the European Parliament declines to give consent to ACTA. In doing so, it is important to note that increased IP rights protection for European producers trading in the global marketplace is of high importance. Following the expected revision of relevant EU directives, your rapporteur hopes the European Commission will therefore come forward with new proposals for protecting IP.

While this should indeed be seen as a major blow to the prospects of a speedy ratification by the European Parliament and a rebuke to the European Commission which took the lead in negotiating ACTA for the EU, it does not mean that ACTA is dead in the EU.

Last week, several of the four committees involved in the first step of the process were scheduled to publish their opinions and deliver them to the INTA committee. These opinions are likely to be heavily influenced by the appointed Rapporteur for each committee. They are reportedly equally divided. Two of the four Rapporteurs oppose ACTA and two are strong supporters. EDRi has posted a draft opinion of the influential Legal Affairs Committee (JURI) rapporteur, MEP Marielle Gallo, who is a strong ACTA supporter. She had previously been proposing a fast vote on her draft opinion within JURI, but on April 26, she pushed instead for JURI to postpone its vote on the opinion. This seems like a further delaying tactic by ACTA supporters to slow down the process within the European Parliament until they’ve got the numbers for a yes vote while the fierce lobbying campaign continues apace in Brussels.

Everything comes down to how MEPs vote in the Parliamentary plenary vote. MEPs in European Parliament are members of political parties, and analysts in Europe are now trying to tabulate how the political party groups will vote on ACTA. As Joe McNamee, the Brussels-based Advocacy Co-ordinator for European Digital Rights noted in an insightful piece last week, the numbers look closer than you might think: 52.5% of the Parliament opposed to ACTA, to 47.5% in favor, if you extrapolate from the views of the Rapporteurs of the four committees involved in the first ratification step:

To put it in another way, if just 20 MEPs have their minds changed as a result of the massive lobbying campaign currently underway and organised by the European Commission and big business interests, then ACTA will be adopted. The situation becomes even more precarious when we consider that it often happens that more than 5% of MEPs do not vote (either absent or abstaining) meaning that the chances of the current tiny majority being sufficient are more a matter of luck than anything else.

We are at a stage where every single vote in the European Parliament is of huge value. If the pro-ACTA message of the rapporteurs in the Legal Affairs and (shockingly) the Development Committee prevail, this will create a new momentum and will be used to “prove” that ACTA is a legitimate proposal.

McNamee continues:

Assuming that the anti-democratic elements in the European Parliament will not be allowed to have their way, there are two possible outcomes. The first is the anti-ACTA campaign will be anesthetised by complacency – assuming victory, citizens will stop contacting Parliamentarians, will not take part in demonstrations and will reassure MEPs that our attention span is so short that we can be ignored on ACTA, that we can be ignored on the upcoming IPRED Directive, that we can be ignored on the upcoming Data Retention Directive. And we reassure our opponents that no future democratic movement will be able to sustain a campaign as long as needed. We lose. Europe loses.

Or we do our duty for European democracy and maintain our pressure right up until the vote. And then we win. And Europe wins.

The future of ACTA as an international agreement will be decided in Europe. While recent media reports have led many people to conclude that ACTA is dead, this is unfortunately not true. Worse, it’s quite a dangerous misconception to have rebounding through the zeitgeist at a time when we need every possible vote in the European Parliament for ACTA to be rejected in July. Citizens in Europe and elsewhere must now clearly and loudly voice our concerns about this  agreement to our elected representatives to counter-balance the content industry lobbyists that are hard at work in Brussels shoring-up support for ACTA. Now is the time to make your views heard. If you’re in the EU, contact your MEPs and urge them to vote no on ACTA.

~

More information on how to have your views heard is at the following resources:

EDRI’s ACTA campaign page

La Quadrature du Net’s ACTA campaign page

April 30, 2012 Posted by | Civil Liberties, Full Spectrum Dominance | , , , , , | Leave a comment

One Thing Maine, Virginia and Arizona Have in Common: Opposition to the NDAA

By Allie Bohm | ACLU | April 27, 2012

This week, the House Armed Services Committee has turned its attention back to the National Defense Authorization Act and began working on this year’s bill. You remember last year’s perversion that, for the first time in American history, codified indefinite military detention without charge or trial far from any battlefield? State legislators and activists and concerned citizens on the right and the left — and everyone in between — haven’t forgotten.

On Wednesday, Arizona’s state legislature sent a bill opposing the detention provisions in the NDAA to their governor. And, last week, a similar bill became law in Virginia, about a month after Maine passed a joint resolution to the same effect. Add to that list the cities and counties that have passed resolutions urging Congress to repeal the problematic provisions in the NDAA — Fairfax, Calif.; Santa Cruz, Calif.; El Paso County, Colo.; Fremont County, Colo.; Moffat County, Colo.; Weld County, Colo.; Cherokee County, Kan.; Northampton, Mass.; Alleghany County, N.C.; Macomb, N.Y.; Elk County, Pa.; and New Shoreham, R.I. — and the map starts looking awfully full. This is not a red state issue or a blue state issue or a purple state issue. A few of the resolutions are under-inclusive, but their message is still clear: across social and political lines, no one likes the idea of indefinite detention or mandatory military detention far from any battlefield. (Okay, except maybe Sen. Lindsey Graham (R-S.C.) and a few other misguided members of Congress.)

Will your town, city, county, or state be the next to speak up? You can make that happen. Check out our model legislation and activist toolkit for legislative language, talking points, and tips to help you get started. Our bill sends a message from your local legislative body to Congress that the indefinite military detention provisions of the NDAA should be repealed. The model legislation prohibits state and local employees from aiding the federal armed forces in the investigation, arrest, detention, or trial of any person within the United States under the NDAA. It also sends a message from your legislative body to Congress that the 2001 Authorization for Use of Military Force should expire at the end of the war in Afghanistan so that the government cannot continue to use the AUMF as justification for its claims that war is everywhere and anywhere and that the president can order the American military to imprison without charge or trial people picked up far from any battlefield.

And while you’re at it, head over to our Action Center and urge your member of Congress to fix the NDAA. The time is now. This year’s NDAA provides the perfect opportunity for Congress to fix last year’s debacle. And, we need you — and your state legislators and city council members — to speak up if we’re going to get Congress to finally do the right thing.

April 27, 2012 Posted by | Civil Liberties, Full Spectrum Dominance | , , , , , , | Leave a comment

CISPA passes House in unexpected last-minute vote

RT | 27 April, 2012

The House of Representatives has approved Cyber Intelligence Sharing and Protection Act with a vote count of 248-168. The bill is now headed for the Senate. President Barack Obama will be able to sign or cancel it pending Senate approval.

Initially slated to vote on the bill Friday, the House of Representatives decided to pass Cyber Intelligence Sharing and Protection Act (CISPA) Thursday after approving a number of amendments.

Apart from cyber and national security purposes, the bill would now allow the government to use private information obtained through CISPA for the investigation and prosecution of “cybersecurity crime,” protection of individuals and the protection of children. The new clauses define “cybersecurity crime” as any crime involving network disruption or hacking.

“Basically this means CISPA can no longer be called a cyber security bill at all. The government would be able to search information it collects under CISPA for the purposes of investigating American citizens with complete immunity from all privacy protections as long as they can claim someone committed a ‘cybersecurity crime.’ Basically it says the Fourth Amendment does not apply online, at all,” Techdirt’s Leigh Beadon said.

Declan McCullagh, correspondent from CNET News, says CISPA will cause more trouble than is immediately apparent.

“The most controversial section of CISPA is the language – that notwithstanding any other portion the of law, companies can share what they want as long as it’s for what they call a ‘cyber security purpose,'” he told RT.

CISPA was introduced in the House last November.  Critics chided the bill, saying its broad wording could allow the government to spy on individual Internet users and block websites that publish vaguely defined ‘sensitive’ data.

“[CISPA] doesn’t really have any protections against cyber threats, all it does is make people share their information. But that’s not going to solve the problem. What’s going to solve the problem is actual security measures, protecting the service in the first place, not spying on people after the fact,” Internet activist Aaron Swartz told RT.

The White House issued a statement Wednesday saying President Barack Obama would be advised to veto the bill if he receives it. The Obama administration denounces the proposed law for potentially giving the government cyber-sleuthing powers that would allow both federal authorities and private businesses to sneak into inboxes and online activities in the name of combating Internet terrorism tactics.

Earlier, the House of Representatives and Senate also considered adopting the Stop Online Piracy Act (SOPA) and Protect IP Act (PIPA). These bills sought to entitle the US government to curb access to “rogue websites” that illegally hosted intellectual property. The bills could effectively force search engines to remove these websites from search results, an action many private companies considered intrusive.

PIPA and SOPA were opposed by many Internet giants including Google, Mozilla, Facebook, Yahoo!, Wikipedia and Reddit. Google organized a petition against the legislation, while Wikipedia held a 24-hour blackout to protest the bill in January. As a result, SOPA was recalled while PIPA was postponed indefinitely.

However, CISPA was actually backed by Facebook, despite its opposition to SOPA and PIPA. In a blog post on April 13, Joel Kaplan, Vice President of US Public Policy at Facebook, argued that if enacted into law, the bill would “give companies like ours the tools we need to protect our systems and the security of our users’ information, while also providing those users confidence that adequate privacy safeguards are in place.”

A number of big companies, including AT&T, Microsoft, Boeing, Verizon and Oracle have also supported CISPA.

The CISPA battleground in numbers

April 27, 2012 Posted by | Civil Liberties, Corruption, Full Spectrum Dominance | , , , , , , | Leave a comment

Security for the 99%

By Dan Auerbach | EFF | April 25, 2012

The House of Representatives kicked off their “cybersecurity week” yesterday with a hearing titled “America Is Under Cyber Attack: Why Urgent Action is Needed.” Needless to say, the rhetoric of fear was in full force. A lot of topics were raised by members of Congress and panelists, but perhaps the most troublesome theme came from panelist and Former Executive Assistant Director of the FBI Shawn Henry, who repeatedly urged that good cybersecurity means going on the offensive:

“the problem with existing […] tactics is that they are too focused on adversary tools (malware and exploits) and not on who the adversary is and how they operate. Ultimately, until we focus on the enemy and take the fight to them […], we will fail.”

This offensively-minded approach has major pitfalls, as it could lead to more government monitoring and control over our communications. While we think an increased focus on catching criminals using existing tools is a fine tactic that could be used by law enforcement, we fear the temptation for law enforcement to increase their surveillance capabilities in order to successfully go on the offensive in the context of computer crimes. This could mean things like breaking into people’s computers without warrants, or disrupting privacy-enhancing tools like Tor. Needless to say, we think it would be a very bad idea to link our safety to the ability for law enforcement to effectively monitor people, and that is a danger of focusing solely on an offensive strategy. Instead, we would like to offer an alternative, defensively-oriented point of view regarding security, an important view that we think was not adequately represented in yesterday’s panel.

Securing U.S. critical infrastructure networks, corporate networks, and the Internet at large depends upon securing our computers and networked devices. Fundamentally, it’s very simple: fewer software vulnerabilities means more security. Once a vulnerability is patched and an upgraded version of software is available and in use, that increases safety for all of us. Ensuring that the right mechanisms are in place to maximize this baseline security should be a major focus area of any organized effort to secure our critical and other Internet infrastructure. This means encouraging the disclosure of vulnerabilities when they are found so that they can be fixed, and no longer exploited. This is what we mean when we talk about security for everyone. This defensive strategy also takes a view of vulnerabilities that includes engineering with security in mind: if software doesn’t force good security on administrators and other humans who have a role to play to keep things secure, then that should be considered a security vulnerability in that software.

In order to understand why vulnerabilities are the foundation of insecurity and ought to be the focus of defensive efforts, let’s take a bit of time for those new to the computer security world to define bugs, vulnerabilities, exploits, and a particularly nasty class of exploits called “zero-day” exploits.

What are bugs, vulnerabilities, exploits and “zero-day” exploits?

A software bug is a general term referring to an unintentional problem with a piece of software that causes the software to work in an unexpected or unintended way. Bugs can refer to low-level issues (“we started counting from 0 over here, but from 1 over there, and now this array is messed up”), or to high-level issues (“we didn’t implement a feature allowing people to see their open orders on this website”).

Security vulnerabilities are a class of bugs in software; these are the bugs that allow an attacker to gain unauthorized access to do something that she couldn’t before. This could mean gaining access to a remote computer, or to a private network, or to other private information. Once again, these range from low-level vulnerabilities (“We weren’t expecting the user to give a name that was 4 gigabytes long; our oversight allowed the user to crash the program and execute her malicious code on the victim’s system”) to high-level (“Since we didn’t force a user to use a strong passphrase, his account could be compromised”).

Exploits are pieces of software that actually take advantage of the security vulnerability and give the user running the software unauthorized access. A security vulnerability could lead to an exploit, although not all vulnerabilities lead to exploits.

Zero-day exploits are exploits that take advantage of an undisclosed vulnerability. Suppose there is a publicly known vulnerability in the browser Internet Explorer 6. Then any exploit based on that vulnerability is NOT considered a zero-day, and you can (often, theoretically) protect yourself from such a vulnerability. In this case, for example, you could do so by downloading Internet Explorer 9. However, if there is a “zero-day” in Internet Explorer 9, there’s nothing you can knowingly do as a user to protect yourself. This makes this type of vulnerability especially scary, since it could be used not just against unwitting users who haven’t upgraded their software, but against anyone.

Ok, got it. To make us safer, we need to patch vulnerabilities and prevent exploits, especially zero-day exploits. Does CISPA encourage this?

Unfortunately, the “cybersecurity” bill CISPA and other legislation under debate does NOT focus on this baseline security. Instead of encouraging the patching of vulnerabilities as quickly as possible, or offering solutions to improve the general security of networked computers, the bill encourages broad surveillance of personal data by companies and the government. This type of information sharing is largely unrelated to the core issue of vulnerabilities that need to be patched at the software level. It’s certainly possible that by mining that data one could come across an exploit or an unknown vulnerability and share it with the vendor, but the bill is NOT about sharing vulnerabilities so that they can be patched – it’s about sharing raw data in a way that could legitimize a public-private surveillance partnership. And this data sharing between companies and the government in no way encourages security vulnerabilities themselves to be shared with the relevant software vendors and developers so that they can be patched. In other words, it just doesn’t attack the root of the problem.

Why is fixing vulnerabilities at odds with taking an offensive approach to security?

If we take an offensive approach as Mr. Henry suggests, a “security for the 1%” situation seems likely to arise, in which vulnerabilities are sometimes kept secret, and mitigations or fixes for these vulnerabilities are selectively doled out by the government or other private security firms only to critical infrastructure or paying clients (the “1%” deemed worthy of protection). The government might even deploy black box systems to companies and infrastructure designed to mitigate exploits based on secret vulnerabilities while giving as little information as possible about those underlying vulnerabilities, even to the companies they are protecting. Either way, the vendor would not be told about the vulnerability and so anyone who wasn’t a recipient of the “privileged” information would be hung out to dry.

What is a better approach to security?

Changing the incentives and culture to encourage the right sort of information sharing concerning vulnerabilities is a complex problem, and we do not purport to have a complete solution. There are many pieces to the puzzle: what should be done about vendors who don’t care about security? What about users who don’t upgrade software, or go out of their way to be vulnerable? What about security researchers who discover vulnerabilities, and choose to sell this knowledge to the highest bidder, instead of ensuring that the vendor knows about the vulnerability and it gets fixed?

There are some common sense tactics that the government can take to help solve these problems. For starters, the government can itself commit to disclosing any known vulnerabilities to vendors so that they are promptly patched. Next, incentives could be put in place to encourage research that has broad beneficial effects for everyone’s security. For example, suppose a researcher invents a new testing technique that reduces how many exploitable vulnerabilities there are in software in general. This is a win for everyone, and we think the government should strongly encourage such research.1

But beyond these common sense suggestions, the main point we want to raise in this post is not to offer a solution to these problems, but rather suggest that anyone interested in security at the national and international level should be thinking hard about them. Taking an offensive approach has the potential to put our civil liberties in danger, and could create a situation in which our safety ebbs and flows with how well the intelligence community can spy on us. This precarious and undesirable situation can be avoided if instead we take a defensive approach to stop the problem at its core, working to ensure that everyone is maximally protected. Mr. Henry suggests that “offense outpaces the defense.” That seems like an oversimplification, but even if one accepts it to be true, we should not take this to be an immutable property of the world. Instead, we should work to change it by increasing our defensive efforts. Unfortunately, the “cybersecurity” debate does not seem to be addressing this point of view, but we hope that somebody brings it up during “cybersecurity week”.

In the mean time, please speak out against the misguided cybersecurity legislation by taking action against CISPA.

April 26, 2012 Posted by | Civil Liberties, Full Spectrum Dominance | , , , , | Leave a comment