White House Going With 'Security By Obscurity' As Excuse For Refusing To Release Healthcare.gov Security Details

from the hackers! dept

These days, in the computer security world, it's pretty well known that if you're relying on security by obscurity, you're not being secure. Somehow that message has not reached the techies working on Healthcare.gov. I guess it shouldn't be much of a surprise, given what a disaster the rollout of that site was, but everyone was claiming that the whole thing was under control these days, since real techies had been brought in to fix things. In fact, everyone was so happy with Mikey Dickerson's miraculous saving of the program that the White House set up a special US Digital Service for him to lead, allowing him to save other US government projects from near certain disaster.

But when the Associated Press filed a Freedom of Information Act request to find out how Healthcare.gov was handing its security it got rejected because, according to the White House, it might teach hackers how to break into the system:

In denying access to the documents, including what's known as a site security plan, Medicare told the AP that disclosing them could violate health-privacy laws because it might give hackers enough information to break into the service.

"We concluded that releasing this information would potentially cause an unwarranted risk to consumers' private information," CMS spokesman Aaron Albright said in a statement.

Of course, that suggests that merely revealing the security steps the site has taken will reveal massive vulnerabilities -- and, as most people with even the slightest bit of technological knowledge know, if that's the case, then it's likely the site has already been compromised. If revealing the security setup for the site will leave it open to being hacked, we should probably assume the site was hacked a long, long time ago. If they're deploying security right, merely telling the world what they're doing wouldn't increase the risk. The fact that they're afraid it will suggests that the security plan is dangerously weak.

Filed Under: foia, healthcare.gov, security, security by obscurity
Companies: associated press

As DOJ Hunts For 'Second Leaker,' Will It Also Explore Who Leaked The Intercept's Story To The AP?

from the questions-to-ponder dept

Earlier this week, Tim Cushing wrote about The Intercept's latest scoop, concerning the makeup of the US government's federal terrorist watchlist, and the fact that a large chunk of it isn't affiliated with any terrorist groups. While most of the article focused on that point, he made two other notes in passing -- the first was that it was obvious that this release was from a second leaker, not Snowden, and the second was about how the government "leaked" the story in a "friendlier" manner to the AP in order to beat The Intercept. We thought both of these asides were interesting, but they've both turned into big stories on their own.

CNN later confirmed that US government officials are now searching for the second leaker (though "second" may not be accurate either...), more or less confirming what many people had been suspecting. Meanwhile, the "scoop spoiling" by the federal government actually resulted in a semi-apology from the National Counterterrorism Center (NCTC) who gave the scoop to the AP. The NCTC claimed it had been working with the AP on a story for a while, and after seeing what The Intercept was doing, felt it needed to give them the heads up, though it also says it could have handled the situation better. Of course, this also makes it more likely that The Intercept won't bother giving the government much time (if any) to respond on future stories. Why risk the chance of having the government spoil the scoop again?

However, with all this concern about the "second leaker," Chris Soghoian asks a very good question. If the Justice Department is going to go hunting for whoever leaked the information to The Intercept, will it similarly go after whoever at NCTC was apparently providing the same basic information to the Associated Press? Or how about the person who told CNN that the US government believes there's a "second leaker"? Because that information is also a leak, and potentially a big one, given that it will alert the leaker that the government is searching for him or her.

Somehow, we don't think the DOJ will be too concerned about those leaks. "Official" leaks happen all the time and no one cares. It's just the leaks that make the government look bad that somehow are seen as criminal.

Filed Under: government leaks, leaker, leaks, terrorism, tsdb, watchlist
Companies: associated press, cnn, the intercept

AP Tells Reporters That Their Stories Are Too Long; Cut Out 'Bloated Mid-Level Copy'

from the but-why? dept

Every so often when we have guest posters here at Techdirt, they ask "what word count are you looking for" and I always provide the same answer: as long as it takes to tell the story you're telling -- no more, no less. This is the internet, and sometimes stories can be quite short and get the point across, and other times they can be quite long. There may be times that we're concerned where a story goes on too long, but that's mainly because it may lead to the key points disappearing in a sea of other stuff. In those cases, we may look for ways to shorten the post, or possibly split it into a multi-part series. But in an age where we don't need to fit things into a limited number of column inches, it seems appropriate to argue that any story should be as long as it needs to be.

The Associated Press, it appears, has other ideas. It has sent out a memo to folks that most of its stories need to be shorter:

Citing a “sea of bloated mid-level copy,” Associated Press Managing Editor for U.S. News Brian Carovillano last week instructed fellow editors at the wire service to limit most “daily, bylined digest stories” to a length of between 300 and 500 words. Top stories from each state, Carovillano directed, should hit the 500 to 700-word range, and the “top global stories” may exceed 700 words but must still be “tightly written and edited.”

Now, it's true that in many cases (1) the AP is shooting for a much more mainstream audience and (2) they do have to worry about a limited number of column inches. But, still, the idea that stories across the board need to be "shorter" seems like a silly way to deal with it. We could argue (and, plenty of times, we will) that AP stories should be better written, but saying that they should all be shorter seems like a very weak hack to fix bad writing. Why not just focus on writing better?

Filed Under: journalism, word count
Companies: ap, associated press

George W. Bush Used Top Google Results For All His Paintings; Will He Be Sued For Copyright Infringement?

from the w-is-an-appropriation-artist dept

You may have heard the recent stories about former President George W. Bush's new exhibit of paintings of world leaders. There's been plenty of chatter about the former President picking up painting as a hobby since leaving office. While many may have assumed that he used his experience in meeting with those world leaders in order to have an accurate representation of what they looked like, the truth is that he just pulled results from Google Image search result for each one. Literally. Some people have gone through and done Google Image searches on each of the subjects he painted, and discovered that the paintings were clearly all based on either the very first result, or very near the top search result. Yes, that's right. George W. Bush is an appropriation artist.

Many of those images are from Wikipedia, where they're under Creative Commons licensing, but others are clearly covered by copyright. As Animal New York notes, the image of former French President Jacques Chirac comes from a photo of the cover of Chirac's book cover, where the copyright on the photo is actually held by the Associated Press. The Animal New York article is probably correct that it's unlikely that the Associated Press will go after the former President for copyright infringement, but only because it's hypocritical. In the past, the Associated Press did, in fact, sue Shepard Fairey over his iconic image of President Obama, that was also based on an AP photo. Fairey (stupidly) did himself in by trying to destroy evidence and then lie about it, seriously harming his case, and distracting from the central question of whether or not his image was fair use. But, the AP has sued others over that image as well, so you never know.

While the chances are minimal, it certainly would be interesting to have a case in which, of all people, George W. Bush, becomes the poster child for fair use.

Filed Under: appropriation art, copyright, george w. bush, image search, paintings, photographs, shepard fairey
Companies: associated press

Federal Judge Paraphrases Mike Rogers; Tells Muslims Their Rights Can't Be Violated If They Don't Know They're Being Violated

from the and-not-even-AFTER-that-either,-apparently dept

The federal judge handling the lawsuit seeking an injunction against the NYPD's pervasive surveillance of Muslims appears to have taken a page from Rep. Mike Rogers' book. Judge William Martini has dismissed the case, stating that the only reason the plaintiffs claimed their rights were being violated is because someone told them their rights were being violated.

Marcy Wheeler at emptywheel sums it up:

The core of his logic is that Adam Goldman and Matt Apuzzo have injured NYC’s Muslim community by providing them proof of the spying targeted at them.

From the ruling itself:

None of the Plaintiffs’ injuries arose until after the Associated Press released unredacted, confidential NYPD documents and articles expressing its own interpretation of those documents. Nowhere in the Complaint do Plaintiffs allege that they suffered harm prior to the unauthorized release of the documents by the Associated Press. This confirms that Plaintiffs’ alleged injuries flow from the Associated Press’s unauthorized disclosure of the documents. The harms are not “fairly traceable” to any act of surveillance.

Your rights aren't violated until you know they've been violated. And even then, knowing they've been violated apparently doesn't give you standing to pursue this claim, at least not according to Judge Martini.

Martini takes time to lay into the acts of journalism that led to this suit being filed, pointing out that the AP's reporters "covertly" obtained access to NYPD documents, before (shock!) publishing them (without authorization) along with their "interpretation" of the confidential papers. If these two reporters would have minded their own business, no one would have known their rights were being violated and Judge Martini wouldn't have been inconvenienced by having to consider the plaintiffs' claims.

Martini's reasoning is just as flawed as Rogers', but he does Rogers one better by detailing the sort of pervasive surveillance he finds to be perfectly non-rights-violating. Back to Wheeler:

Martini said all this spying was cool because it was designed to find Muslim terrorists hiding among Muslims...

As I emphasized here, when it was first reported, NYPD wasn’t hunting for Muslim terrorists in places where the 9/11 terrorists were known to hang out — cheap hotels, gyms, cybercafes, and a bunch of other businesses catering to anonymity rather than Muslims. Rather, the NYPD was hunting terrorists in schools in Newark, including the one above teaching girls in fifth to twelfth grade, and another teaching first through fourth graders.

The NYPD was hunting terrorists in a girls school.

The plaintiffs' expressed concerns that past surveillance efforts could negatively affect their futures are waved away for being speculative rather than "provable." This is more the law in general rather than Martini's interpretation, but up until the AP exposed the documents, the NYPD's surveillance programs were also more speculative than provable. And given recent history, how much "speculation" is actually being deployed here?

Plaintiffs Syed Hassan, Soofia Tahir, and Zaimah Abdur-Rahim fear that being the subjects of surveillance will interfere with their careers. Hassan is a U.S. Soldier and Tahir is expecting to begin a career in international social work. Both plaintiffs allege that career advancement will require background checks and security clearances. Both allege that their affiliations with organizations falsely labeled as “threats” will hinder their career advancement.

Who knows what sort of flags the NYPD's surveillance will raise on background checks, or whether anything noted by the department is actually merited? The NYPD's informants have been known to inflate claims and flat out make stuff up just to meet the expectations of the Demographics Unit. Simply putting their names into the system could create problems for the claimants. Just ask Dr. Ibrahim, who spent a decade on the TSA's "no fly" list because of an FBI agent's clerical error.

But take away all the other questionable parts of Martini's decision and we're still left with this: a federal judge telling plaintiffs their rights weren't violated until the program was exposed, and even then, actually weren't violated.

Filed Under: mike rogers, nypd, surveillance, william martini
Companies: associated press

DOJ Puts Another Leaker In Jail: The War On Whistleblowers Rolls On

from the no-leaks-allowed dept

You may recall that, prior to the whole Snowden affair, the DOJ was under fire for spying on the phone records of a bunch of Associated Press journalists. The issue was some details of the US disrupting a supposed plan by al-Qaeda in the Arabian Peninsula (AQAP) to bomb a US-bound plane were leaked. The DOJ has now triumphantly announced a guilty plea for the leak from Donald Sachtleben, an ex-FBI agent, who apparently gave detailed info about the plot to AP journalists. Sachtleben was already dealing with charges for child porn, so this just piles on top of that. He's agreed to serve 43-months in jail for the leak, covering both a charge of disclosing national defense information as well as retaining classified info.

While this does seem like a case of more of a general "leak" rather than direct whistleblowing, it clearly fits in with the President's war on whistleblowers, whose architect loves to send people to jail to make an example of them.

It's still difficult to see how this justified spying on so many AP phone lines. While some keep insisting that the leak was really dangerous, as has been previously noted, now CIA boss (prior to being in that position) appeared to reveal a lot more about the "plot" that suggested that here was never any actual threat at all. Furthermore, the AP had agreed to hold off on publishing the info until the government had made it clear that there was no risk.

Filed Under: aqap, arrests, doj, donald sachtleben, leaks, surveillance
Companies: associated press

Reporters Tell Attorney General Eric Holder They Won't Agree To 'Off The Record' Meeting As Scale Of Journalist Spying Expands

from the thousands-and-thousands dept

A few quick updates on the continuing saga of the DOJ's highly questionable spying on the communications of reporters. First up, we find out that the AP is claiming that the DOJ's scooping up of phone records wasn't nearly as limited as some people have suggested, but rather contained records for "thousands and thousands" of phone calls. Remember, the DOJ's own guidelines say that any such record retrieval must be very targeted rather than broad.

Of course, as all of this was happening, a sympathetic story leaked to the press, claiming that Eric Holder feels tremendous remorse for the specific case of the spying on James Rosen. Though, as you read the details, it sure sounds a lot more like "political expediency" rather than honest "remorse."

The sweeping seizure of the AP phone records had thrown Justice on the defensive. But at least in that case Holder had some personal insulation; having been interviewed by the FBI, he'd recused himself from the investigation and, thus, had not personally signed off on the subpoenas. In the Fox case, however, Holder knew he bore a direct measure of responsibility. He had approved a search-warrant application that equated a reporter's newsgathering activities with criminal conduct. That put Holder at the center of the brewing controversy, all while the Obama administration was being buffeted over allegations that the IRS had targeted conservative groups and by the continuing Benghazi tempest.

By week's end, Holder knew he had to be proactive in stemming the criticism and restoring the department's credibility with the press. He and his advisers began exploring ways to reform the Justice Department's internal guidelines for investigating leaks to safeguard the media against overly intrusive tactics. (Obama announced a review of the guidelines during a major speech on counterterrorism last Thursday.) Meanwhile, on Friday, Holder made a round of calls to Capitol Hill in an attempt to mollify concerned lawmakers. In calls to Sens. Charles Schumer (D-NY), Dick Durbin (D-Ill.), and Lindsey Graham (R-SC), Holder said he understood why there had been such an outcry over his department's actions. As one of Holder's advisers put it, the message was: "Look we get it. We understand why this is so controversial, and we're ready to make changes to find the right balance." At the same time, Holder enlisted their help to get a media-shield law passed in Congress. (On Sunday, Schumer announced the formation of a bipartisan "gang of eight" to press for the legislation.)

However, he supposedly is upset that his public image is not reflective of what he thinks of himself.

But sources close to the attorney general says he has been particularly stung by the leak controversy, in large part because his department's—and his own—actions are at odds with his image of himself as a pragmatic lawyer with liberal instincts and a well-honed sense of balance—not unlike the president he serves.

Of course, one way to avoid being accused of such things is... you know... not to do them in the first place.

In response, Holder announced that he'd be holding a meeting with news organizations to go over the DOJ's guidelines on getting access to such information. But, he couldn't even do that correctly. After announcing that this meeting would be off-the-record, a variety of news organizations, including the NY Times and the Associated Press announced they would not attend.

Of course, they could just attend and then "leak" the results. What would Holder do in response?

Filed Under: attorney general, eric holder, off the record, reporters, spying
Companies: associated press, ny times

AP's Attempt At DRM'ing The News Shuts Down

from the total-failure dept

Plenty of people rightly mocked the news a few years ago that the Associated Press was working on a plan to "DRM the news." The idea was to put some sort of licensing mechanism together to get news aggregators to pay to promote their news. This seemed incredibly dumb for a whole host of reasons. It added no value. Its only purpose was to limit the value for everyone in the system by putting a tollbooth where none needed to exist. When it finally launched last year to great fanfare in the newspaper world, under the name "NewsRight," we pointed out that, once again, it made no sense. Basically, the whole focus appeared to be on getting bloggers and aggregators to pay for a license they legally did not need.

Since the launch... we heard absolutely nothing about NewsRight. There was a launch, with its newspaper backers claiming it was some huge moment for newspapers, and then nothing.

Well, until now, when we find out that NewsRight quietly shut down. Apparently, among its many problems, many of the big name news organization that owned NewsRight wouldn't even include their own works as part of the "license" because they feared cannibalizing revenue from other sources. So, take legacy companies that are backwards looking, combine it with a licensing scheme based on no legal right, a lack of any actual added value and (finally) mix in players who are scared of cannibalizing some cash cow... and it adds up to an easy failure.

Filed Under: drm, journalism, licensing, news
Companies: associated press, newsright

What National Security Risk? Evidence Suggests Embarassment Drove DOJ Spying On AP Phone Records

from the national-security? dept

The saga concerning the DOJ scooping up phone records of Associated Press has continued to expand. The DOJ sent a quick and rather disingenuous letter in response to the AP's complaint. In it, the DOJ -- contrary to its own history of abusive practices concerning reporter phone records -- insists that it was incredibly careful to only seek key information involving classified information that "can risk lives and cause grave harm to the security of all Americans."

The AP quickly hit back by calling bullshit on the DOJ's claims of a "narrowly" focused subpoena:

The scope of the subpoena was overbroad under the law, given that it involved seizing records from a broad range of telephones across AP’s newsgathering operation. More than 100 journalists work in the locations served by those telephones. How can we consider this inquiry to be narrowly drawn?

Furthermore, the AP claims that while the DOJ says that only some records were obtained, the original notification it received indicated a very broad swath of phone records.

However, the real question that's beginning to come out is whether or not this was really such a serious issue that the DOJ needed to sweep in and grab a bunch of phone records, likely revealing protected journalistic sources. We've discussed in the past how the Obama administration has been the most aggressive in history in going after whistleblowers and anyone who leaks to the press -- and, because of that, many are rightly wondering if that's what's driving the DOJ here. As more details come out, there is a very strong indication that the investigation had absolutely nothing to do with security at all.

A few years ago, we wrote about how Daniel Ellsberg (one of the most famous whistleblower/leakers of all time) speculated that President Obama's unprecedented attacks on whistleblowers were really out of embarrassment about questionable things his administration was doing being revealed. That may be the case with this particular leak and investigation as well. The AP has pointed out repeatedly that the report they published -- concerning the thwarting of another underwear bomber -- had been held back, but they only published it after the government had said there was no more threat:

We held that story until the government assured us that the national security concerns had passed. Indeed, the White House was preparing to publicly announce that the bomb plot had been foiled.

But the issue appears to go deeper than that. Eric Holder made some extreme claims about the leak to defend the collection of the phone records:

This was a very serious leak. A very, very serious leak. I’ve been a prosecutor since 1976, and I have to say that this is among, if not the most serious, it is within the top two or three most serious leaks I’ve ever seen. It put the American people at risk. And that is not hyperbole. It put the American people at risk.

However, as emptywheel points out in the link above, John Brennan, now head of the CIA, apparently was the one who revealed to the press the fact that the bomber was a US agent and that there was no real risk to anyone. During his appointment hearings, when questioned about leaking that info to the press, Brennan explained:

I think what you're referring to, Senator, is when I had a teleconference with some individuals, former government officials from previous administrations who were going to be out on talk shows on the night that a IED was intercepted.

And so I discussed with them some of the aspects of that, because I was going on the news network shows the following day, I wanted to make sure they understood the nature of the threat and what it was and what it wasn't.

And so what I said, at the time, because I said I couldn't talk about any operational details, and this was shortly after the anniversary of the Bin Laden takedown, I said there was never a threat to the American public as we had said so publicly, because we had inside control of the plot and the device was never a threat to the American public.

When asked more specifically about this, Brennan again insisted that there was no threat because the US was in control. As emptywheel asks, if this particular leak of information -- which it seems Brennan did directly -- was really so much of a threat that "put people at risk," then why would Brennan be appointed and approved to head the CIA?

So, now we have a situation where the AP reported on information which it's pretty clear the government told them was no security risk. That resulted in the eventual "outing" that the guy who had the bomb was a US controlled agent, which is apparently why the US government was upset. But that outing seems to have come not from these reporters, but from the now head of the CIA directly to members of the press. And yet it's the reporters that are being aggressively investigated, while Brennan gets the job at the top of the CIA?

Once again, this points to an administration cracking down on leaks not because of any real risk or threat, but out of embarrassment.

Filed Under: cia, doj, eric holder, john brennan, journalism, leaks, national security, reporting, whistleblowing
Companies: associated press

DOJ Unconcerned About The Constitution, Obtained AP Reporters' Phone Records

from the freedom-of-the-press?-ha!-what's-that? dept

We've talked quite a bit about how the federal government has been pretty aggressively shattering any remnants of the 4th amendment, and while there are some parts of the 1st amendment that are still respected, our government doesn't always seem so keen on that one either. Apparently, they've decided to kill two birds with one stone recently, in obtaining a broad collection of phone records concerning Associated Press journalists, which is almost certainly in violation of the law. The AP only just found out about this on Friday, despite the data already being obtained, and covering more than 20 separate phone lines (including work, home and mobile phones) for multiple AP journalists -- and a period covering approximately two months in early 2012. The AP has sent a quite reasonably angry letter to Attorney General Holder about this collection.

There can be no possible justification for such an overbroad collection of the telephone communications of The Associated Press and its reporters. These records potentially reveal communications with confidential sources across all of the newsgathering activities undertaken by the AP during a two-month period, provide a road map to AP’s newsgathering operations, and disclose information about AP’s activities and operations that the government has no conceivable right to know.

That the Department undertook this unprecedented step without providing any notice to the AP, and without taking any steps to narrow the scope of its subpoenas to matters actually relevant to an ongoing investigation, is particularly troubling.

The sheer volume of records obtained, most of which can have no plausible connection to any ongoing investigation, indicates, at a minimum, that this effort did not comply with 28 C.F.R. §50.10 and should therefore never have been undertaken in the first place. The regulations require that, in all cases and without exception, a subpoena for a reporter’s telephone toll records must be “as narrowly drawn as possible.’’ This plainly did not happen

The AP also (again, quite reasonably) notes that this appears to be a "serious interference with AP's constitutional rights to gather and report the news" and demand that the government destroy all copies of the data it received.

This really is an incredibly broad move by the government. Especially when it comes to reporters, the government has generally respected the right for reporters to keep their sources private, even if this administration has been known to threaten reporters if they won't reveal sources. In case you're wondering the law here is pretty clear about the limitations on getting this kind of info.

There should be reasonable ground to believe that a crime has been committed and that the information sought is essential to the successful investigation of that crime. The subpoena should be as narrowly drawn as possible; it should be directed at relevant information regarding a limited subject matter and should cover a reasonably limited time period. In addition, prior to seeking the Attorney General's authorization, the government should have pursued all reasonable alternative investigation steps as required by paragraph (b) of this section.

I'm sure that Eric Holder will try to tapdance around this one as well, but the claims here are very serious. On the positive side, perhaps this will finally help the press wake up to the continued expansion of the federal government's surveillance operations and their general disdain for the constitution if it helps them go after whoever they want. The press likes to go nuts when some startup accidentally leaks some data or tracks what people are doing online, but routinely ignores how the government seems to feel entitled to any bit of private data about anyone, often without a warrant. Perhaps having the press have their records taken will wake some of them up to the fact that it impacts them as well (perhaps even more than others).

Filed Under: 1st amendment, 4th amendment, confidentiality, doj, eric holder, reporters, sources
Companies: associated press