Big News: Appeals Court Says CFAA Can't Be Used To Stop Web Scraping

from the this-is-good dept

Two years after a lower court correctly decided that LinkedIn couldn't use the CFAA to stop third parties from scraping their site, the 9th Circuit appeals court has upheld that decision in a very important decision for the future of an open web. For a long time we've talked about how various internet companies -- especially the large ones -- have abused the CFAA to stop competition and interoperability. If you're unaware, the CFAA is basically the US's "anti-hacking" law, which was designed to make it a crime (and a civil infraction) to "break into" someone else's computer. But for years it's been interpreted way too broadly (to the point that it's referred to as "the law that sticks" when trying to get someone for "doing something bad on a computer."

While we have tremendous concerns about criminal CFAA prosecutions, the use of CFAA in civil contexts by companies trying to block competition is perhaps just as troubling. We've called out Craigslist and, especially, Facebook for abusing the CFAA to stop companies from building on what they've built and providing a better service. To this day, we remain troubled by the 9th Circuit siding with Facebook in declaring the CFAA an okay tool to block a third party from building a better service for Facebook users and believe (somewhat strongly) that this particular decision and abuse is part of why Facebook is in the position its in today and that there are no significant competitors it faces. In that decision, the 9th Circuit ruled that because Facebook had sent a cease-and-desist letter to Power, any access after that was now "without authorization" and thus violated the CFAA.

And that's part of what makes this new HiQ v. Linkedin decision, done by the very same court, so fascinating. It seems to go the other way. While Facebook was allowed to use the CFAA to stop Power users from scraping content from Facebook (with permission from the account holder), here, the 9th Circuit has ruled that LinkedIn can't (at this stage) use the CFAA to stop HiQ from scraping its site.

The fact that the results in HiQ and Power came out differently deserves some exploration -- and we can highlight ways in which both decisions are weird and troubling. But from a pure policy standpoint, saying that scraping a site does not violate the law is an undeniably good thing and we should be happy with the overall outcome. Though, the it's now set up a weird system where the 9th Circuit itself seems to disagree with itself and there's a wider circuit split -- meaning it's possible that the Supreme Court could take up this issue at some point.

In discussing the CFAA, this 9th Circuit panel seems to fully understand the intention of the CFAA: to stop hacking. Not to stop companies from blocking people/companies they dislike:

The 1984 House Report on the CFAA explicitly analogized the conduct prohibited by section 1030 to forced entry: “It is noteworthy that section 1030 deals with an ‘unauthorized access’ concept of computer fraud rather than the mere use of a computer. Thus, the conduct prohibited is analogous to that of ‘breaking and entering’ . . . .’” H.R. Rep. No. 98-894, at 20 (1984); see also id. at 10 (describing the problem of “‘hackers’ who have been able to access (trespass into) both private and public computer systems”). Senator Jeremiah Denton similarly characterized the CFAA as a statute designed to prevent unlawful intrusion into otherwise inaccessible computers, observing that “[t]he bill makes it clear that unauthorized access to a Government computer is a trespass offense, as surely as if the offender had entered a restricted Government compound without proper authorization.”11 132 Cong. Rec. 27639 (1986) (emphasis added). And when considering amendments to the CFAA two years later, the House again linked computer intrusion to breaking and entering. See H.R. Rep. No. 99-612, at 5–6 (1986) (describing “the expanding group of electronic trespassers,” who trespass “just as much as if they broke a window and crawled into a home while the occupants were away”).

In recognizing that the CFAA is best understood as an anti-intrusion statute and not as a “misappropriation statute,” Nosal I, 676 F.3d at 857–58, we rejected the contract-based interpretation of the CFAA’s “without authorization” provision adopted by some of our sister circuits.

That's all good -- and because of that, the court finds that LinkedIn can't claim that scraping their site is a CFAA violation, even after a cease-and-desist. But, it tries to differentiate from the Facebook v. Power decision by saying that one involves a password, and the other does not. So it's the fact that the information being scraped on LinkedIn is public information that changes the calculus here.

We therefore conclude that hiQ has raised a serious question as to whether the reference to access “without authorization” limits the scope of the statutory coverage to computer information for which authorization or access permission, such as password authentication, is generally required. Put differently, the CFAA contemplates the existence of three kinds of computer information: (1) information for which access is open to the general public and permission is not required, (2) information for which authorization is required and has been given, and (3) information for which authorization is required but has not been given (or, in the case of the prohibition on exceeding authorized access, has not been given for the part of the system accessed). Public LinkedIn profiles, available to anyone with an Internet connection, fall into the first category. With regard to such information, the “breaking and entering” analogue invoked so frequently during congressional consideration has no application, and the concept of “without authorization” is inapt.

Neither of the cases LinkedIn principally relies upon is to the contrary. LinkedIn first cites Nosal II, 844 F.3d 1024 (9th Cir. 2016). As we have already stated, Nosal II held that a former employee who used current employees’ login credentials to access company computers and collect confidential information had acted “‘without authorization’ in violation of the CFAA.” Nosal II, 844 F.3d at 1038. The computer information the defendant accessed in Nosal II was thus plainly one which no one could access without authorization.

So too with regard to the system at issue in Power Ventures, 844 F.3d 1058 (9th Cir. 2016), the other precedent upon which LinkedIn relies. In that case, Facebook sued Power Ventures, a social networking website that aggregated social networking information from multiple platforms, for accessing Facebook users’ data and using that data to send mass messages as part of a promotional campaign. Id. at 1062–63. After Facebook sent a cease-and-desist letter, Power Ventures continued to circumvent IP barriers and gain access to password-protected Facebook member profiles. Id. at 1063. We held that after receiving an individualized cease-and-desist letter, Power Ventures had accessed Facebook computers “without authorization” and was therefore liable under the CFAA. Id. at 1067–68. But we specifically recognized that “Facebook has tried to limit and control access to its website” as to the purposes for which Power Ventures sought to use it. Id. at 1063. Indeed, Facebook requires its users to register with a unique username and password, and Power Ventures required that Facebook users provide their Facebook username and password to access their Facebook data on Power Ventures’ platform. Facebook, Inc. v. Power Ventures, Inc., 844 F. Supp. 2d 1025, 1028 (N.D. Cal. 2012). While Power Ventures was gathering user data that was protected by Facebook’s username and password authentication system, the data hiQ was scraping was available to anyone with a web browser.

That last bit... confuses me. Yes, the information that was at stake in the Power case was locked up with password protection, but (and this is the important part), it was the user whose password it was that gave permission to Power to access the data in Facebook on their behalf. So I have trouble seeing how it's really that different than this HiQ case. This ruling seems to suggest that there's some magical property to a password that doesn't seem supported by the law. In the Power case, the access is still very much "authorized" because the holder of the password is giving it out. But the court tries to dance around this by pretending that the authorization question is different. I don't see how that makes any sense -- even if I'm happy that at least scraping of public info is considered fair game. Still, the panel leans in hard on the password question to distinguish these two cases:

For all these reasons, it appears that the CFAA’s prohibition on accessing a computer “without authorization” is violated when a person circumvents a computer’s generally applicable rules regarding access permissions, such as username and password requirements, to gain access to a computer. It is likely that when a computer network generally permits public access to its data, a user’s accessing that publicly available data will not constitute access without authorization under the CFAA. The data hiQ seeks to access is not owned by LinkedIn and has not been demarcated by LinkedIn as private using such an authorization system. HiQ has therefore raised serious questions about whether LinkedIn may invoke the CFAA to preempt hiQ’s possibly meritorious tortious interference claim.

Orin Kerr -- who probably knows more about the CFAA than anyone else -- has done a deep dive on this ruling as well, which is worth reading. As he notes, part of the weirdness in this case is procedural. HiQ is focused on getting a preliminary injunction stopping LinkedIn from using the CFAA to stop them from scraping the LinkedIn site. That sets the standards a bit lower than might otherwise be, and means that the ruling is not necessarily the final world on the CFAA in this situation. He also notes that this should be seen as a big win for the open internet, and (in many ways) isolates the Power decision as "an outlier."

I also think this decision renders Power Ventures an outlier. I may be biased, as I thought Power Ventures was wrong. As regular readers may remember, I represented Power Ventures on the petition for rehearing to try to get the panel decision overturned. But Power Ventures seemed to give cease-and-desist letters magical powers given their clarity and notice. It was possible to read Power Ventures broadly as saying that as long as the computer owner sends the cease-and-desist letter, the computer owner's written directive controls the CFAA question—the recipient is sent into Brekka-land where their access rights were withdrawn.

HiQ Labs now places a critical limit on Power Ventures. Under HiQ Labs, the cease-and-desist letter only controls access rights to non-public data. That seems to reduce Power Ventures to a limited application of Nosal II. Under both Nosal II and Power Ventures-as-construed-in-HiQ, once a computer owner tells you to go away, you can't then rely on a current legitimate user's permission to let you back in.

Putting the cases together, the Ninth Circuit law right now seems to go like this. You can scrape a public website, and you can violate terms of service, without violating the CFAA. However, you can only access non-public areas of a computer if you haven't had your access rights canceled before, either through a cease-and-desist letter or through the relationship ending that had granted you access rights.

As Kerr and the 9th Circuit itself note, however, there remains a circuit split between the 9th's hodge podge interpretations of the CFAA and other appeals courts. That certainly suggests that this could end up before the Supreme Court at some point.

One other note: I've seen a few lawyers, including those I respect, worry that this decision could actually lead to restrictions on the tools that sites themselves use to block more malicious parties. As Eric Goldman noted in his analysis:

Meanwhile, if server operators can’t restrict who can access their servers, then it will embolden data scavengers–including trolls, malefactors, and governments–who intend to weaponize the data against users.

This is one of the rare cases where I disagree with Goldman's analysis. I don't see how the ruling would lead to such a result. The ruling does suggest that it's tortious interference (this is separate from the CFAA analysis) for LinkedIn to block HiQ, since doing so undermine's HiQ's entire business. But I don't see how that same analysis would apply "trolls, malefactors, and governments." I do find the tortious interference discussion a bit confusing in its own right. While I don't think LinkedIn should be able to use the law to stop HiQ from scraping its site, it seems silly (and of questionable legality) to argue that it can't even use technical measures to block HiQ. But that's what the ruling appears to say:

LinkedIn’s threats to invoke the CFAA and implementation of technical measures selectively to ban hiQ bots could well constitute “intentional acts designed to induce a breach or disruption” of hiQ’s contractual relationships with third parties.

I agree on the use of the CFAA. But disagree on the point about "technical measures." One involves using the power of the government to block perfectly reasonable activity -- but the other is a purely technical question. And I don't see how or why the law should block any site from implementing technical measures to prevent access, even if overall public policy should encourage such access.

All in all this seems like a mostly good decision, with this oddity, combined with the tap dance to distinguish it from other rulings. Add in the big circuit splits and you can rest assured that this is nowhere near the last word on this matter.

Filed Under: 9th circuit, authorized access, cfaa, hacking, open access, scraping, tortious interference
Companies: facebook, hiq, linkedin, power ventures

Activism & Doxing: Stephen Miller, ICE And How Internet Platforms Have No Good Options

from the and-for-fun,-the-cfaa-and-scraping dept

Last month, at the COMO Content Moderation Summit in Washington DC, I co-ran a "You Make the Call" session with Emma Llanso from CDT. The idea was to turn the audience into a content moderation/trust & safety team of a fictionalized social media platform. We showed numerous examples of content or accounts that were "flagged" and then showed the associated terms of service, and had the entire audience vote on what to do. One of the fictional examples involved someone posting a link to a third-party website "contactinfo.com" claiming to have the personal phone and email contact info of Harvey Weinstein and urging people "you know what to do!" with a hashtag. The relevant terms of service included this: "You may not post personal information about others without their consent."

The audience voting was pretty mixed on this. 47% of the audience punted on the question, choosing to escalate it to a supervisor as they felt they couldn't decide whether to leave the content up or take it down. 32% felt it should just be taken down. 10% said to just leave it up and another 10% said to put a content warning flag on the content. We joked a bit during the session that some of these examples were "ripped from the headlines" but apparently we predicted the headlines in this case, because there are two stories this week that touch on exactly this kind of thing.

Example one is the story that came out yesterday, in which Twitter chose to start locking the accounts of users who were either tweeting Trump senior advisor Stephen Miller's cell phone number, or merely linking to a Splinternews article that published his cell phone number (which I'm guessing has since been changed...).

Splinternews decided to publish Miller's phone number after multiple news reports attributed the inhumane* decision to separate children of asylum seekers from their parents to Miller, who has defended the plan. Other reports noted that Miller is enjoying all of the controversy over this policy. Splinternews, citing Donald Trump's own history of giving out the phone numbers of people who anger him, thought it was only fair that people be able to reach out to Miller.

This is -- for fairly obvious reasons -- a controversial decision. I think most news organizations would never do such a thing. Not surprisingly, the number spread rapidly on Twitter, and Twitter started locking all of those accounts until the tweets were removed. That seems at least well within reason under Twitter's rules that explicitly state:

You may not publish or post other people's private information without their express authorization and permission.

But, that question gets a lot sketchier when it comes to locking the accounts of people who merely linked to the Splinternews article. A la our fictionalized example, those people are not actually publishing or posting anyone's private info. They are posting a link to a third party that purports to have that information. And, of course, in this case, the situation is complicated even more than our fictionalized example because Splinternews is a news organization (owned by Univision), and Twitter also has said that it has a "newsworthy" exception to its rules.

Personally, I think it's the wrong call to lock the accounts of those linking to the news story, but... as we discovered in our own sample version, it's not an easy call and lots of people have strong opinions one way or the other. Indeed, part of the reason why Twitter may have decided to do this was that supporters of Trump/Miller started calling out the article as an example of doxxing and claiming that leaving it up showed that Twitter was unfairly biased against them. It is a no win situation.

And, of course, it wouldn't take long before people started coming up with clever workarounds, such as Parker Higgins (citing the infamous 09F9 controversy in which the MPAA tried to censor the revelation of a cryptographic key that broke the MPAA's preferred DRM, and people responded by posting variations on the code, including a color chart in which the hex codes of the colors were the code), who posted the following:

Would Twitter lock his account for posting a two color image? At some point, the whole thing gets... crazy. That's not to argue that revealing someone's private cell phone number is a good thing -- no matter how you feel about Miller or the border policy. But just on the content moderation side, it puts Twitter in a no win situation in which people are going to be pissed off no matter what it does. Oh, and of course, it also helped create something of a Streisand Effect. I certainly hadn't heard about the Splinternews article or that people were passing around Miller's phone number until the story broke about Twitter whac'ing at moles on its site.

And that takes us to the second example, which happened a day earlier -- and was also in response to people's quite reasonable* anger about the border policy. Sam Lavigne decided to make something of a public statement about how he felt about ICE by scraping** LinkedIn for profile information on everyone who works at ICE (and who has a LinkedIn public profile). His database included 1595 ICE employees. He wrote a Medium blog post about this, posted the repository to Github and another user, Russel Neiss, created a Twitter account (@iceHRgov) that tweeted out info about each of those employees from that database. Notice that none of those are linked. That's because all three companies took them down (though you can still find archives of the Medium post). There was also an archive of the Github repository, but it has since been memory-holed as well.

Again... this raises a lot of questions. Github claimed that it removed the page for "violating community guidelines" -- specifically around "doxxing and harassment, and violating a third party's privacy." Medium claimed that the post violated rules against "doxxing" and specifically the "aggregation of publicly available information to target, shame, blackmail, harass, intimidate, threaten or endanger." Twitter, in Twitter's usual way, is not commenting. LinkedIn put out a statement saying: "We do not support or condone what immigration authorities are doing at the border, but we can’t allow the illegal use of our member data. We will take appropriate action to ensure our members’ data is protected and used properly."

Many people point out that all of this feels kind of ridiculous, seeing as this is all public info that the individuals chose to reveal about themselves on a public website. While Medium's expansive definition of doxxing makes things interesting by including an intent standard in releasing the info, even if it is publicly available, the whole thing, again, demonstrates how complex this is. I know that some people will claim that these are easy calls -- but, just for fun, try flipping the equation a bit. If you're anti-Trump, how would you feel if a prominent alt-right person compiled and posted your info -- even if publicly available -- on a site where alt-right folks gather, with the clear intent of having hoards of Trump trolls harassing you. Be careful the precedent you set.

If it were up to me, I think I would have come down differently than Medium, Github and Twitter in this case. My rationale: (1) all of this info was public information (2) that those individuals chose to place on a public website, knowing it was public (3) they are all employed by the federal government, meaning they are public servants and (4) while the compilation was done by someone who is clearly against the border policy, Lavigne never encouraged or suggested harassment of ICE agents. Instead, he wrote: "While I don’t have a precise idea of what should be done with this data set, I leave it here with the hope that researchers, journalists and activists will find it useful." He separately noted that he believed "it's important to document what's happening, and by whom." That seems to actually make a strong point in favor of leaving the data up, as there is value in documenting what's happening.

That said, reasonable people can disagree on this question (even if there should be no disagreement about how inhumane the policy at the border has been*) of what is the appropriate way for different platforms to handle these situations -- taking into account that this situation could play out with very different players in the future, and there is value in being consistent.

This is the very point that we were demonstrating with that game that we ran at COMO. Many people seem to think that content moderation decisions are easy: you just take down the content that is bad, and leave up the content that is good. But it's pretty rare that the content is easily classified in one of those categories. There is an enormous gray area -- and much of it involves nuance and context, which is not always easy to come by -- and which may look incredibly different depending on where you sit and what kind of world you think we live in. I still think there are strong arguments that the platforms should have left much of the content discussed in this post up, but I'm not the one making that call.

When we ran that game in DC last month, it was notable that on every single example we used -- even the ones we thought were "easy calls" -- there were some audience members who selected every option in the game. That is, there was not a single situation in our examples in which everyone agreed what should be done. Indeed, since there were four options, and all four were chosen by at least one person in every single example, it shows just how difficult it really is to make these calls. They are subjective. And what plays into that subjective decision making includes your own views, your own perspective, your own reading of the content and the rules -- and sometimes third party factors, including how people are reacting and what public pressure you're getting (in both directions). It is an impossible situation.

This is also why the various calls to mandate that platforms do this or face legal liability are even more ridiculous and dangerous. There are no "right" answers to these decisions. There are solutions that seem better to lots of people, but plenty of others will disagree. If you think you know the "right" way that all of these questions should be handled, I guarantee you're wrong, and if you were in charge of these platforms, you'd end up feeling just as conflicted as well.

This is why it's really time to start thinking about and talking about better solutions. Simply calling on platforms to be the final arbiters of what goes online and what stays offline is not a workable solution.

* Just a side note: if you are among the small minority of ethically-challenged individuals who gets upset that I describe the policy as inhumane: fuck off. The policy is inhumane and if you're defending it, you should seriously take time to re-evaluate your ethics and your life choices. On a separate note, if you are among the people who are then going to try to justify this policy as "but Obama/others did it too," the same applies. Whataboutism is no argument here. The policy is inhumane no matter who did it, and pointing out that others did it too doesn't change that. And, as inhumane as it may have been in the past, it has been severely ramped up. There is no defense for it. Attempting to defend it only serves to out yourself as a horrible person who has issues. Seriously: get help.

** This doesn't even fit anywhere in with this story, but scraping LinkedIn is (stupidly) incredibly dangerous. Linkedin has a history of suing people for scraping public info off of LinkedIn. And even if it's lost some of those cases, the company appears to take a pretty aggressive stance towards scrapers. We can argue about how ridiculous this is, but, dammit, this post is already too long talking about other stuff, so discuss it separately.

Filed Under: activism, content moderation, doxing, harassment, ice, internet platforms, phone numbers, stephen miller, takedowns
Companies: github, linkedin, medium, twitter

Germany Accuses Chinese Intelligence Services Of Using Fake LinkedIn Profiles To Recruit Informants And Extract Sensitive Information

from the well,-of-course-it's-not-just-Russia dept

Over the last year, the scale of Russia's disinformation activities has become clearer. Its Internet Research Agency has deployed an astonishing range of sophisticated techniques, included accounts on Twitter and Facebook, and hiring activists within the US without the latter being aware they were working for the Russian government. We also now know that the same organization has been buying Facebook ads on a large scale that were seen by over a hundred million US citizens. But it would be naïve to think that Russia is the only foreign power engaged in this kind of activity. In fact, it would be surprising if any intelligence agency worth its salt were not carrying out similar activities around the globe. The first detailed information about China's use of fake social media accounts to recruit informants and extract sensitive information has just been published by the Bundesamt für Verfassungsschutz (BfV), Germany's domestic intelligence service. As Reuters reports:

Nine months of research had found that more than 10,000 German citizens had been contacted on the LinkedIn professional networking site by fake profiles disguised as headhunters, consultants, think-tankers or scholars, the BfV said.

Quartz quotes the BfV's president, Hans-Georg Maaßen, as saying:

"We are dealing with a broad attempt to infiltrate parliaments, ministries and administrations," said Maaßen. “Chinese intelligence services are using new strategies of attack in the digital space."

An interim report on the analysis that appeared on the BfV site in July (original in German) explains how the Chinese operated. The supposed headhunters, scholars and Chinese officials claimed that there were interested in the specialism of the person being approached. They inquired about a possible exchange of professional views on the topic, and spoke of an "important customer" in China:

the Chinese contact persons ask those involved for a curriculum vitae and offered to pay for a trial project. If this was completed satisfactorily, an invitation is made to go to China to meet with the "important customer", with the costs of the stay being covered by the Chinese side. In fact, however, the "important customer" never appears and is not explicitly named. In due course, the persons involved are usually asked regularly to write reports in return for appropriate remuneration, or to pass on internal, sensitive information from the respective work area.

As part of its report, the BfV published a selection of the fake profies. Reuters explains:

Many of the profile pictures show stylish and visually appealing young men and women. The picture of "Laeticia Chen", a manager at the "China Center of International Politics and Economy" was nicked from an online fashion catalogue, an official said.

The Chinese Foreign Ministry spokesman Lu Kang was, of course shocked by the accusations, which he called "baseless":

"We hope the relevant German organizations, particularly government departments, can speak and act more responsibly, and not do things that are not beneficial to the development of bilateral relations," Lu said.

The implicit threat there chimes with two other stories about China that Techdirt published last month. In one of them, the Chinese authorities put pressure on the academic publisher Springer Nature to censor thousands of papers that dealt with topics that showed China in a less than flattering light. Similarly, Allen & Unwin was "persuaded" by the Chinese authorities not to publish a book about China's growing but covert influence in Australia. The row between Australia and China has since escalated further. The latter denounced remarks by Australian politicians as being "full of prejudices against China", and lodged a formal protest. Taken with the latest news of China's attempts to recruit informants using social media, these recent events are evidence of a newly aggressive China on the world scene -- and of what The Economist calls China's "sharp power".

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Filed Under: china, espionage, fake profiles, germany, surveillance
Companies: linkedin

Court Says CFAA Isn't Meant To Prevent Access To Public Data, Orders LinkedIn To Drop Anti-Scraper Efforts

from the perverting-a-bad-law dept

Some good pushback against the CFAA (Computer Fraud and Abuse Act) has been handed down by a federal court. LinkedIn, which has frequently sued scrapers under both the CFAA and DMCA, just lost an important preliminary round to a company whose entire business model relies on LinkedIn's publicly-available data.

hiQ Labs scrapes LinkedIn data from users whose accounts are public, repackages it and sells it to third party recruiters and HR departments, allowing companies to track employee skills and get a read on which employees might be planning to jump ship.

LinkedIn didn't care much for another business piggybacking on its data (and likely cutting back ever so slightly on the number of third parties it sells this data to), so it sued hiQ, alleging the scraping of publicly-available data violated the CFAA. This has completely backfired. hiQ has obtained an injunction preventing LinkedIn from blocking its scraping efforts. [h/t Brad Heath]

In short, the court finds the hardships are all on hiQ's side: if LinkedIn blocks the scraping, the company will likely close. The decision [PDF], importantly, notes this isn't what the CFAA was put in place to guard against. It also adds that if it sided with LinkedIn's arguments, the internet itself would suffer.

In summary, the balance of hardships tips sharply in hiQ's favor. hiQ has demonstrated there are serious questions on the merits. In particular, the Court is doubtful that the Computer Fraud and Abuse Act may be invoked by LinkedIn to punish hiQ for accessing publicly available data; the broad interpretation of the CFAA advocated by LinkedIn, if adopted, could profoundly impact open access to the Internet, a result that Congress could not have intended when it enacted the CFAA over three decades ago.

And there's more bad news for LinkedIn:

Furthermore, hiQ has raised serious questions as to whether LinkedIn, in blocking hiQ's access to public data, possibly as a means of limiting competition, violates state law.

LinkedIn tried to argue continued access by hiQ would threaten its own business, mainly through supposed violations of its customers' privacy. It notes many of its users (50 million to be exact) have deployed LinkedIn's "Do Not Broadcast" option, which limits notifications about changes to accounts. Out of the 50 million users, LinkedIn claims three have alleged harm from third-party data collection. LinkedIn says hiQ's scraped determinations about poachable employees could harm users whose accounts remain public, but are utilizing the "Do Not Broadcast" feature.

The court is not entirely unsympathetic to LinkedIn's arguments. But it is mostly unsympathetic, partially because LinkedIn appears to be vastly overstating the privacy concerns of its users...

These considerations are not without merit, but there are a number of reasons to discount to some extent the harm claimed by LinkedIn. First, LinkedIn emphasizes that the fact that 50 million users have opted into the "Do Not Broadcast" feature indicates that a vast number of its users are fearful that their employer may monitor their accounts for possible changes. But there are other potential reasons why a user may opt for that setting. For instance, users may be cognizant that their profile changes are generating a large volume of unwanted notifications broadcasted to their connections on the site. They may wish to limit annoying intrusions into their contacts.

Second, LinkedIn has presented little evidence of users' actual privacy expectation; out of its hundreds of millions of users, including 50 million using Do Not Broadcast, LinkedIn has only identified three individual complaints specifically raising concerns about data privacy related to third-party data collection. Docket No. 49-1 Exs. A-C. None actually discuss hiQ or the "Do Not Broadcast" setting.

...and partially because LinkedIn doesn't appear to care all that much about its users' privacy.

Third, LinkedIn's professed privacy concerns are somewhat undermined by the fact that LinkedIn allows other third-parties to access user data without its members' knowledge or consent. LinkedIn offers a product called "Recruiter" that allows professional recruiters to identify possible candidates for other job opportunities. LinkedIn avers that when users have selected the Do Not Broadcast option, the Recruiter product respects this choice and does not update recruiters of profile changes. However, hiQ presented marketing materials at the hearing which indicate that regardless of other privacy settings, information including profile changes are conveyed to third parties who subscribe to Recruiter. Indeed, these materials inform potential customers that when they "follow" another user, "[f]rom now on, when they update their profile or celebrate a work anniversary, you'll receive an update on your homepage. And don't worry – they don't know you're following them." LinkedIn thus trumpets its own product in a way that seems to afford little deference to the very privacy concerns it professes to be protecting in this case.

As for the alleged CFAA violations, the court find nothing that agrees with LinkedIn's legal theory public information anyone can access somehow turns into unauthorized access when a company accesses it via a scraper.

A user does not "access" a computer "without authorization" by using bots, even in the face of technical countermeasures, when the data it accesses is otherwise open to the public.

But it goes further, laying down in explicit detail how ruling in LinkedIn's favor would severely damage open access on the internet.

Under LinkedIn's interpretation of the CFAA, a website would be free to revoke "authorization" with respect to any person, at any time, for any reason, and invoke the CFAA for enforcement, potentially subjecting an Internet user to criminal, as well as civil, liability. Indeed, because the Ninth Circuit has specifically rejected the argument that "the CFAA only criminalizes access where the party circumvents a technological access barrier," Nosal II, 844 F.3d at 1038, merely viewing a website in contravention of a unilateral directive from a private entity would be a crime, effectuating the digital equivalence of Medusa. The potential for such exercise of power over access to publicly viewable information by a private entity weaponized by the potential of criminal sanctions is deeply concerning...

[T]he CFAA as interpreted by LinkedIn would not leave any room for the consideration of either a website owner's reasons for denying authorization or an individual's possible justification for ignoring such a denial. Website owners could, for example, block access by individuals or groups on the basis of race or gender discrimination. Political campaigns could block selected news media, or supporters of rival candidates, from accessing their websites. Companies could prevent competitors or consumer groups from visiting their websites to learn about their products or analyze pricing. Further, in addition to criminalizing any attempt to obtain access to information otherwise viewable by the public at large, the CFAA would preempt all state and local laws that might otherwise afford a legal right of access (e.g., state law rights asserted by hiQ herein). A broad reading of the CFAA could stifle the dynamic evolution and incremental development of state and local laws addressing the delicate balance between open access to information and privacy – all in the name of a federal statute enacted in 1984 before the advent of the World Wide Web.

The case will still proceed forward, but the outlook isn't that bright for LinkedIn. It has been ordered to drop any anti-circumvention efforts it put in place within 24 hours and rescind the cease-and-desist orders it sent to hiQ. On top of there being zero chance it will prevail on its CFAA claims, the company will now have to defend itself against state law counterclaims by hiQ. This legal effort -- probably deployed in hopes of achieving a quick settlement -- is going to add up to real dollars in legal fees alone.

Filed Under: cfaa, public data, scraping
Companies: hiq, linkedin

Russia Orders LinkedIn's Service To Be Blocked, Supposedly For Failing To Store Personal Data Locally

from the think-globally,-act-locally dept

Techdirt has written plenty of stories about Vladimir Putin's increasingly harsh clampdown on Internet freedom. But, like China, Russia is still coming up with new ways to tighten its control. One is the legal requirement that the personal data of Russian citizens must be stored on Russian soil. Now, a US company has fallen afoul of that 2015 law:

Russia's communications regulator [Roskomnadzor] ordered public access to LinkedIn's website to be blocked today (17 November) to comply with a court ruling that found the social networking firm guilty of violating data storage laws.

According to the EurActiv story, the ban is being put in place immediately:

LinkedIn's site will be blocked within 24 hours, the Interfax news agency cited Roskomnadzor spokesman Vadim Ampelonsky as saying. One internet service provider, Rostelcom, said it had already blocked access to the site.

What's curious is that LinkedIn is not the only US company to have flouted Russia's data localization law: both Google and Facebook have also ignored it. A post on NBC News suggests the following is the reason for that discrepancy:

A spokesman for the [Roskomnadzor] watchdog had earlier said that LinkedIn was punished for alleged leaks of user data, Russian media reported.

Information about 120 million LinkedIn user accounts was stolen in 2012, the attack reportedly blamed on Russian hackers.

Irrespective of the messy details of the LinkedIn case, requirements that personal data must be stored locally are likely to become an increasingly hot topic. Already, the EU is unwilling to finalize the Trade in Services Agreement (TISA) in part because of US demands that it should include unrestrained data flows -- something that could be illegal under EU privacy laws if applied to personal information.

With the person who will soon run the CIA keen on expanded government spying powers, it is almost certain that the current Privacy Shield framework, which allows the personal data of EU citizens to be sent to the US, will be struck down by the Court of Justice of the European Union. If that happens, the only way companies like Google, Facebook -- and LinkedIn -- would be able to operate in the EU would be to store their data on the continent. If they fail to comply, they won't be blocked, as in Russia, but they could be hit with a fine of up to 4% of their global turnover.

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Filed Under: data hosting, localization, russia, tisa
Companies: linkedin, microsoft

Disappointing: LinkedIn Abusing CFAA & DMCA To Sue Scraping Bots

from the please-don't-do-this dept

It's been really unfortunate to see various internet companies that absolutely should know better, look to abuse the CFAA to attack people using tools to scrape public information off of their websites. In the past few years, we've seen Facebook and Craigslist do this (with Facebook recently winning in court).

Now LinkedIn is doing the same thing, suing a bunch of anonymous users for scraping public information from LinkedIn. This is not the first time the company has done this. A few years ago, the company (using the exact same lawyers) filed a very similar lawsuit, eventually figuring out that the scraping was done by a wannabe competitor, HiringSolved, which pretty quickly settled the lawsuit, agreeing to pay $40,000 and erase all the data it collected.

The latest lawsuit appears to be more of the same, claiming that the scraping violates both the CFAA and the DMCA:

During periods of time since December 2015, and to this day, unknown persons and/or entities employing various automated software programs (often referred to as “bots”) have extracted and copied data from many LinkedIn pages. To access this information on LinkedIn’s site, the Doe Defendants circumvented several technical barriers employed by LinkedIn that prevent mass automated scraping, and have knowingly and intentionally violated various access and use restrictions in LinkedIn’s User Agreement, which they agreed to abide by in registering LinkedIn member accounts. In so doing, they have violated an array of federal and state laws, including the Computer Fraud and Abuse Act, 18 U.S.C. §§ 1030, et seq. (the “CFAA”), California Penal Code §§ 502 et seq., and the Digital Millennium Copyright Act, 17 U.S.C. §§ 1201 et seq. (the “DMCA”), and have engaged in unlawful acts of breach of contract, misappropriation, and trespass.

This is bullshit. Courts have directly held that violating a terms of service does not equate to a CFAA violation for "unauthorized access" or "exceeding authorized access." Here, it appears that LinkedIn is hoping that the combination of claiming a terms of service violation with attempts to get around technological protection measures makes it a CFAA violation.

I completely understand that LinkedIn may not like the fact that people are scraping its data, and that they've found ways around LinkedIn's attempts to block such scraping via technological means, but it's a dangerous slippery slope when a company is claiming that a terms of service violation violated the CFAA -- and that getting around simple blocks becomes a DMCA 1201 anti-circumvention violation. Both of these are problematic: saying that violating the terms of service violates the CFAA is a stretch and saying that violating the DMCA by getting around protection technology -- even if not for the purpose of infringing on copyrights -- is a problem.

Of course, this lawsuit, like the last one, is probably really designed to just sniff out who's running the bots, and to push them into a settlement where they'll stop doing so.

Still, this lawsuit seems particularly ridiculous coming just weeks after LinkedIn's founder and chairman, Reid Hoffman, funded a $250,000 disobedience award at MIT's Media Lab. The point of that award is to encourage people to engage in disobedience to change society in a positive way -- which is something that people often use scraping for. And yet, here his company is engaging in a legal battle that will make that kind of scraping much more risky. I know and like Hoffman, who is quite a smart, thoughtful and principled guy. And I have no idea if he even knew this lawsuit was going to be filed. But I think it sends the wrong message when he's encouraging useful hacking on the one hand, while his company (which, yes, was just sold to Microsoft) is suing people for doing the very same thing of hacking on the other hand.

Filed Under: bots, cfaa, dmca, scraping
Companies: linkedin

The White House Asks Silicon Valley What To Do To 'Disrupt' ISIS

from the not-that-kind-of-disruption... dept

As you may have heard, on Friday, a group of top White House officials, including Homeland Security director Jeh Johnson, FBI Director James Comey and NSA boss Admiral Michael Rogers, all came out to Silicon Valley to meet with tech execs to talk about how to "disrupt" groups like ISIS. On the tech side, a bunch of top execs came, including Apple CEO Tim Cook, Facebook COO Sheryl Sandberg, LinkedIn founder Reid Hoffman, Dropbox CEO Drew Houston and CloudFlare CEO Matthew Prince. The White House released a basic agenda publicly, though there was also apparently a more thorough briefing document that ran about 7 pages.

U.S. Government Meeting with Technology Executives on Counterterrorism

I. Introductions

II. Setting the stage

a. Purpose of Meeting

b. Unclassified background on terrorist use of technology, including encryption

III. Core Discussion Areas

a. How can we make it harder for terrorists to leveraging the internet to recruit, radicalize, and mobilize followers to violence?

b. How can we help others to create, publish, and amplify alternative content that would undercut ISIL?

c. In what ways can we use technology to help disrupt paths to radicalization to violence, identify recruitment patterns, and provide metrics to help measure our efforts to counter radicalization to violence?

d. How can we make it harder for terrorists to use the internet to mobilize, facilitate, and operationalize attacks, and make it easier for law enforcement and the intelligence community to identify terrorist operatives and prevent attacks?

IV. Questions or other issues raised by Technology Companies

V. Next Steps

You will, of course, note the bit on encryption. According to some of the reports, while the meeting was really supposed to be more about anything but encryption (i.e. about figuring out ways to "counter" ISIS's supposed social media success, which likely has been overblown anyway), Comey said that he would only participate if encryption was on the agenda.

The Intercept got its hands on the more detailed briefing and revealed the part about encryption:

In addition to using technology to recruit and radicalize, terrorists are using technology to mobilize supporters to attack and to plan, move money for, coordinate, and execute attacks. The roles played by terrorist leaders and attack plotters in this activity vary, ranging from providing general direction to small groups to undertake attacks of their own design wherever they are located to offering repeated and specific guidance on how to execute attacks. To avoid law enforcement and the intelligence community detecting their activities, terrorists are using encrypted forms of communications at various stages of attack plotting and execution. We expect terrorists will continue to use technology to mobilize, facilitate, and operationalize attacks, including using encrypted communications where law enforcement cannot obtain the content of the communication even with court authorization. We would be happy to provide classified briefings in which we could share additional information.

Key Questions: We are interested in exploring all options with you for how to deal with the growing threat of terrorists and other malicious actors using technology, including encrypted technology, to threaten our national security and public safety. We understand that there is no one-size-fits-all solution to address this problem and that each of you has very different products and services that work in different ways. Are there high-level principles we could agree on for working through these problems together? And are there technologies that could make it harder for terrorists to use the internet to mobilize, facilitate, and operationalize? Or easier for us to find them when they do? What are the potential downsides or unintended consequences we should be aware of when considering these kinds of technology-based approaches to counter terrorism?

==

A number of organizations in the government, as well as some in private industry and academia, have researched techniques to detect and measure radicalization. Some have suggested that a measurement of level of radicalization could provide insights to measure levels of radicalization to violence. While it is unclear whether radicalization is measureable or could be measured, such a measurement would be extremely useful to help shape and target counter-messaging and efforts focused on countering violent extremism. This type of approach requires consideration of First Amendment protections and privacy and civil liberties concerns, additional front-end research on specific drivers of radicalization and themes among violent extremist populations, careful design of intervention tools, dedicated technical expertise, and the ability to iteratively improve the tools based on experience in deploying them. Industry certainly has a lot of expertise in measuring resonance in order to see how effective and broad a messaging campaign reaches an audience. A partnership to determine if resonance can be measured for both ISIL and counter-ISIL content in order to guide and improve and more effectively counter the ISIL narrative could be beneficial.

==

The United States recognizes the need to empower credible non-governmental voices that would speak out against ISIL and terrorism more broadly both overseas and at home. However, there is a shortage of compelling credible alternative content; and this content is often not as effectively produced or distributed as pro-ISIL content and lacks the sensational quality that can capture the media’s attention. Content creation is made difficult by ISIL’s brutal rule and near total control of communications infrastructure in its territory in Iraq and Syria, which can make it dangerous for citizens to speak out or provide video or images. Further, many of the leading and credible voices that might counter ISIL lack the content-generation and social media prowess that would be required to counter ISIL online. There is also a need for more credible positive messaging and content that provides alternatives to young people concerned about many of the grievances ISIL highlights.

In parallel with ongoing U.S. Government efforts, we invite the private sector to consider ways to increase the availability alternative content. Beyond the tech sector, we have heard from other private sector actors, including advertising executives, who are interested in helping develop and amplify compelling counter-ISIL content; and we hope there are opportunities to bring together the best in tech, media, and marketing to work with credible non-government voices to address this shared challenge.

For what it's worth, it appears (thankfully) that the majority of the meeting did not focus on the issue of encryption and (somewhat importantly) it was made clear to government officials that they're doing a hell of a lot more harm than good in continuing to suggest that undermining encryption is a reasonable approach. Tim Cook apparently said that the government needs to come out publicly in favor of strong encryption, rather than its silly statements that suggest a desire to undermine it.

The real crux of the meeting, though, was looking at if there was "some other thing" that the tech industry could do to help in the fight against terrorism. This actually seems like a perfectly reasonable question to ask. But there are still reasonable concerns. First, pretty much all of these companies already have terms of service that forbid their use in the furtherance of criminal or terrorist activities. Second, they tend to already work with the government when such activity is discovered on the service. Third, in many cases, letting terrorist organizations use these platforms freely is one of the most effective ways to enable intelligence officials to find out what they're doing.

If you look at the agenda above, it really feels as if the meeting was built on the wrong premise. It's basically all about how do we stop bad people from using technology effectively. But that's a fool's errand, because technology doesn't distinguish between good people and bad people.

Technology, for the most part, is about helping people do things better and more efficiently, not about stopping people from doing things. It's too bad there wasn't a focus on using today's technology tools to enable more people to help out in the fight against terrorism and extremism. Instead, much of the focus is on "how do we make it harder for someone to do [x]."

From the reports that came out, the discussion was pretty high level, with ideas like "could Facebook adjust its algorithm that spots potentially suicidal users to also detect potentially radicalized members." Having such discussions is fine, in theory. In fact, if anything, the oddest thing about this little "summit" is that it demonstrates just how wide the gulf has become between Silicon Valley and DC. In the past, discussions like this weren't so crazy -- and didn't need press coverage.

But here's the thing: the intelligence community totally poisoned the well here with its actions over the past decade and a half. For the past few months DC folks have been whining about how Silicon Valley is seeing this as an "us v. them" situation, but that's only true because the NSA blew everything up, hacking into systems, lying to the public, abusing the secretive powers of National Security Letters, the FISA Court and Executive Order 12333. The government treated Silicon Valley as an adversary, and is now whining that Silicon Valley doesn't want to help.

I'm quite certain that everyone in the room wants to do what they can to "stop ISIS" ("disrupt" is totally the wrong word here). And it would be great if there were ways to actually do that. But it can't involve the usual way that the intelligence and law enforcement communities have focused on in the past decade and a half: violating privacy, exploiting systems and generally treating the public's rights as collateral damage. And it can't involve stomping on freedom of expression.

It's fine if the two sides want to talk and see if they can come up with something useful, but as long as DC keeps thinking of Silicon Valley as creating "magic pixie dust" instead of innovation, it's not going to be that useful.

Filed Under: admiral mike rogers, encryption, going dark, isis, james comey, jeh johnson, tim cook, white house
Companies: apple, cloudflare, dropbox, facebook, linkedin

News Corp's CEO Bizarre Obsession With Made Up Lies About Google

from the stop-drinking-the-koolaid dept

Last year we wrote about News Corp. CEO Robert Thomson's weird anti-Google rant that seemed quite devoid of facts. It was a odd amalgamation of conspiracy theory and outright falsehoods that fit more in the realm of an angry internet troll, rather than the CEO of a media conglomerate. Apparently, Thomson has continued to let these beliefs fester and has once again gone off on Google and other companies much more successful on the internet in a confused and rambling speech in Australia. The talk, focused on the future of the media industry, starts off with a philosophical discussion about China before jumping into an attack on the internet, which begins mildly enough with some digs at internet companies:

Media companies, too, are looking for their bearings. Here we are in the age of the GPS, of relentless, endless tracking and precisely precise data, and yet some in media are wandering aimlessly, dazed and confused, without coordinates and slouching towards oblivion. We are living in the decade of content distribution, which is not necessarily good for the act of creation. For journalists and newspapers are creationists, not in the biblical sense, but in the creative sense – I am fortunate to be a custodian in a company that invests in thousands of creative acts around the world each day, great journalism, compelling analysis, feisty blogs, captivating videos and brilliant books, fiction and non-fiction. The question for this creationist is whether my views are anti-evolutionary or anti e-evolution – already a bit backward and sliding ever more so.

For the distributionists do indeed have powerful distribution channels, Google and Facebook, and pretenders like LinkedIn, which is spam central. None of them actually create content, and they certainly have little intention of paying for it, but they do redistribute the content created by others – they would argue that such redistribution is a natural extension of their role as social networks. I would argue that much of the redistribution is an unnatural act. But there are broader issues that are still unfolding for media companies, who are themselves struggling to profit from their news and other content, while the distributionists are helping themselves to that content, coopting and corralling audiences and consciously devaluing brands. The supposed idealism of these companies is in stark contrast to their actual behavior. That Google’s newly conceived parent company is to be called Alphabet has itself created a range of delicious permutations: A is for Avarice, B is for Bowdlerize, through to K for Kleptocracy, P for Piracy and Z for Zealotry.

Of course, this gets pretty much everything wrong. They're not distributors, they tend to be marketing vehicles. And there are all sorts of things that are just silly about this. After all, News Corp. itself has a rather long history of building or buying its own aggregation tools that tend to be a lot more aggressive than the Googles or Facebooks of the world. Oh, but nearly all of News Corp.'s attempts have flopped.

The reality, it seems, is that Thomson is jealous that Google and Facebook have succeeded in building services that people find useful, whereas News Corp. has failed. So he lashes out claiming that they're "pirating" or "stealing" content, and "redistributing" it. But that's not what's happening at all. Google is a search engine, it's helping people find more content. And, as a recent study in Spain showed, when Google News pulled out it harmed the news industry, rather than helped it. It took away traffic and hurt ad revenue.

What kind of person slams a company that increases his company's revenue and increases his company's visibility?

Apparently, the chief exec of News Corp., Robert Thomson.

All of this seems to stem from a simple bit of (willful?) misunderstanding. Thomson keeps claiming that Google and Facebook are somehow "distributing" News Corp. content. But they're not. They're helping people promote it or find it. And they're very successful at doing so, and that's the real problem. Thomson is jealous of their success.

It should be reassuring for news organisations that the distributors have suddenly started to realize that the quality of content is important, particularly as they try to build walled gardens – though it should be noted that the Chinese discovered that even a Great Wall didn’t work. The spammers at LinkedIn discovered that CVs are only burnished occasionally and anyone who tweaks their CV a few times a week is probably not worth hiring. Anyway, they now see themselves as a news distributor, and news organizations who cozy up too closely to them are guilty of techno trendiness. It is patently important to be aware of the trends but a grievous sin to be too trendy.

Whatever you might think of Linkedin or its recent strong push into being a content platform, this seems like a weirdly inappropriate insult for a major media company boss to be making. First of all, I think most hiring managers would strongly disagree with Thomson's suggestion that Linkedin isn't useful as a tool for hiring people. These days it's one of the first places people go. Is Thomson so out of touch that he doesn't realize this?

And we are entering a new phase of development by the big distribution networks, a phase in which they are not only appropriating content but deciding what content is appropriate and inappropriate. They are appointing editors not to create but to curate. And these curators tend to have a certain mindset, a deep fondness for political correctness, and a tendency to be intolerant of ideological infractions. Silicon Valley is moving from the PC to being a purveyor of the PC.

Huh? First off, anyone looking at this with any sense of reality would note that News Corp. has a much longer history of acting as a gatekeeper, greatly limiting what content it feels is "appropriate" for people to see. Google and Facebook are quite different, opening up a much broader sense of content to the world. Are there reasonable concerns about algorithms choosing what content you see and things like a "filter bubble"? Sure. Absolutely. But comparing that to News Corp. of all places doesn't make News Corp. look very good. Remember, this is the same company who turned the tag line "fair & balanced" into a punchline. For the CEO of that company to argue that Google and Facebook are somehow curating content in one direction is... well... ironic.

Of course, what it really comes down to is the fact that Thomson doesn't like the political sensibilities of the people who run these tech companies:

This transition is already underway. The stream of content is often a flow of soft-left sensibility, a stream of content consciousness in which genuine debate is in danger of drowning and alternative views rarely surface. This profound movement is taking place, and without much serious discussion of the social consequences.

Newspapers have always been a little unruly, but they are characterised by public debate, wrangling, haggling, arguing, sometimes passionately about issues and consequences, about the impact on societies and on people. The philosophy, the point of great newspapers is clear. But now we have the exponential growth of purportedly neutral platforms built by e-elites that will be far from neutral, far from objective, succumbing to a stultifyingly samey subjectivity and sensibility.

Again, remember that this is all coming from News Corp.. If he really feels this way, why not just build a competing platform that has News Corp.s' political "sensibilities." After all, isn't that what the company did with Fox News? Why not do that online and see how it works? That's what's nice about the internet. Anyone can build anything and see if it works.

After some more whining about how those darn "lefties" are running Silicon Valley, he goes back to attacking Google over "intellectual property" issues that he doesn't seem to understand.

More relevant to our discussion is the digital divot; the deficit in reporting resources created by the egregious aggregation of news by distributors for whom provenance is an inconvenience and who are contemptuous of copyright. The words Intellectual Property don’t appear in the Google alphabet. Without proper recognition, without proper remuneration, well-resourced reporting will be ever more challenged. When I arrived in Beijing, many a US newspaper had China correspondents – now some of those papers no longer exist in printed form.

Mismanagement played a role, as did journalistic hubris, but the digital age has been hostile to investment in reporters and reporting. Why pay professionals when you have UGC, user-generated content? And why pay when you can purloin?

Except, again, none of that is accurate. Google, for one, seems to bend over backwards going above and beyond what's required by law to appease Hollywood and firms like News Corp., only to find them still wanting more or plotting against Google. And, it's funny that this speech comes the very same week that Comcast plowed $200 million into Vox Media at a $1 billion valuation and Buzzfeed's financials leaked showing a healthy, growing business that's investing heavily in editorial.

In other words: it appears that online reporting is actually doing pretty damn well in certain areas -- just not those where News Corp. is acting -- once again highlighting the company's long history of driving internet properties into the ground.

Also, we'll mention (yet again) the study in Spain, noting that Google was helping news publishers make more money and get a larger audience by promoting stories for free. It takes quite a bit of confusion to spin that as being "hostile to investment in reporters and investing."

It's just factually wrong.

If this is the visionary running News Corp. and planning for its future, it seems like News Corp. is heading in the wrong direction.

Filed Under: aggregators, internet, robert thomson, search
Companies: facebook, google, linkedin, news corp.

Transparency Watch Releases Searchable Database Of 27,000 US Intelligence Workers

from the publicly-posted-information,-searchable-by-the-public dept

Intelligence gathering on intelligence gatherers. Watching the watchers. Whatever you want to call it, Transparency Toolkit is doing it. It has gathered 27,000 publicly-posted resumes from members of the "intelligence community" and turned them into a searchable database.

The database -- ICWatch -- was put together using software specifically constructed by Transparency Watch (and posted at Github). Not only can the database be searched through TW's front end, but the data is also available in raw form for data-mining purposes.

Some may find this searchable database to be a form of doxxing, but TW says that isn't the intent. Instead, it's meant to give the public additional insight into the inner workings of the intelligence community, as well as allowing researchers and journalists to sniff out information on still-unrevealed surveillance programs.

"These resumes include many details about the names and functions of secret surveillance programs, including previously unknown secret codewords," Transparency Toolkit said.

"We are releasing these resumes in searchable form with the hopes that people can use them to better understand mass surveillance programs and research trends in the intelligence community."

What Transparency Watch has done is simplified a task anyone could have performed prior to the compilation of the ICWatch database. In fact, nearly two years ago, the ACLU's Chris Soghoian pointed out that public LinkedIn profiles were coughing up classified program names posted by intelligence community members in their listed skills and work history.

This is all Transparency Watch has done -- only in aggregate and accessible to those without a LinkedIn account.

The data was collected from LinkedIn public profiles using search terms like known codewords, intelligence agencies and departments, intelligence contractors, and industry terms, the group said.

What Soghoian noted back in 2013 remains true. Searches for known NSA programs frequently bring up other program names, all posted publicly by employees and contractors with an apparent disregard for the agency's "everything is a secret" policies.

A search for "PINWALE" brings up a profile listing the following:

Cultweave, UIS, Nucleon, CREST, Pinwale, Anchory, Association, Dishfire, SharkFinn, GistQueue, GoldPoint, Mainway

And another listing these terms:

Snort, TRAFFICTHIEF, PINWALE, BOUNDLESS INFORMANT, BLARNEY, BULLRUN, CARNIVORE

You can also find out who's involved in Predator drone flights. Or who's participated in the NSA's Tailored Access Operations.

Some may argue that this algorithmic collection of resumes and LinkedIn profiles may be dragging some people under the "intelligence community" umbrella that shouldn't really be there. That's likely true, but this is one of those inescapable outcomes of dragnet operations. They may also argue that turning over this information to the public may cause some of those listed to be subjected to harassment or put them in danger. Also, this may unfortunately be true as well.

But there's a simple solution, albeit one that can't be applied retroactively.

As the government so frequently points out to us, publicly-posted information carries no expectation of privacy. The same goes for government employees and government contractors in sensitive positions who choose to disclose information about their skills and employment publicly. If any danger to these people exists, it has always existed. ICWatch may make the job simpler, but it's done nothing any person can't do on their own, using simple search tools.

Filed Under: code names, database, intelligence, intelligence community, resumes
Companies: linkedin, transparency watch