When The FBI Shows Up At Your Door About Your Reporting, That's Intimidation

from the yikes dept

Having the government show up at your door to ask some questions about your reporting can be extremely unnerving. Zack Whittaker, the top notch cybersecurity reporter for TechCrunch got to experience the fun of that when the FBI showed up at his door over a year after he had published a story about a hacker dumping thousands of Mexican embassy documents from Guatemala after the Mexican embassy left the data exposed online.

As with many situations involving reporting on hacks and leaks, rather than focus on those actually responsible (often those who left the information exposed), law enforcement and the powers that be... often target the journalists. We saw that recently in Missouri where the governor called reporters hackers (and "fake news") for ethically disclosing that the state's elementary school agency had left teacher and administrator social security numbers exposed -- something the Department of Elementary and Secondary Educationapologized for weeks later (though it didn't apologize to the journalists).

For Whittaker, the experience was reasonably concerning:

I contacted Mexico’s consulate in New York for comment, as is standard practice when reporting a story. A spokesperson said the Mexican government took the matter “very seriously.” We published our story, and that seemed to be the end of it.

The FBI knock at my door a year later suggested it wasn’t. I declined to speak with the agents and closed the door.

After we published our story the Mexican government requested the help of the U.S. Department of Justice through diplomatic channels to investigate the hack and presumably try to identify the hacker. Because I had contact with the hacker, that must have made me a subject of interest to the Mexican authorities, hence the visit a year on.

A month after the house call, the Mexican government provided the FBI with a list of written questions it wanted us to answer, many of which were already answered in the story. Our response to the DOJ declined to provide anything more than what we had already published.

However, as Zack notes, even if he knew he hadn't done anything wrong, all of this is incredibly unnerving. Legal threats (unfortunately, and often ridiculously) now come with the territory of being a journalist, but the intimidation factor is very real -- and that can be super damaging for better informing the public. Indeed, it's often why the powerful -- be they governments or just wealthy people and companies -- make use of such intimidation tactics all the time:

We’ve rebuffed spurious legal demands before, but having federal agents on your doorstep simply for doing your job is certainly a new one for me. There has been no suggestion of wrongdoing, though it’s unsettling not knowing what view Mexico would take if I ever stepped foot on its soil.

But it’s the legal threats and demands that don’t make it to print that can have the most damage. Legal demands inherently have a silencing effect. Sometimes they succeed. Journalism can be risky and the newsrooms don’t always win. Left unchecked, legal threats can have a chilling effect that stifles both security research and journalism by making it legally toxic to work. That means the world is less informed and sometimes less secure.

Filed Under: fbi, intimidation, journalism, mexico, reporting, zack whittaker
Companies: techcrunch

Stalkerware Developer Demands TechCrunch Remove Article Detailing Its Leaking Of Sensitive Data

from the set-weapons-to-'backfire' dept

Last week, stalkerware purveyor ClevGuard was discovered to be hosting tons of sensitive data harvested from victims' phones in an Alibaba data bucket set to public with no password protection. ClevGuard makes KidsGuard, an app whose name suggests it's something parents can use to monitor their children's cell phone use, but the developer has helpfully noted the software's also great for monitoring spouses and employees.

After being notified of the issue, Alibaba secured the bucket and made sure ClevGuard was made aware of the problem. But ClevGuard's not finished being stupid about this. Rather than quietly go about securing its exfiltrated data -- which includes contacts, photos, GPS location data, and content harvested from a variety of messaging apps -- the company has decided it would like to raise its infamy level and ensure even more people know about its horrific stalkerware.

Zack Whittaker broke the news at TechCrunch, publishing a lengthy expose of both the product and its insecure data storage. And now ClevGuard is baselessly demanding he take down his article.

If you can't see/read the tweet, Whittaker says:

We just received an email from ClevGuard asking us to delete the two articles we published this week about the KidsGuard stalkerware, which has been used to spy on thousands of victims.

We declined.

Whittaker has also put together a how-to guide for removing this stalkerware from your device, which probably isn't improving TechCrunch/ClevGuard relations.

And while we're discussing ClevGuard, let's take a quick look at its marketing efforts, which directly contradict the End User License Agreement the company pushes on users.

Here are the limitations ClevGuard supposedly imposes on users, in all of its original, gloriously-broken English:

You comprehend that the Site and ClevGuard will be utilized just for the reasons for underneath (I) parental control of their kids, (ii) on a gadget, which is of your possession, under such situation, you should get authorization from the client being observed, (iii) other legal points as per the laws in your very own purview. The terms of Child is characterized as underneath:

Youngster: Your very own lawful kid that is under the legitimate age of 18 (as characterized by US law). The kid must be observed utilizing a perfect telephone that you possess. You can't screen a kid on the off chance that you hold one of the accompanying connections:

• Brother/Sister
• Step-Brother/Step-Sister
• Step-Father/Step-Mother
• Aunt/Uncle; Cousin/Nephew
• Grandfather/Grandmother
• Great-Grandfather/Great-Grandmother

Worker: Your representative at an organization you claim or a representative at indistinguishable organization from you and you have administrative duties regarding. The representative must be checked utilizing a perfect telephone claimed by the organization and issued to the worker under your organization's approaches with respect to organization telephones. The representative must give assent and be advised they are being observed before checking can start.

So, according to ClevGuard's own EULA, the stalkerware can only "legally" be used to monitor "youngsters" and "workers." (And only on "perfect telephones," which are generally only found in the Oval Office.)

But the company's quasi-blog suggests customers should use the software in ways that break the EULA, offering up reasons why KidsGuard is better than its competitors for stalking spouses and significant others. Here's a post detailing the "2 Best Ways to Track my Girlfriend's Phone," with KidsGuard beating out the built-in "Find My Phone" feature. Here's a list of the "10 Best Couple Tracker Apps" with KidsGuard topping the list. ClevGuard's site is full of "helpful" posts pushing KidsGuard to monitor something other than "youngsters" and "workers," suggesting it's not just "perfect telephones" that can be spied on with ClevGuard's software.

To sum up: ClevGuard is a terrible company offering a horrible product that can be abused to spy on nearly anyone without their knowledge. The data then -- until recently -- ended up in unsecured data buckets. But why should ClevGuard try harder? This sensitive data belongs to people being spied on. Screw them for being covertly surveilled, I guess. Nothing to hide, nothing to fear, etc. The bogus demand TechCrunch remove its article is just the expired icing on ClevGaurd's garbage cake.

Filed Under: data breaches, kidsguard, leaks, sensitive data, stalkerware
Companies: clevguard, techcrunch

AOL CEO Promises 'The Market' Will Keep Verizon, AOL Honest About Sleazy New Stealth Cookies

from the trust-us,-we're-the-phone-company dept

If you recall, Verizon has been under fire for much of the last year for the company's new stealth "cookies," which involve modifying user traffic to inject a unique identifier traffic header (UIDH) into each packet. This header allows Verizon and other companies to track a user's online behavior and build complete online user profiles, and can't be disabled via the traditional browser settings. Verizon initially tried to claim this unencrypted data attached to packets couldn't be used to build profiles by third parties, right before a third party showed just how easy it was to apparently do so.

As we recently noted, Verizon's new UIDH system has now made its way to the AOL empire after Verizon acquired the company for $4.4 billion earlier this year. The fracas was "covered" by Verizon-owned TechCrunch (bonus points: try to find one sentence in this article that describes the potential downside of what Verizon/AOL are doing), which quoted AOL CEO Tim Armstrong as declaring that "the market" will somehow protect you, the consumer:

"He said the market would prevent companies from abusing the swaths of data they collected. "If consumers don’t trust you it’s not worth whatever you’re going to do with the data,” Armstrong said. “Verizon is probably more sensitive to data than most Internet companies.” Armstrong said he would not want to be at a company in the future that had the opportunity to gather and optimize data and didn’t use it. “Data is oil for this economy,” Armstrong said. “Oil can be used really well, and oil can be used really poorly."

Yeah, here's the thing, Tim. Nobody trusts Verizon. Whether it's the company's relentless attacks on net neutrality, its ripping off of countless towns, states and cities, or Verizon's ham-fisted belief in closed networks and locked-down devices, "trust" isn't a word anybody really associates with Verizon. And no, Verizon isn't "probably more sensitive to data" than other companies, as the millions of users who've had their data shoveled over to the NSA can attest. If there's a company in the United States that's likely to use data irresponsibly and "really poorly," there's a pretty damn good chance it's going to be Verizon.

Remember, it took security researchers two years to even discover what Verizon was doing to user traffic. It took another six months of relentless media criticism for Verizon to even let users opt out of the practice. Does that sound like a company that's using user data responsibly? Does it sound like a company that's "more sensitive to data" than most Internet companies?

Meanwhile, this idea that magic market forces will somehow keep data-collection parasites honest is something Verizon's been arguing for years. Back in 2008, while trying to shoot down improved user privacy protections, Verizon insisted that public shame would keep the company honest:

"A couple of years back during the debate on net neutrality, I made the argument that industry leadership through some form of oversight/self-regulatory model, coupled with competition and the extensive oversight provided by literally hundreds of thousands of sophisticated online users would help ensure effective enforcement of good practices and protect consumers."

And yet "hundreds of thousands of sophisticated users" had no idea Verizon was secretly modifying their user traffic for two full years, so how exactly did that work out for end users? Yes, there are times you should trust in the ability of "the market" to sort itself out, especially if dealing with fragile emerging ecosystems. But in this case it seems abundantly clear that what "the market" wants is for consumers to be docile cash cows who nod dumbly as every shred of data is collected and monetized, and their personal privacy preferences are utterly ignored.

Filed Under: advertising, stealth cookies, tim armstrong, tracking
Companies: aol, techcrunch, verizon

Fark Gets Patent Troll To Settle For Nothing... Did Reddit Pay Up?

from the don't-feed-the-trolls dept

Last summer we wrote about an absolutely ridiculous patent troll, named Gooseberry Natural Resources LLC, who holds a ridiculously broad patent (6,370,535) that it claimed covered the basic concept of generating a press release online, which it then used to sue a bunch of companies who had been in business since way before the patent was issued. At the beginning of this year, we noted that Gooseberry tried to expand the definition of what the patent covered, and sued a bunch of tech sites you probably read, including Fark, Reddit, Slashdot, TechCrunch and Digg. As we noted at the time, as with most patent trolls, Gooseberry was just a shell company, and the real owners of the patent were a secret. Tragically, even with the combined investigative power of those sites, no one was able to piece together who really owns that patent.

In February, Drew from Fark explained why patent trolling is so incredibly detrimental. Unlike most other bogus lawsuits, you can't just point out that the patent has absolutely nothing to do with your business and get the case dismissed. You basically have to go to court and spend hundreds of thousands, if not millions, of dollars to fight it. This is what makes patent trolling so successful. It's cheaper to just pay up. In fact, patent trolls totally rely on this, because going to court is expensive for them too -- and they almost always lose. So they have just as much incentive to avoid court as the folks being sued, in many cases.

So it's awesome to hear that Drew stared down Gooseberry and got them to agree to "settle" for absolutely nothing. Even more amazing is that he convinced them to wipe out the "standard" NDA on a patent troll settlement. Almost every settlement includes an ironclad non-disclosure agreement which says you can't say what the amount of the settlement was. This means that even if you pay nothing, they still tell the world that you "settled" and imply it was for millions and talk up how this proves their patent is valid. Not in this case:

Their patent had nothing to do with Fark. The patent troll realized we were going to fight them instead of settle, so they asked for our best offer. I said how about you get nothing and drop the lawsuit? They accepted.

Normally, we wouldn't be able to talk about any of the details. Terms of patent lawsuit settlements are usually bound by ironclad nondisclosure agreements. NDAs allow patent trolls to extract maximum settlements from each entity they've filed lawsuits against - as a result no one knows who paid what. In the last round of settlement negotiations we asked to strike the NDA provision. They agreed (and to the attorneys out there reading this, I'm as baffled as you are).

Striking the NDA was crucial because I wanted to be able to tell everyone what really happened: we didn't pay them a single dime

Unfortunately, Drew also notes that Conde Nast (the owners of Reddit) also "settled" this week, which probably means they paid something (not much), though I wonder if they were able to ditch the NDA as well. It sounds like TechCrunch/AOL is still fighting this (and hopefully will be emboldened by Drew talking publicly about getting them to back down). Still, the bigger point is how much of a toll this kind of thing takes on businesses. Fark is quite successful, but this kind of thing could have destroyed it. As someone who is too often threatened by completely bogus lawsuit threats, I certainly can understand the emotional impact these things can take on someone, which Drew discusses as well:

At any rate, this bullshiat is finally over. It was a nightmare. Imagine someone breaking into your home, then being forced to sit on the couch while their lawyers file motions over how much stuff they can take. My wife Heather said my first draft of this post sounded too angry, probably due to the fact that every third word was an f-bomb (among other things I paraphrased our best one-time settlement offer as "how about jack sh*t and go f*ck yourself", which may be a more accurate depiction of how I really felt at the time). I won't lie though, I was angry and I am still. Too much money was wasted on this, too many sleepless nights, too many hours away from running Fark, and all this because someone else decided that suing companies for bearing a vague resemblance to their patent (patents they don't even appear to use themselves) is a good business model. We're short a full-time employee thanks to these douchebags.

People who cheer on trolls and bogus lawsuits have no idea what a massive emotional impact such bogus lawsuits have on legitimate businesses. Kudos to Drew for not just standing up to one and winning in pretty much every conceivable way, but also being willing to express just what kind of emotional impact these kinds of bullshit lawsuits have on people.

Filed Under: drew curtis, fark, patents, press releases, reddit
Companies: aol, conde nast, digg, fark, gooseberry natural resources, reddit, slashdot, techcrunch

Reddit, Digg, Fark, Slashdot, TechCrunch & Others Sued Over Ridiculous 'Online Press Release' Patent

from the like-that-will-work dept

Last summer, you may recall, we wrote about the ridiculous situation of a company called "Gooseberry Natural Resources LLC," which held a ridiculous broad patent (6,370,535) that it claimed covered the basic concept of generating a press release online. The company had sued a bunch of (usually small) online press release services -- some of whom were really struggling to fight the lawsuit. And, to make matters worse, it was not clear who really owned the patent, as there appeared to be a series of shell companies to hide the actual patent holder.

Apparently whoever is behind Gooseberry got tired of simply trying to demand cash from mom-and-pop press release services, and has now decided to sue a bunch of online services, Digg, Reddit, Fark, TechCrunch, and others. What do any of those companies have to do with generating press releases online? You've got me. Of course, some of those sites are pretty good at teaming up and doing good deeds. So, perhaps the Reddit crew might be able to figure out who really holds this patent?

The whole thing looks pretty ridiculous. For example, this is the section on how it claims Reddit violates the patent:

Plaintiff is informed and believes that Advance owns, operates, advertises, controls, sells, and otherwise provides hardware, software and websites for "news and press release services" including via the reddit.com website ("the Advance system", available at www.reddit.com). Upon information and belief, Advance has infringed and continues to infringe one or more claims of the '535 patent by making, using, providing, offering to sell, and selling (directly or through intermediaries), in this district and elsewhere in the United States, systems and methods for entering and providing structured news and press releases. More particularly, Plaintiff is informed and believes that Advance has and/or require and/or directs users to access and/or interact with a system that receives and stores separately specified portions of a new or press release and that assembles a news or press release in a predetermined format.

This is basically the same basic language used against all the sites sued. It's basically a ridiculous attack on lots of well-known tech blogs and news aggregator sites, claiming they somehow infringe on this ridiculous patent. I find it especially amusing that they've included Slashdot in this attack, seeing as Slashdot's system (which really hasn't changed that much over the years) predates the patent filing by a few years. Seems like the prior art on this one is likely to be pretty strong. Of course, fighting a patent infringement lawsuit, no matter how bogus, can be quite expensive. Hopefully these sites are willing to team up and pool resources. Thankfully, most of the sites involved are owned by much larger companies who can (and hopefully will) fight this.

Filed Under: news, patents, press releases, websites
Companies: digg, fark, reddit, slashdot, techcrunch

Virtual Goods, Scams, Investigative Reporting And The Media

from the all-in-one-package dept

For many years, we've been quite skeptical of any business model in virtual worlds/social networks that rely on "buying virtual goods." That's because these are all based on artificial scarcities, and as we all know (hopefully, by now), relying on artificial scarcities for a business model is incredibly risky, especially once people realize the scarcities are artificial. And yet, over the past few years, a number of businesses have been built on this very premise. In fact, Silicon Valley is crawling these days with businesses built on selling virtual goods, and if you talk to many VCs about it, you'll quickly note that they're positively giddy over the fact that people are paying for this stuff. What they don't seem to realize is that it's unlikely to last.

In the last couple weeks, Mike Arrington, over at TechCrunch, did an amazing job calling attention to the widely known, but rarely discussed in polite company, dark underbelly to most of those business models: quite a large part of their revenue is based on scammy offers that effectively trick unsophisticated purchasers (often kids) into signing up for expensive subscriptions to things they don't want. I was at an investor "roundtable" a couple months ago, which was mostly bankers in suits, and they were laughing about just how gullible people are on these things, and it's great to see TechCrunch exposing them, and pushing the worst abusers to clean up their act. Of course, even when some, like Zynga, claim to be cleaning up their act, Arrington was able to dig up a video where Zynga's CEO proudly talked about the scammy tactics he used -- and then noted that these same scammy tactics showed right back up on Zynga, after the company promised they were gone. Those who use these kinds of tactics may find that while they "bring revenue now," it may be short-lived. Companies that focus on such abusive tactics live to regret it (just ask RealNetworks).

But, the really amazing thing, as pointed out by Dan Lyons/Fake Steve Jobs, in an amazingly un-Fake-Steve-Jobs-like rant, is to compare the series of writeups by Arrington with the love letter to Zynga and other "virtual goods" companies in the NY Times, which came out after most of Arrington's posts, and makes no mention of them at all. As Lyons/FSJ notes:

So: they walked into this shit-storm and somehow, by some miracle, managed not to notice the fecal matter flying all around them. It's like covering a football game that took place in the middle of the blizzard and neglecting to mention the weather.

Now, maybe they did all the reporting before Arrington's stuff broke. In which case they should have gone back and updated their info. Or maybe, just maybe, Zynga's PR people teed up a Times story as a kind of rebuttal to what Arrington was reporting. Either way, that's what ended up happening: Zynga used the Times to deflect the bad shit flying at them from Arrington. They need good press because they're hoping to cash out by going public next year. That story in the Times will be worth millions. Many millions.

Meanwhile, Arrington, still digging, blasted again on Saturday night, reporting that sleazy ads had popped up again on Zynga, despite promises that they would be taken down.

Um, New York Times? If you guys are still wondering why people are dropping their subscriptions and getting their news from blogs instead of you -- this is why.

After which, Lyons/FSJ notes:

And to all those people who go around wringing their hands and saying what are we going to do when the "real newspapers" all die and we have to get our news from Gawker and HuffPo and TechCrunch? Friends, I think we're going to be just fine.... What really cracks me up is how often I still hear people say that bloggers are mere "aggregators" and the "real journalism" gets done at places like the Times. Because time after time, blogs are simply beating the shit out of the newspapers. They're the ones who still dare to go for the throat, while their counterparts at big newspapers just keep reaching for the shrimp cocktail.

Of course, there's just a bit of irony in noting that Dan Lyons wrote one of the quintessential blog bashing articles four years ago, when he was writing for Forbes, at one point suggesting that blogger "journalists" were no different than notorious (NY Times) maker-up-of-stories, Jayson Blair. Nice to see he's coming around to recognizing things perhaps aren't so bad in the blog world.

Filed Under: bloggers, dan lyons, media, michael arrington, offers, reporting, scams, virtual goods
Companies: offerpal, techcrunch, zynga

Patent Lawsuit Silly Season: TechCrunch Sued For Patent Infringement After Critical Blog Post

from the this-will-end-badly dept

There are different levels of ridiculousness when it comes to patent lawsuits, with the lowest of the low being patent lawsuits based more on spite than on any legitimate claim. For a while, it seemed like Ray Niro's use of the infamous JPG patent, to sue a bunch companies he just didn't like, was perhaps alone in that category. But, it appears that we now have a new entrant. Apparently, some company (who we won't even name, since there's a good chance it's doing this just to get press attention) sued a more well-known competitor for patent infringement, over a location-based services patent. Looking over the patent itself it's difficult to see how it was approved. People were talking about location-based profile matching a decade ago, let alone five years ago when this patent was filed.

TechCrunch wrote a post mocking the lawsuit as a weak attempt to get press coverage (it worked!), while noting that TechCrunch itself was partnered with the sued company to provide a "co-branded community." This apparently caused the patent holder to amend the lawsuit and include TechCrunch as a defendant. Apparently, there were no threats or notification (though, the guy claims he tried to call TechCrunch). This will likely get tossed out incredibly quickly, as any judge will recognize that TechCrunch is just licensing its brand, not supplying the technology (and also hopefully question the validity of the patent itself). Already, though, TechCrunch's Michael Arrington is planning to countersue, so this could get fun.

The patent holder claims that adding TechCrunch to the lawsuit had nothing to do with the original post, but that's rather difficult to believe. There's also this somewhat amusing quote from the patent holder:

"TechCrunch can say whatever they want, and I applaud them. But no one has the right to infringe on a patent that I worked very, very hard for many years to bring about -- not just on paper but in reality."

Yes, and thanks to a broken patent system, you now get to dump a totally frivolous lawsuit on a site that clearly did not infringe on your highly questionable patent. Just like Thomas Jefferson intended.

Filed Under: location-based services, patents, press, revenge
Companies: earthcomber, loopt, techcrunch

AP Quotes Blogger In Discussing Bloggers Quoting AP; Hilarity Ensues

from the i-want-my-$12.50 dept

The ongoing ridiculous situation brewing between bloggers and the Associated Press has now taken a turn towards the enjoyably hilarious. We had already mentioned the fact that, despite the AP's complaints that bloggers quoting less than 100 words were violating fair use, the AP had a long history of quoting more than 100 words from bloggers -- and not even linking back to the original blog. Now, in a bit of ultimate irony, the AP's own article about this brouhaha quoted (without linking) twenty-two words from TechCrunch. That's 18 words more than the supposed four word "limit" the AP has suggested. With an ironic chance that wide, TechCrunch's Michael Arrington couldn't resist, and asked his lawyer to send a DMCA takedown notice to the Associated Press, along with a bill for $12.50 (directly off the AP's own pricing schedule). He admits that it's ridiculous, but that's what his actions are designed to present. By law, the AP should be required to takedown the content before filing a response -- though, since it's filing the response to itself, then perhaps it won't need to takedown the content. Either way, this helps illustrate the insanity of the entire situation.

Filed Under: copyright, dmca, fair use, michael arrington, takedowns
Companies: associated press, techcrunch

Before You Threaten To Sue Someone Over Their Website, You Might Want To Understand The Web

from the a-little-suggestion dept

We get to see ridiculous legal threats all the time. Sometimes we get such legal threats directly (my favorite was the big name analyst firm that once threatened to sue us because we linked to their own press release), but more often we hear about the ridiculous legal threats made to others. However, in all the bizarre and ridiculous legal threats, it would appear that Mike Arrington over at TechCrunch may have just won the award for both the most ridiculous and the most persistently wrong threatener. Arrington shares on his site how he received an email demanding $150,000 for a photo of the actor Ashton Kutcher that TechCrunch was using "to generate traffic and revenue." The guy sending the email claimed to represent the interests of the photographer of the photograph -- and said that if Arrington didn't pay up quickly (and quietly), he would file a suit for $1.5 million. It's hard to start on what's wrong with the lawsuit, but the obvious place is the simple fact that TechCrunch never hosted the picture in question. Instead, someone in the comments once linked to a website that hosted the picture, and if you did a search in Google for Kutcher's name, the photo showed up connected to TechCrunch because of that link.

Even ignoring the ridiculous amount being asked for and the clear confusion over how Google and the web work, what's even more bizarre about this is that when this was pointed out to the guy, rather than understanding what happened, he just became even more defensive. He somehow thought that it was TechCrunch's responsibility to get the photo taken off Google. He then started calling TechCrunch's advertisers and threatening them saying that they would be a part of the lawsuit that he was intending to file. Arrington wrote up a detailed explanation of this... and then the guy started posting a series of poorly spelled comments trying to defend his position -- insisting that the photographer was "robed" and that it was clear TechCrunch had something to do with it. Congratulations, Mike, you've won the award for the most bizarre and persistently ridiculous legal threat we've seen. And that's saying a lot.

Filed Under: legal threats
Companies: google, techcrunch