Court Rules Against EFF In DOJ FOIA Lawsuit... But Mainly Because ODNI Already Declassified Most Of It

from the progress dept

We've joked about how James Clapper and the Office of the Director of National Intelligence (ODNI) like to claim that the various documents they've been declassifying and releasing in the post-Snowden era are decisions they've made out of the goodness of their transparency-loving hearts, when the reality is that much of it is in response to FOIA lawsuits from the EFF. When it comes to Section 702 of the FISA Amendments Act, the part of the law that covers PRISM and (more importantly) the direct "upstream" tapping of the internet backbone via companies like AT&T, EFF had asked for a variety of documents pertaining to how the program was run. After ODNI did everything possible to refuse to provide such documents in any meaningful way, EFF sued.

Following the Snowden revelations, and the sudden "we love transparency*" (*not really) attitude of the ODNI, it started re-reviewing the original redactions and (look at that!) suddenly realized that it didn't actually need to have wasted so much black ink on the originals. EFF continued to push back on certain redactions, and ODNI magically discovered even more wasted black ink. Eventually, huge portions of the various documents that had previously been withheld were revealed. EFF kept pushing, and asked the court to review some of the remaining redactions, just to make sure that ODNI wasn't hiding anything solely out of embarrassment, rather than for legitimate national security purposes. The court got to secretly review the unredacted document, asked some detailed questions of the DOJ, leading to even more redactions falling by the wayside. So, now, finally, after all of that, the judge has basically said that all of the remaining redactions are legitimate, and thus effectively rules "against" the EFF.

However, this is a pretty clear victory for the EFF, considering that during the course of the case it was able to remove many of the original redactions. Of course, this is still problematic, because it highlights how many of those original redactions were clearly improper, and it took this long and convoluted process (and Ed Snowden) before ODNI was willing to reveal these documents concerning a rather key program in how the NSA conducts surveillance.

Filed Under: doj, eff, foia, odni, section 702
Companies: eff

EFF Sues Over National Security Letters... But Can't Tell You Who Its Clients Are

from the because-secrecy dept

The ridiculous (and most likely illegal) gag orders around widely abused "National Security Letters" (NSLs) is pretty widely known. It's created absurd situations in which companies have had to go to court secretly without being able to admit that they were fighting on behalf of their users, except in rare cases where the gags are finally lifted.

Well, here we go again, as the EFF has challenged NSLs issued to two separate companies -- one telco and one internet company. However, because of the gag orders, EFF isn't even allowed to say who its clients are in these filings.

The Electronic Frontier Foundation (EFF) filed two briefs on Friday challenging secret government demands for information known as National Security Letters (NSLs) with the Ninth Circuit Court of Appeals. The briefs—one filed on behalf of a telecom company and another for an Internet company—remain under seal because the government continues to insist that even identifying the companies involved might endanger national security.

While the facts surrounding the specific companies and the NSLs they are challenging cannot be disclosed, their legal positions are already public: the NSL statute is a violation of the First Amendment as well as the constitutional separation of powers.

We have yet to see any good reason for why the government can claim that the mere fact that a company has received a National Security Letter needs to be classified.

Filed Under: eff, first amendment, gag order, nsl, secrecy

AT&T Exec Claims EFF's Mocking NSA Logo Creates A 'Chilling Effect'

from the and-if-anyone-knows-about-chilling-effects... dept

For quite some time, the good folks at EFF have offered awesome NSA Spying Hoodies with their brilliantly re-imagined NSA logo: You might notice the AT&T logo in the middle there. That's not there just for show. Many years before the world knew of Ed Snowden, an AT&T technician by the name of Mark Klein literally walked in the front door of the EFF's old offices, and revealed how the NSA was installing hardware directly on AT&T's premises to tap directly into the internet backbone, in order to collect basically all internet traffic.

This is the same hoodie that Snowden himself used to wear around the NSA office in Hawaii where he worked (his coworkers thought he was being ironic). Either way, the logo is pretty well known by now.

Not surprisingly, last week during the RSA conference, plenty of folks thought it would be an appropriate venue to wear the hoodie (or similar t-shirts). And guess who took offense? According to the NY Times, an anonymous AT&T exec claimed such a logo created a "chilling effect" on discussion:

Around San Francisco this week, some were seen sporting Electronic Frontier Foundation T-shirts featuring a retooled N.S.A. logo with an eagle using its talons to plug into the American telecom network, symbolized by AT&T. Asked about the T-shirts, one AT&T executive, who asked not to be named, said they had a chilling effect.

“There are many of us at AT&T who are disturbed by what we’ve been hearing about the N.S.A.,” this person said. “But when you see that,” he said, pointing to the T-shirts, “a conversation becomes impossible.”

I don't think that cowardly exec knows what a "chilling effect" really means. I'd argue that secretly giving the NSA full access to the internet backbone, to collect whatever data they want is what creates a real chilling effect. Opening up pretty much just about everyone to intrusive and excessive surveillance by a secretive government agency? That's a chilling effect. Having someone wearing a t-shirt or hoodie that makes fun of your company for allowing such surveillance? No, that's not a chilling effect. It's the opposite. It's called exercising their right to expression.

Filed Under: chilling effect, eff, nsa, parody
Companies: at&t

NY Times Unimpressed With Any Online Protest That Doesn't Rattle The Earth's Very Core

from the you're-not-helping dept

As we recently announced and participated in, a group of websites, companies, consumer advocacy groups and digital rights organizations all joined forces for a day of action last Tuesday against mass surveillance. That protest, dedicated to the memory of Aaron Swartz, involved participants and websites running banners that urged visitors to head over to the protest website and contact their representatives. An underlying goal was to harness some of the outrage against SOPA/PIPA and direct it toward the NSA's ongoing surveillance abuses, since online protest have been proven to help move the needle, even if they can't all be on the scale of SOPA.

Not everybody was impressed. Because the NSA and friends didn't immediately admit fault and declare an end to all surveillance before crying a lot, launching balloons and committing coordinated seppuku on the steps of the Capitol building, Nicole Perlroth at the NY Times took to penning a slightly-snotty article strongly suggesting the effort was a waste of time and "barely registered":

"...the protest on Tuesday barely registered. Wikipedia did not participate. Reddit — which went offline for 12 hours during the protests two years ago — added an inconspicuous banner to its homepage. Sites like Tumblr, Mozilla and DuckDuckGo, which were listed as organizers, did not include the banner on their homepages. The most vocal protesters were the usual suspects: activist groups like the Electronic Frontier Foundation, the American Civil Liberties Union, Amnesty International and Greenpeace."

Apparently because the "usual suspects" like the EFF are always saying lot of weird stuff, there wasn't much point in paying attention to them (or something). Perlroth also implies that if large companies like Google and Wikipedia aren't going to loudly participate in your online protests, you might as well go home and cry in your pudding, because as we've seen all throughout history, it's impossible to enact meaningful social change without the help of a large corporate donor.

Some of the folks more closely associated with the protest didn't agree, like Sina Khanifar, who helped coordinate the campaign. Khanifar points out in a blog post that Perlroth's definition of "barely registering" could use some fine tuning:

"I'm not sure how 80k calls and over 500k emails counts as "barely registering." That's not to mention over 400k shares on Facebook, and another 100k on Twitter and Google Plus. And over 200 million page views of the banner. Compare Tuesday with the lead-up to the vote on Rep. Amash’s bill to defund NSA’s call records program. In two days about 15,000 calls were made through DefundTheNSA.com. Staffers reported that their phones rang heavily in support of the bill."

Khanifar rather amusingly picks apart numerous other problems with Perlroth's article, like the claim there was no substantive discussion on Reddit (there were roughly 7,000 comments, and Redditors are busy organizing the next wave) and the argument that participants Tumblr, Mozilla and DuckDuckGo did nothing to their websites (they did), while noting that this was one small part of a much broader effort towards NSA reform. He also quite correctly points out that if you're going to compare every online protest to the single largest and most successful protest in the history of the Internet, you're probably going to spend a lot of time disappointed. To make Perlroth happy though, perhaps next time we get the urge to protest, we'll pre-emptively realize the futility of the effort and stay home to watch reality TV instead. That'll learn 'em.

Filed Under: day we fight back, eff, nsa, pipa, protest, sopa
Companies: new york times

Supporting EFF Means You're A Security Risk?

from the really-now? dept

As lots of folks keep trying to delve into the mind of Ed Snowden without really knowing him at all, Andrew Katz at Time has an article about the security clearance process that people go through to get into a job like that, discussing some of the "blind spots" in the process that might have let an Ed Snowden through. Apparently, the EFF sticker on his laptop should have been a warning sign:

In a photograph posted online after Snowden revealed himself, his laptop displays a sticker touting the Electronic Frontier Foundation, a longstanding advocate for online rights and staunch opponent of government surveillance. That would have been enough of a warning sign to make it into his file, Smith says, but investigators wouldn't have come across it because clearance interviews aren't performed at their homes: "You're not around that person's personal belongings to make any other additional observations about that person's characters."

It seems a bit extreme to suggest that merely supporting a group like EFF automatically makes you suspect for jobs in the intelligence world. After all, isn't EFF defending basic Constitutional freedoms that Americans hold dear, and which our government is supposed to be protecting? But, even more to the point, if having EFF paraphernalia makes you a potential security risk in the NSA, what does that say about NSA Director, General Keith Alexander who attended last year's Defcon in an EFF t-shirt: Clearly, the NSA is doomed. Its boss is a huge security risk who never should have been given clearance!

More seriously though, it's getting fairly ridiculous when supporting basic Constitutional rights suddenly makes you a security risk. We're entering witch hunt territory, which is what happens when people get overly paranoid.

Filed Under: civil liberties, ed snowden, edward snowden, eff, keith alexander, warning signs

DOJ Argues Secret Ruling Over Secret Unconstitutional Surveillance Must Remain Secret Because It's Secret

from the and,-you-know,-it's-secret dept

About a year ago, after a lot of pressure from Senator Ron Wyden, the government finally admitted (late on a Friday) that, yes, indeed some of its surveillance efforts had been found unconstitutional for violating the 4th Amendment. But they didn't explain what, nor did they reveal the FISA court ruling which made that assessment. Since that time, the EFF has been fighting the government to get it to reveal the ruling. The DOJ refused to release it following a Freedom of Information Act (FOIA) request, and later said that even if it wanted to, it can't release the document, because only the FISA Court (FISC) could release it. But, in an earlier ruling in a different case filed by the ACLU seeking to reveal a FISC ruling, FISC had said that FISC couldn't reveal it, and the ACLU needed to seek the document from the DOJ. In other words, both the DOJ and FISC are pointing fingers at each other, saying that only the other one can reveal the document. In response, the EFF has asked for confirmation from FISC that if a district court rules against the DOJ and tells it to release the document, that FISC will actually do so.

Now, the DOJ is fighting back with the most circular and ridiculous logic imaginable:

In its response filed with the FISC today, the government offers a circular argument, asserting that only the Executive Branch can de-classify the opinion, but that it is somehow prohibited by the FISC rules from doing so.

The government’s argument is guaranteed to make heads spin. DOJ earlier argued that it lacks discretion to release the FISC opinion without the FISC's consent, but DOJ now argues that if the FISC were to agree with EFF, “the consequence would be that the Government could release the opinion or any portion of it in its discretion.” But FISC material is classified solely because the Executive Branch demands that it be, so release of the opinion has always been a matter of Executive discretion.

Frankly, it’s difficult to understand what DOJ is saying. The Government seems to have a knee-jerk inclination towards secrecy, one that often – as in this case – simply defies logic. The government's bottom line is this: their rules trump the public's statutory rights. But it's not the province of the Executive branch to determine which rights citizens get to assert.

Basically, the finger pointing continues. However, considering the increasing concern about vast government surveillance, it certainly seems like the government should start looking into being a hell of a lot more transparent, and it could start by giving up this game and releasing that FISC ruling.

Filed Under: 4th amendment, doj, eff, fisa court, fisc, foia, nsa surveillance, surveillance

Orin Kerr And Members Of The EFF Representing AT&T Hacker 'Weev' Pro Bono During His Appeal

from the and-hopefully,-head-off-further-damaging-CFAA-precedent dept

Andrew "Weev" Auernheimer is appealing his 41 month prison sentence (and its accompanying fine of $73,000). Many members of the security community have expressed concern with this ruling, especially in light of other CFAA cases. Auernheimer's exposure of AT&T's security hole doesn't really seem like the sort of thing that should be punished, at least not with multiple years in jail and a hefty fine. Then there's the unsettling feeling that the US prosecutors pushed hard for a prison sentence because they found Weev unlikable.

Fortunately for Weev (and others who have or will run afoul of the CFAA), Orin Kerr has stepped up to offer pro bono representation in Auernheimer's appeal (along with members of the EFF). Kerr, most recently spotted here going head-to-jackass with Rep. Gohmert over the legality of "destroying" a hacker's computer, has a very thorough post discussing his reasons for joining the fray. Basically, it boils down to this: nearly everything about the government's decision is wrong, which is problematic if this ruling is going to be used as precedent in future CFAA cases.

In the government’s view, visiting the URLs was an unauthorized access of AT&T’s website. But I think that’s wrong. At bottom, the conduct here was visiting a public website. As the Sixth Circuit stated in Pulte Homes, Inc. v. Laborers’ International Union Of North America, 648 F.3d 295 (6th Cir. 2011), everyone is authorized to visit an “unprotected website” that is “open to the public.” The fact that AT&T would not have wanted Spitler to visit those particular URLs doesn’t make visiting the public website and collecting the information a criminal unauthorized access. If you make information available to the public with the hope that only some people would bother to look, it’s not a crime for other people to see what you make available to them.

According to Kerr, undesirable access does not equal unauthorized access. The URLs were publicly available due to AT&T's own carelessness. What this actually looks like is the vindictive pursuit of an individual for publicly embarrassing the company. But it's not all on AT&T. The prosecutors themselves had to do a bit of creative sentencing to arrive at a "suitable" punishment for Weev's "hack."

Unauthorized access is ordinarily a misdemeanor. Why is this crime a felony? Here’s the government’s remarkable theory. All 50 states have state unauthorized access computer crime statutes similar to the federal unauthorized access statute. The government’s theory is that this overlap turns essentially all federal CFAA misdemeanors into federal felonies. They rely on 18 U.S.C. 1030(C)(2)(B)(ii), which states that a misdemeanor unauthorized access becomes a felony when it is “in furtherance of any criminal or tortious act in violation of the Constitution or laws of the United States or of any State.” The government argues that the existence of state unauthorized access crimes transform unauthorized access misdemeanor crimes into felonies: The overlap means that every federal unauthorized access crime is a federal crime “in furtherance of” the analogous state crime.

As Kerr states, this is nothing more than disingenuous double-counting being done for no other reason than to make the charges carry some weight. A misdemeanor results in a slap on the wrist, something that would hardly make AT&T happy. This isn't Kerr's (or the government's) first experience with hacking-related double-counting.

Back in 2011, Sarah Palin's email account was hacked and the Justice Department attempted to charge the hacker under two overlapping laws: "hacking into a computer" and "hacking an email account." This was overturned on appeal by the Fourth Circuit court, stating that the Justice Department's attempt to double dip a single action violated US principles on double jeopardy. This situation is more of the same, only with a convenient overlap of federal and state laws allowing prosecutors to ratchet up the charges from a misdemeanor to a full-blown felony.

In addition to these problems, Kerr also finds some jurisdictional issues at play. Even though none of the principals are located in New Jersey, the charges were brought in that state. The rationale? Some of the email addresses belonged to New Jersey residents. This paper-thin justification for filing charges in a pretty much unrelated state gives the appearance of prosecutorial venue shopping.

The most ridiculous aspect of the case is Kerr's final reason for stepping in: the sentence.

The largest part of Auernheimer’s sentence was due to an alleged $73,000 in loss suffered by AT&T. Under the provisions of the Sentencing Guidelines associated with 18 U.S.C. 1030, sentences are based primarily on the amount of loss caused by the crime. More dollar loss to the victim means more time in prison for the defendant.

AT&T claims it incurred costs of $73,000 due to Auernheimer's actions. But it claimed no loss to its computers, it suffered no downtime and lost no data. The only assertion of loss comes via AT&T's efforts to notify customers of the data breach.

First, AT&T notified its customers by e-mail. That was free, leading to a “cost” so far of zero. But then AT&T decided to follow-up the e-mail notification with paper letter notification, and the postage and paper costs amounted to about $73,000.

That's right. Auernheimer has to repay AT&T for envelopes and stamps with $73,000 of his own money -- and 3-1/2 years of his life. As Kerr points out, AT&T cannot reasonably pin this notification expense on Auernheimer as these costs are not "directly attributable" to the defendant's access of its supposedly off-limits URLs. Furthermore, Kerr says these costs are not "reasonable," considering AT&T's electronic notice to its customers was largely successful. In essence, Weev is doing time because he raided AT&T's petty cash box by proxy. Hopefully, this appeal will overturn this misguided sentence and prevent the CFAA from becoming an even worse law, thanks to the precedent set by this decision.

Filed Under: andrew auernheimer, cfaa, eff, orin kerr, weev

Freedom Of The Press Foundation Sets Up Shop To Help Fund Journalism Disruptors Like Wikileaks

from the good-to-see dept

This is cool to see. An absolutely awesome group of folks have set up a project called the Freedom of the Press Foundation, which is raising money to donate to various online projects that (you guessed it) help create a more free and open press. Part of the idea is that by funneling money through a foundation like this one, projects like Wikileaks can more easily get funded, without risk of being cut off individually (a la Wikileaks being cut off from most funding sources). Of course, it's not just Wikileaks, but sites like Muckrock, which we've used for a while to help with our Freedom of Information Act requests and some other "citizen journalism" sites.

Among the high profile folks behind the site are Daniel Ellsberg, of the Pentagon Papers fame, some EFFers, including founder John Perry Barlow and activists Trevor Timm (who's the executive director of this new project) and Rainey Reitman. Then there are people like journalists Glenn Greenwald, Josh Stearns and Xeni Jardin, and filmmaker Laura Poitras (who is working on a film about Wikileaks and internet freedom, and has been "detained and interrogated about her work at the U.S. border over 40 times.") And also actor John Cusack -- whose name appears a bit out of place, but he's been active in these kinds of issues.

I hope the project works out well. It's something that is clearly needed.

Filed Under: daniel ellsberg, eff, foundation, funding, john cusack, journalism, rainey reitman, trevor timm, xeni jardin
Companies: freedome of the press foundation