Election Security Has Become A Partisan Issue As Senate Votes Down Funding

from the bad-ideas dept

It shouldn't matter which party you belong to (or if you belong to no party at all): fixing our totally broken election security should be a priority. This is a topic we've written about on Techdirt for nearly 20 years. The broken system of electronic voting has always been a security disaster, and now with more direct attempts to influence elections happening, it should be even more of a priority. And yet, following the lead in the House, this week the Senate voted down an amendment from Senator Patrick Leahy providing more funding for election security.

The vote was almost exactly along partisan lines, with only one crossover (Senator Bob Corker was the only Republican who voted for the amendment). While there were some arguments made against the bill, they don't make much sense:

Sen. Blunt said that states are responsible for running their elections, not the federal government, and that providing more funds would give the impression of federal overreach.
Sen. Lankford said on the floor Wednesday, referencing the omnibus funds, “the $380 million amount is what was needed for the moment," and indicated he didn't want to fund states beyond that right now.

There can be reasonable questions in how this money is being spent, and what's being done to actually secure elections, but the fact that this seems to be becoming a partisan issue should worry us all. And, I know some of you will be tempted to do this, but claiming that Republicans are against this because insecure technology helps them get elected is not a serious response. That's not only cynical, but almost certainly incorrect.

However, at a time when Congress (including many of the Senators who voted against this) have been grandstanding about tech companies being used to influence elections, the fact that they would then not really care that much about our woefully undersecured voting infrastructure just seems ridiculous. For years, we've argued that when tech policy issues get partisan, they get stupid, and it would be a real shame for election security, of all topics, to become stupidly partisan.

Filed Under: election security, funding, partisanship, patrick leahy, senate

How To Avoid Future Krack-Like Failures: Create Well-Maintained 'Fat' Protocols Using Initial Coin Offerings

from the blockchain-cryptocurrency-fashionable-moi? dept

It came as something of a shock to learn recently that several hugely-popular security protocols for Wi-Fi, including WPA (Wireless Protected Access) and WPA2, were vulnerable to a key re-installation attack (pdf). A useful introduction from the EFF puts things in context, while more technical details can be found on the krackattacks.com site, and in a great post by Matthew Green. As well as the obvious security implications, there's another angle to the Krack incident that Techdirt readers may find of note. It turns out that one important reason why what is a fairly simple flaw was not spotted earlier is that the main documentation was not easily accessible. As Wired explains:

The WPA2 protocol was developed by the Wi-Fi Alliance and the Institute of Electrical and Electronics Engineers (IEEE), which acts as a standards body for numerous technical industries, including wireless security. But unlike, say, Transport Layer Security [TLS], the popular cryptographic protocol used in web encryption, WPA2 doesn't make its specifications widely available. IEEE wireless security standards carry a retail cost of hundreds of dollars to access, and costs to review multiple interoperable standards can quickly add up to thousands of dollars.

The obvious way to avoid this issue is to ensure that key protocols are all freely available so that they can be scrutinized by the greatest number of people. But the Wired article points out that there's a different problem in that situation:

Even open standards like TLS experience major, damaging bugs at times. Open standards have broad community oversight, but don't have the funding for deep, robust maintenance and vetting

It's another well-known concern: just because protocols and software are open doesn't necessarily mean that people will find even obvious bugs. That's because they may not have the time to look for them, which in turn comes down to incentives and rewards. Peer esteem only goes to far, and even hackers have to eat. If they receive no direct reward for spending hours searching through code for bugs, they may not bother.

So if we want to avoid major failures like the Krack vulnerability, we need to do two things. First, key protocols and software should be open and freely available. That's the easy part, since openness is now a well-accepted approach in the digital world. Secondly, we need to find a way to reward people for looking at all this stuff. As Krack shows, current incentives aren't working. But there's a new approach that some are touting as the way forward. It involves the fashionable idea of Initial Coin Offerings (ICO) of cryptocurrency tokens. A detailed article on qz.com explains how ICOs can be used to fund new software projects by encouraging people to buy tokens speculatively:

The user would pay for a token upfront, providing funds for coders to develop the promised technology. If the technology works as advertised and gains popularity, it should attract more users, thus increasing demand for the token offered at the start. As the token value increases, those early users who bought tokens will benefit from appreciating token prices.

It's that hope of future investment gains that would encourage people to buy ICO tokens from a risky venture. But it's not just the early users who benefit from a technology that takes off. A key idea of this kind of ICO is that the coders behind the technology would own a sizable proportion of the total token offering; as the technology becomes popular, and tokens gain in value, so does their holding.

This novel approach could be applied to protocol development. The hope is that by creating "fat" protocols that can capture more of the value of the ecosystem that is built on top of them, there would be funds available to pay people to look for bugs in the system, which would be totally open. It's an intriguing idea -- one that may be worth trying given the problems with today's approaches.

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Filed Under: cryptocurrency, funding, ico, krack, protocols, standards, wpa2

Senate Comes To Its Senses: Does NOT Support Ted Cruz's Plan To Block Internet Governance Transition

from the crisis-averted dept

So, just a few hours ago, the reports were still spreading that the Senate would absolutely include Ted Cruz's preferred language that would block the (largely symbolic, but really important) transfer of control over the IANA functions of ICANN away from the Commerce Department. We've explained over and over and over again why this is important -- including once this morning in response to Donald Trump suddenly taking a stand (an incredibly ignorant one, but a stand) on the issue.

And then... poof. The Senate Appropriations Committee released its "short term continuing resolution" (CR for short) and it does not include any language on blocking the IANA transition. So... all the talk and (misleading) hype was apparently a bunch of grandstanding and hot air over nothing. It may have just been posturing and used to negotiate something else. Or, maybe (just maybe) people who actually understood what was happening with the IANA transition were actually able to explain to those in charge how stupid all this rhetoric was. That would certainly be a nice explanation for this -- though it seems tragically unlikely.

But, for the short term, this means a very dangerous thing for the internet, pushed for by Ted Cruz (and, as of yesterday, Donald Trump) has been avoided. It's possible that the House could try to somehow move to block the transition, but that seems unlikely. So, we may have actually won one here and narrowly avoided political grandstanding mucking up a piece of the internet. Phew.

Filed Under: continuing resolution, donald trump, funding, iana, iana transition, internet, internet governance, senate, ted cruz
Companies: icann

Senate Funding Bill For State Dept. Asks It To Figure Out Ways To Stop Bad People From Using Tor

from the good-luck-with-that dept

It would appear that Congress is not so happy that the State Department is a major funding source for the Tor project. Tor, of course, is the internet anonymyzing system that was originally developed with support from the US government as a way to promote free and safe access to the internet for people around the globe (mostly focusing on those under threat in authoritarian countries). Of course, other parts of our government aren't huge fans of Tor, because it doesn't just help activists and dissidents in other countries avoid detection, but also, well, just about anyone (except on days when the FBI decides to hack their way in).

There has, of course, always been some tension there. There are always the conspiracy theorists who believe that because Tor receives US government funding it is by default compromised. Those tend to be tinfoil hat wearing types, though. The folks who work on Tor are not exactly recognized for being particularly friendly to intrusive government surveillance. They tend to be the exact opposite of that. And, of course, part of the Snowden revelations revealed that Tor was one tool that still stymied the NSA in most cases.

But it appears that Congress may be quietly trying to undermine this. On Friday, Politico had a tiny blurb in passing about how the latest State Department appropriations bill making its way through Congress includes some references to stopping "circumvention technologies" from being used by bad people. The Politico report suggests this is designed to apply more broadly to encryption, but reading the specifics it appears to be targeted straight at Tor. Here's the Senate report on the appropriations, where it discusses funding related to "internet freedom."

That, of course, was the reasoning behind Tor in the first place, but here Congress is now trying to put some limitations on what the State Dept. can do with its funds, including demanding that it seek out ways to stop bad guys from using technology like Tor. In the report, it's described this way:

...the Committee requires that spend plans submitted by the Department of State and BBG pursuant to section 7078(c) of the act include a description of safeguards to ensure that circumvention technologies are not used for illicit purposes, such as coordinating terrorist activities or online sexual exploitation of children.

In the full bill, the key section notes that the funding shall only be available for internet freedom after efforts are made to stop bad people from using the tools.

... made available for the research and development of new tools or techniques authorized in paragraph (A) only after the BBG CEO, in consultation with the Secretary of State and other relevant United States Government departments and agencies, evaluates the risks and benefits of such new tools or techniques, and establishes safeguards to minimize the use of such new tools or techniques for illicit purposes.

In case you're wondering, the "BBG CEO" is the CEO of the Broadcasting Board of Governors, the US government agency that manages media efforts around the globe, such as the Voice of America.

Make no mistake, this appears to be an attempt to sneak in an attack on Tor via Congress into the State Dept. Tor has been developed to provide the best absolute anonymity/privacy tools for people using the internet -- with the acknowledgement that it can be misused, because the people developing it recognize that the best way to protect the vast majority of its users is to build a system that is truly secure -- not one that artificially tries to limit its uses. Hopefully, this provision is changed, or else it may be eventually leveraged as a way to attack Tor, to attack Tor's funding and try to get the State Department to stop supporting such useful projects.

Filed Under: congress, funding, state department, tor

House Attacks Net Neutrality, Cable Box Reform With Sneaky Budget Rider

from the dysfunction-junction dept

As we've noted a few times, there's really only two ways the telecom sector can successfully destroy U.S. net neutrality rules. Broadband providers could prevail on part or all of their multi-headed lawsuit against the FCC, a decision on which is expected any day now. Or the rules could be dismantled by the next President, who could repopulate the FCC with the usual assortment of revolving-door sector sycophants, reverting the agency back to its more consistent, historical role as a dumbly nodding enabler of broadband sector dysfunction.

Every other attempt to kill the rules is just politicians barking loudly for their campaign contribution dinners -- though that's not to say the barking doesn't get very loud from time to time.

The latest example is the House Appropriations Committee's 29-17 vote to approve an FCC appropriations bill (pdf), part of a larger Financial Services Bill determining the 2017 budgets for multiple agencies. The bill was passed last week with amendment language intended to hobble the FCC's net neutrality rules -- and its quest to bring competition to the cable set top box. More specifically, the bill prohibits the FCC from enforcing its net neutrality rules until the ongoing court case is settled. But it also would relegate the FCC's attempt to bring competition to the cable box to committee purgatory.

This attempt to force the FCC's cable box reform plan into a "study" that never ends -- despite an already scheduled extensive public comment period -- has been a constant drum beat among telecom lobbyists, who've masterfully enjoyed having a laundry list of Senators parrot their claims that cable set top box reform will somehow hurt consumer privacy, spike piracy rates, and even harm minorities. The real reason for the sector's opposition is the $21 billion in captive annual set top rental fees the cable sector enjoys, and the fact that more set top box competition means better, cheaper hardware that will highlight streaming alternatives to legacy television (the horror).

As is usually the case, politicians supporting the hamstringing of the FCC profess they're wasting taxpayer money and legislative time not because they're paid allies of the telecom duopolists, but because they're just breathlessly worried about the health of the nation. For example, Chairman of the Financial Services and General Government Appropriations Subcommittee, Florida Representative Ander Crenshaw, issued a statement making it abundantly clear he's not happy with a regulator actually doing its job:

"In addition, this Committee has strong concerns that the FCC seems to be prolonging their pattern of regulatory overreach with its recent set-top box proposal. And so, we include language that requires the FCC to stop and study this controversial rule before they can move any further. The telecommunications industry is more competitive than ever. And yet, the Commission has been more active than ever in trying to exert regulatory control over market innovation. To return the FCC’s focus towards mission critical work and away from politically charged rule makings, the bill requires the FCC to do less with less."

And by "mission critical work" Crenshaw means joining him in pretending that the broadband sector is actually competitive, and that forcing consumers to pay thousands of dollars for sub-standard, closed cable hardware is the pinnacle of innovation. Like past efforts of this type, the rider language won't make it very far, but it's always entertaining to see folks like Crenshaw dressing up cronyism as a noble assault on the very dysfunction he covertly enables.

Filed Under: competition, congress, fcc, funding, net neutrality

House Budget Bill Guts Net Neutrality, Kills FCC Authority -- All Because The FCC Dared To Stand Up To Comcast & AT&T

from the punished-for-doing-your-job dept

We've noted a few times now that ever since the FCC passed net neutrality rules, loyal ISP politicians in the House and Senate have been engaged in a full-court press to punish the agency for daring to stand up to big broadband ISPs. That has involved an endless parade of taxpayer-funded hearings pretending to be about agency transparency and accountability -- but are really just about publicly shaming the agency. It has also involved a laundry list of bills that attempt to thoroughly gut FCC funding and authority under the pretense of saving the country from a power-mad FCC.

This not-so-subtle ballet continued this week, when the House passed a new budget bill that would gut the FCC's 2017 budget by $69 million, stall the FCC's attempt to bring competition to the cable box, and prevent the FCC from enforcing net neutrality violations until the industry's lawsuit is settled. In fact, like previous bills, this new budget bill uses an absurdly broad definition of "rate regulation" to effectively prevent the FCC from doing anything:

"The GOP proposals define rate regulation so broadly that Wheeler says they would prevent the FCC from enforcing key net neutrality provisions and disrupt its process for reviewing mergers. The budget bill again uses a definition of rate regulation that goes far beyond the utility rate-setting traditionally imposed on landline phone providers. The proposal would prevent the FCC from using its net neutrality rules to act against discriminatory data cap policies, among other things."

Note that this latest push comes -- not coincidentally -- as ISPs like AT&T and Comcast have started pushing usage caps harder, and the FCC has started dropping hints that it might just do something about it.

All the while, the pretense continues that this is all just the House's quest to ensure government is fiscally responsible, transparent, and accountable before the "American people." From an announcement by House Appropriations Committee Chair Hal Rogers:

"The job of this bill is two-fold: to make wise investments with taxpayer dollars in the programs and agencies that we need to grow our economy and enforce our laws, and to tightly hold the reins on the over-spending and overreach within federal bureaucracies. This bill makes great strides on all accounts – carefully investing taxpayer dollars in programs that promote opportunity, while keeping these agencies accountable to the American people."

You are, of course, supposed to ignore that Rogers received $25,000 in campaign contributions during the current election cycle from the telecom industry, and that this is all just a giant stage play designed to punish the telecom regulator for actually doing its fucking job.

Filed Under: appropriations, broadband, competition, congress, fcc, funding, net neutrality, set top boxes
Companies: at&t, comcast, verizon

New Mexico Attorney General Would Rather See Sexting Teens Treated As Sex Offenders Than See His Funding 'Jeopardized'

from the christ,-what-an-asshole dept

Teens sexting can't be addressed by existing laws. Law enforcement -- which far too often chooses to involve itself in matters best left to parents -- bends child pornography laws to "fit" the crime. They often state they're only doing this to save kids from the harm that might result by further distribution of explicit photos. How exactly turning a teen into a child pornographer who must add his or herself to the sex offender registries is less harmful than the imagined outcomes cited by law enforcement is never explained.

Over in New Mexico, legislators are making an honest attempt to keep sexting teens from being treated like sex offenders. And it's law enforcement that's leading the opposition to the proposed changes. The bill would continue to uphold harsh penalties for actual child pornographers while decriminalizing sexting between teens.

The New Mexico Attorney General is having none of it, as Reason's Robby Soave reports:

"I cannot support an amendment that weakens protections for teenagers from predatory activity, creates a dangerous new child exploitation loophole, and places New Mexico's federal Internet Crimes Against Children Task Force funding in jeopardy,” said Attorney General Hector Balderas in a statement, according to the Alamogordo Daily News.

This statement is not only ridiculous, but it shows the AG is more interested in budget lines than the future of teens who do the sort of things teens are inevitably going to do. Balderas is explicitly stating that he's willing to sacrifice young lives in order to secure his task force's funding. That's just sickening. In Balderas' world, sexting teens are nothing more than a revenue stream.

As Soave points out, the legislation still contains harsh punishments for child pornographers and does nothing to create a "loophole" for accused offenders. What it would do is keep teens from being charged for exchanging explicit photos with their peers by carving out an exception for photos exchanged by teens ages 14-17.

There's nothing logical about applying sexual predator/child pornography laws in this way. But Balderas has helpfully explained why many law enforcement officials are more than happy to do exactly that. There's good money in chasing down child pornographers -- a criminal act reviled by a majority of their constituents. Anything that might jeopardize these funds -- like treating sexting teens as a disciplinary/educational problem rather than a criminal one -- is to be rejected out of hand.

Soave notes Balderas was so incensed by this threat to his funding that he and his staff walked out of the hearing in a show of outrageously stupid, callously self-centered solidarity. Balderas may want to play hardball with child pornographers, but he's also shown he's more than willing to fuck a few kids himself when there's money on the line.

Filed Under: funding, hector balderas, law enforcement, new mexico, sex offenders, sexting

Report Claims That Big Political Funder Sheldon Adelson Is The 'Anonymous' Owner Of Las Vegas Newspaper

from the well,-that's-a-fun-one dept

Earlier this week, we wrote about the truly bizarre situation in which the Las Vegas Review Journal -- the largest newspaper in Nevada -- had been purchased for $140 million... and no one knew who the owner was. For fairly obvious reasons, this started to make a lot of people uncomfortable -- including the reporters for the NVRJ. Suspicion quickly focused on big time political funders, with some noting that Nevada is an early primary state, and may play a key role in the presidential election. The Koch brothers, who are big time funders of candidates flat out denied it, leading to more intense scrutiny on the other key guess: Las Vegas casino magnate Sheldon Adelson, a key funder of Mitt Romney in the last election.

Now, Dan Primack at Fortune is claiming that Adelson did, in fact purchase the paper, using the newly formed News + Media Capital Group LLC as a shell to try (apparently not very well) to hide that fact:

For nearly a week, the media and political worlds have been wondering who paid $140 million to purchase Nevada’s largest daily newspaper, The Las Vegas Review-Journal. The primary buyer had taken great pains to remain anonymous, but Fortune has learned from multiple sources familiar with the situation that it is Sheldon Adelson, chairman and CEO of casino operator Las Vegas Sands Corp.

The LVRJ itself had been investigating the issue and provided a bunch of supporting evidence for why Adelson was the likely buyer.

The Fortune report wonders if Adelson really only wanted to keep it secret until after last night's debate -- which he hosted -- had passed. Though that doesn't really make much sense. Either way, by trying to be secretive about it, the only end result is putting that much more attention on the fact that he's the buyer. If the idea was to subtly influence viewpoints, that may have backfired.

Filed Under: funding, journalism, las vegas review journal, newspaper, sheldon adelson
Companies: las vegas review journal, lvrj, news + media capital group

EFF Files Legal Complaint Against Google At The FTC

from the yeah,-eff-isn't-run-by-google dept

So this is interesting. The Electronic Frontier Foundation is dragging Google in front of the FTC, with a complaint alleging some potentially serious privacy violations concerning tracking of students in schools. The crux of the EFF's complaint:

While Google does not use student data for targeted advertising within a subset of Google sites, EFF found that Google’s “Sync” feature for the Chrome browser is enabled by default on Chromebooks sold to schools. This allows Google to track, store on its servers, and data mine for non-advertising purposes, records of every Internet site students visit, every search term they use, the results they click on, videos they look for and watch on YouTube, and their saved passwords. Google doesn’t first obtain permission from students or their parents and since some schools require students to use Chromebooks, many parents are unable to prevent Google’s data collection.

Looking over the details, I'm not entirely sure what the issue is here. The sync feature isn't designed to violate someone's privacy, but to allow users to access the same websites from different machines -- a feature that could be useful, especially in school settings where there may be a bunch of laptops that are passed around, so students may not always use the same machine. Also, wouldn't Google need to store their saved passwords? It also seems noteworthy that the organizations that put together the Student Privacy Pledge that EFF says Google is violating, have all said that EFF is wrong in its complaint. That said, the EFF is usually really good about these things, so I'll give the group the benefit of the doubt that there could be a problem here and will be paying attention to how this shakes out. No matter what, it will be worth following how the FTC responds.

What's much more interesting to me about this, however, is that this once again shows how the EFF is not a front for Google. There's this weird myth among some in the anti-Google/anti-digital rights world that EFF is just a "shill" for Google. I can't count the number of times I've seen blog posts falsely claim that Google is a major funder of EFF. Hell, resident clueless digital rights commentator Andrew Orlowski at the Register made that claim just a few days ago, saying that EFF "received half of its income one year from Google" even though he knows that claim is hellishly misleading.

You can see the EFF's annual report here, which includes this handy chart. You'll notice, first of all, that approximately slightly less than 1/3 of EFF's funding comes from "corporate contributions" -- but the vast, vast majority of that actually comes from contributions from Humble Bundle campaigns (when you buy video games from Humble, you can designate some portion to go to charity, and EFF is almost always one of the supported charities). Thus, it's actually only less than $600,000 of EFF's $13.5 million income that came from corporate donations. That's less than 5% -- and even if Google is one of those contributors, it's likely not the only one. Now, it's also probably true that some of the "individual contributors" work for Google, but it's certainly not corporate donations. And, from what I've heard from multiple EFF people, the actual amount of revenue that comes from Google employees as individual contributors is tiny.

What most of the conspiracy theorists, such as Orlowski, cite when they say that Google provided a ton of money to the EFF is not what it seems at all. It was a one-time payout, first of all, and it was to settle a legal dispute in which EFF also went against Google. Specifically, it was over Google's ridiculous failed "Google Buzz" offering that had some really weak privacy controls. EFF was among many groups who criticized Google over its privacy failings for Buzz, and so part of the class action settlement was that Google would give a chunk of money to a variety of non-profit/public interest groups who focused on privacy protection -- with EFF being one of those recipients. So even the key case in which Google definitely gave EFF money, it involved a court-sanctioned punishment of Google, giving the money to EFF (and others) who had opposed Google's privacy practices. This was part of a so-called "cy pres" award, and as you can see, in the most recent period, that represented a little over a million dollars in EFF's income. This is hardly a majority and, considering how it comes in, hardly the kind of thing that makes EFF a mouthpiece for those providing the money.

And, of course, now the EFF is going after Google for privacy issues once again. It makes you wonder how everyone who likes to insist EFF is just a Google mouthpiece will spin this one. I'm sure the conspiracy theories will be creative.

Filed Under: children, cy press, ftc, funding, privacy, schools, students
Companies: eff, google