Johns Hopkins Demand To Professor To Remove Blog Post Was Over Totally Bogus Concerns

from the but-of-course dept

We wrote about the Dean of the Engineering School at Johns Hopkins telling cryptography expert and professor Matthew Green to remove his excellent blog post analyzing what attack vectors the NSA might be using to get around encrypted conversations. A few more details have come out, initially via Green's own Twitter feed, which were then mushed together into paragraph form via Ars Technica, which also provides some follow up information. First up, is Green's summary:

So listen, I'm trying not to talk about this much because anything I say will make it worse. What I've been told is that someone on the APL [Johns Hopkins' Applied Physics Laboratory—motto: "Enhancing national security through science and technology"] side of JHU discovered my blog post and determined that it was hosting/linking to classified documents. This requires a human since I don't believe there's any automated scanner for this process. It's not clear to me whether this request originated at APL or if it came from elsewhere. All I know is that I received an e-mail this morning from the Interim Dean of the Engineering school asking me to take down the post and to desist from using the NSA logo. He also suggested I should seek counsel if I continued. In any case I made it clear that I would not shut down my non-JHU blog, but I did shut down a JHU-hosted mirror. I also removed the NSA logo. I did not remove any links or photos of NOW PUBLIC formerly classified material, because that would just be stupid.

I'm baffled by this entire thing. I hope to never receive an e-mail like that again and I certainly believe JHU (APL) is on the wrong side of common sense and academic freedom, regardless of their obligations under the law. That said, I have no desire to cause trouble for any of the very good people at JHU so I'll keep my posts off JHU property. I have no idea if this was serious or a tempest in a teapot.

Separately, JHU put out a statement stating the following:

The university received information this morning that Matthew Green’s blog contained a link or links to classified material and also used the NSA logo. For that reason, we asked Professor Green to remove the Johns Hopkins-hosted mirror site for his blog.

Upon further review, we note that the NSA logo has been removed and that he appears to link to material that has been published in the news media. Interim Dean Andrew Douglas will inform Professor Green that the mirror site may be restored.

Later, JHU told Ars Technica that it had not received a government request, but rather made all of these determinations internally.

Let's pick apart these arguments, because nearly all of them are completely bogus, and JHU's initial decision to send the request to Green was incredibly screwed up on a variety of levels. First off, on the question of the use of the logo. There has been some confusion over this, in part because of a silly law, 18 USC 701, which tries to bar the use of such logos for the purpose of impersonating an official from those agencies. Unfortunately, some like to interpret that as a full ban on using such logos even in reporting. But that's wrong. Green has every right to use the logo in his post.

Similarly, the links to "classified material," as Green himself notes, involved material that is clearly now in the public, having been reported on and discussed widely in a variety of news sources, starting off with the NY Times, The Guardian and Pro Publica. Of course, he does slightly overstate his case in pointing out that they're public -- as for really dumb reasons that we've discussed before the government still likes to pretend that classified info that is being widely discussed and shown in the press is still "classified."

Either way, neither of those arguments justify asking Green to take down the blog post. Green was engaged in a public debate over very important topics, and did so in a perfectly reasonable and legitimate way. That JHU sought to stifle his speech raises serious questions about the way in which JHU views free speech and basic academic freedom. Even if there were slight concerns over the logo or the links, even a very simple review of the situation, along with a principled stand on free expression should have resulted in the school choosing not to do what it did.

Of course, the real hint at what happened comes from the beginning of Green's explanation -- that the complaint came from the APL, which (as some have pointed out) is really a defense contractor rather than an academic institution. It seems likely that the APL was much more concerned about pissing off its partners and colleagues at the NSA, rather than basic concepts such as academic freedom and freedom of speech. While JHU has allowed the post to go back up since the logo is gone, that's a really weak response. JHU should admit that it screwed up royally, and was driven by the short-term economic interests of the APL, rather than the long term interests of protecting its key academics.

Filed Under: academic freedom, censorship, free speech, logos, matthew green, nsa, nsa surveillance

Johns Hopkins Tells Security Researcher To Remove Blog Post About NSA Encryption Attacks From University Server

from the now-take-a-look dept

Last week, a great blog post by cryptographer and research professor Matthew Green was posted, providing some fantastic details about the likely attack vectors by the NSA to compromise encryption schemes. It's a well written and detailed piece from someone who clearly knows what he's talking about. Oh, and it kicks off with an amusing story about how the reporters working on the "NSA builds backdoors into encryption" story had contacted him for comments and, because they didn't reveal too many details, he was concerned about coming off as too paranoid or too much of a "crank." However, after the details came out, he realized he "wasn't cranky enough."

Oddness aside it was a fun (if brief) set of conversations, mostly involving hypotheticals. If the NSA could do this, how might they do it? What would the impact be? I admit that at this point one of my biggest concerns was to avoid coming off like a crank. After all, if I got quoted sounding too much like an NSA conspiracy nut, my colleagues would laugh at me. Then I might not get invited to the cool security parties.

All of this is a long way of saying that I was totally unprepared for today's bombshell revelations describing the NSA's efforts to defeat encryption. Not only does the worst possible hypothetical I discussed appear to be true, but it's true on a scale I couldn't even imagine. I'm no longer the crank. I wasn't even close to cranky enough.

He then goes on to explain where the most probable attacks are coming from and what we should be most worried about and what's likely still safe. I had hoped to write up something about the post in general, but today something new came up. Green noted that the Dean where he teaches, at Johns Hopkins, had asked him to remove the blog post from the university's servers. The blog post was cross-posted both to a blog on the university's servers, as well as to Green's personal blog on Blogger. The personal blog post is still up (and now about to get that much more attention for the takedown). He also notes that this "isn't my Dean's fault" though plenty of folks are curious whose fault it might be. For what it's worth, it appears that Hopkins has a close relationship with the NSA, and the school really isn't that far from the NSA's headquarters.

Either way, for a whole variety of reasons, demanding the blog post be taken down seems fairly pointless. Not only will it draw much more attention to the original post, it now creates additional scrutiny towards Johns Hopkins as to why it's stifling the speech of one of its professors on a key topic of public interest.

Filed Under: censorship, cryptography, encryption, matthew green, nsa, nsa surveillance
Companies: johns hopkins