Proposed DHS Rules May Cause The Deaths They Claim To Prevent

from the security-theater-making-us-less-safe dept

Back at the end of March, the Department of Homeland [in]Security issued rules stating that all electronics larger than a smartphone should be checked instead of kept in a carry-on on flights into the US from 10 airports or on 9 airlines from mainly Muslim countries in the middle east and north Africa. This was following claims by US and UK intelligence that terrorists are smuggling explosive devices in various consumer items to 'target commercial aviation'.

Not only does this not pass the smell test -- anyone looking to bring down an aircraft with explosive devices won't care if they're in the cabin or the hold: boom is boom. The idea that items are going to go through some sort of super-secret screening is laughable, when red-team penetration tests find it trivial to get prohibited items onto aircraft (including via people with no ticket who bypass security screenings). And, of course, airports already require carry-on electronics to be x-rayed, and often swabbed for explosive residue. What's more, I remember seeing 'explosives smuggled on board' hysteria since Pan Am 103 almost 30 years ago, where Czech explosive Semtex was suspected to be in everything from fake muesli to electronics following the use of just 12 ounces (340g) to blast a 50cm hole in the 747's hold.

A more "credible" theory is potential "cyber warfare" (a pox on that term). With electronics out of sight of the passengers after check-in, access to them is far easier for 'security services'. As well as allowing easy access to snoop on passenger electronics and data, there is a potential for far more nefarious actions in the tradition of Stuxnet.

Stuxnet was a worm that targeted a certain Siemens industrial control system primarily used by Iranian nuclear centrifuges. However, it spread via infected USB drives to computers, and from those computers to other USB drives, all the while using rootkits with compromised digital signatures to hide. It essentially used a digital version of '6 degrees of separation' to eventually infect its target. What better way to spread similar malware than to infect a bunch of computers on flights to the target country? It's not just laptops either, cameras need memory cards and are just as easy to infect. As a theory, it's got a lot to commend it, but that's beside the point, because, remember, this is about 'safety' and people not taking bombs into aircraft cabins.

So fast forward to the present, and while expanding the ban has been kicked about, a JetBlue flight has shown the incredible danger of requiring electronics to be put into bags that often are kicked about.

The smoking gun battery (Source, Grand Rapids Ford Airport)

May 30th's JetBlue flight 915 (NY JFK to San Francisco) had to make an emergency landing in Michigan after a AA lithium battery in a backpack started to smoke. When it was noticed, the backpack was moved to the aircraft bathroom which presumably dislodged whatever was causing the short. Luckily that was enough to prevent the fire from getting started, which would have soon gotten out of control.

And therein lies the problem. Lithium battery fires are very dangerous, and one of the things that make them more dangerous than most other fires is that most of the things you'd do by instinct to put out a fire (smother it, put water on it) actually makes them worse. Realistically, the only way to deal with a lithium fire is to stop it before it starts, and while that happened this time, if it were in the hold we'd be looking at a downed Airbus A321 with 158 dead.

Airlines know this and have for a long time. In 2000, I tried to fly with 2 batteries in my checked baggage from the UK to San Francisco with Virgin, and to Las Vegas with TWA. The batteries, Hawker (now Enersys) SBS40's were 38Ah, 12v batteries (yes, you can easily start a car with them) and were packed safely into my checked baggage as well as being certified safe for air travel (they won't leak if tipped or punctured). Virgin had no problems, but TWA flatly refused, citing a risk of fire in the hold (and at 28lb/12.7kg each, carry-on wasn't an option)

Now bear in mind this is a battery designed for rugged use, puncture resistant and safe (which is why they were used in Battlebots entries, which is why I was taking them, for the Suicidal Tendencies team), in a fire-resistant case where the only available fuel might be some small amounts of hydrogen gas, and whatever items are around. Lithium batteries generally don't come in rugged fire-resistant cases, provide their own fuel, and worst of all, physical damage (such as heavy-handed baggage handlers) can cause such damage.

If you want a more specific example of the risks, just cast your minds back to last year and the Samsung note7. With just the potential for a fire with note7 battery, they were banned from aircraft for safety reasons. They weren't consigned to the hold, where they can cause problems without anyone noticing.

And it gets worse, Lithium-ion batteries are EVERYWHERE. Aside from the rechargeable AA and AAA batteries like the one that caught fire on flight 915, lithium batteries are in laptops and cameras. Here are some examples of lithium batteries I had to hand, that I'd take on a trip with me and have to check.

That's a laptop battery, a digital camera battery, a phone battery and a video camera battery (I have 4 of these). One of them is 10 years old, that's how long these batteries have been out there.

Any of these can cause an uncontrollable fire if mishandled (and sometimes, just from age). What's more, any of these devices wouldn't take much to rig with a short-range detonation using nothing more than their own battery as the bomb. A bomb which will pass all the cursory security checks because there are no obvious chemicals (RDX, TNT, etc) to detect.

As a policy to prevent bombings, it's not useless, it's actually WORSE than useless, as it makes it FAR easier to take down an aircraft with electronics, just by accident, let alone by design.

The only people who benefit from this policy were it to be enacted worldwide, would be the computer snoopers, and of course, the many thieves, pilferers, 5-finger-discount shoppers, and general low-life criminals that seem to be employed at most airports in their security/baggage handling/TSA departments. Anyone else is potentially flying corpse-class.

Now, some might say that in this case, having lithium-ion batteries of any kind on an aircraft -- whether in checked luggage or carry-on -- is a recipe for disaster, and that they should be banned in general. But what I'm saying is that they are more prone to fire through mishandling than other battery types, and that such a fire, once it has started and takes hold, is more difficult to get under control easily. Well-maintained, well-treated batteries are safe if they're kept in the cabin, as any incident can at least be quickly addressed, as the recent JetBlue incident showed. Requiring they be put into baggage that is dropped, thrown, punted, squished, molested, rummaged through and otherwise mishandled, before being packed tightly into an aircraft hold unattended means that damage leading to a fire is far more likely, and that fire is unlikely to be discovered – let alone extinguished – before it is too late for the safety of the aircraft.

And if you're wondering how to put out a lithium battery fire when started, the answer is to use a class-D fire extinguisher (which only works on metal fires) but in a pinch, salt (pun intended) or sand can be used. Good luck finding the former, or enough of the latter two at 43,000ft. In a pinch, you can use water in mist form to cool around the battery and bring its temperature down (this can take a LOT of water and time), while also isolating it from any other fuel where possible (which was done in this case). Again, this is not really feasible if the fire is in the hold. Here's a demonstration of extinguishing a laptop battery fire, and how even when prepared, and waiting for it, with an extinguisher at the ready, it can still take a minute or two to put it out. Most people would be tempted to stop once the flames go out, allowing for re-ignition.

Reposted from the Politics & P2P blog

Filed Under: batteries, dhs, fires, flights, laptops, rules

Court Says FBI Doesn't Have To Hand Over Its Rules For Surveilling Domestic Journalists

from the petitioners-immediately-placed-under-surveillance dept

A couple of years ago, the Freedom of the Press Foundation sued the DOJ over its refusal to release its secret rules governing spying on the nation's journalists. This was prompted by revelations the FBI had used National Security Letters to obtain information on AP and Fox News journalists. The DOJ then issued new rules on the do's and don'ts of surveilling journalists, but once again (a) redacted them into uselessness and (b) granted the FBI an NSL exception, undercutting the entire point of the recrafted rules.

The OIG report -- in which the Inspector General disputed the DOJ's extensive redactions -- still has yet to be released in a less-redacted form. Sadly, it now appears it will never be any less redacted than the unintelligible mess the DOJ handed over a few years ago. A federal judge has sided with the government, finding its investigative techniques and methods are too sensitive to be handed over to the public, much less journalists it may or may not have surveilled using NSLs. (h/t Trevor Timm, Mike Scarcella)

Underlying everything is the government's barely-contested assertion that these rules contain information of national security interest. It's a handy assertion because it means the DOJ doesn't even have to explain why the redactions it made are relevant to its national security claims. From the opinion [PDF]:

Recognizing the Court’s “limited institutional expertise on intelligence matters,” the Court accords substantial weight to Hardy’s representation that “any greater specificity in the descriptions and justifications . . . could reasonably be expected to jeopardize the national security of the United States.” Hardy Decl. ¶ 46. In the area of national security, “it is conceivable that the mere explanation of why information must be withheld can convey valuable information to a foreign intelligence agency.”

This same argument appears later in the decision when dispensing of the plaintiff's challenge to yet another FOIA exception deployed by the FBI:

[T]he Court finds Defendant has met its burden and properly withheld documents under Exemption 7(E) for all five categories of documents. Defendant described with particularity that the withheld documents all contained non-public information about the FBI’s investigative techniques and procedures. These pages not only identified NSLs as an investigative technique, but also described information such as the circumstances under which the techniques should be used, how to analyze the information gathered through these techniques, and the current focus of the FBI’s investigations. As in Hamdan, the Court concludes that the declarations, which state that further detail would “reveal[] the very information it seeks to protect,” are sufficient to satisfy Defendant’s burden.

The court's also uninterested in double-checking the DOJ's secrecy assertions. As always, the court has the option to review contested documents behind closed doors (and away from plaintiffs) to see if the government's claims of national security/investigative concerns are valid. The court here declined to exercise this privilege.

The Court finds that in camera review is unnecessary here as Defendant already provided sufficiently detailed factual information in support of its exemptions in the Hardy Declarations and Vaughn Index.

The FBI is still free to use NSLs to obtain information -- including call records -- about journalists. The DOJ may have reined in other options, but NSLs have always been the FBI's go-to form when it's stymied by the FISA court, magistrate judges, or internal guidelines. Nothing about that will change. As for what's actually changed at the DOJ as a result of this public outing of journalist surveillance, the public apparently can't be trusted with that information.

Filed Under: doj, fbi, first amendment, freedom of the press, journalists, rules, surveillance, transparency
Companies: freedom of the press foundation

UK Government Refuses To Impose Privacy Rules On Surveillance Cameras In Hospitals

from the instead,-why-not-try-doing-what-you-already-tried-and-doesn't-work? dept

As we've noted before, the UK is infamous for the number of surveillance cameras that dot the land. They've become so much a part of British life that there is an official Surveillance Camera Commissioner, whose job is to encourage compliance with an official surveillance camera code of practice. The basic principle of the code is the following:

Use of a surveillance camera system must always be for a specified purpose which is in pursuit of a legitimate aim and necessary to meet an identified pressing need.

However, the Commissioner's powers are very circumscribed:

The commissioner has no enforcement or inspection powers and works with relevant authorities to make them aware of their duty to have regard to the code. The code is not applicable to domestic use in private households. The commissioner also must consider how best to encourage voluntary adoption of the code by other operators of surveillance camera systems.

As that makes clear, there are no enforcement powers to compel recalcitrant authorities to bring their surveillance into line. Still, the Surveillance Camera Commissioner does what he can, for example by pointing out situations that he regards as problematic. Here's one he spotted: the increasing use of body-worn surveillance cameras (pdf) in the UK's National Health Service (NHS) hospitals.

The introduction of body-worn video cameras at several hospitals has increased my concerns. Body-worn video cameras are a particularly intrusive device as they capture audio and video simultaneously without the option of switching either off whilst recording.

As the Commissioner points out, hospitals are unusually sensitive environments for surveillance cameras:

The NHS trusts are complex organisations that use surveillance camera systems in public areas where people under surveillance are likely to be vulnerable and distressed, and where the privacy requirements and burden on those conducting transparent, legitimate and proportionate surveillance is surely at its highest.

In order to ensure that surveillance cameras are being used appropriately, the Commissioner asked the UK government to add NHS hospitals to the list of organizations that are obliged by law to comply with the code of practice. The UK government has refused (pdf), writing to the Commissioner as follows:

When we met on 18 October, I indicated that I was not minded to amend the code to expand the list of relevant authorities [that must comply with the surveillance camera code of practice] because I considered that we had not exhausted the possibilities of increasing voluntary compliance with its requirements. That remains my position.

Reasonable enough, you might say. Except that the Commissioner had previously explained to the UK government that he had already tried asking for "voluntary compliance", only to be told by the hospitals that "they could not enforce compliance with guidance that was not mandatory". A cynic might almost think the UK government doesn't really care what its Surveillance Camera Commissioner recommends.

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Filed Under: cctv, hospitals, privacy, rules, surveillance camera commissioner, surveillance cameras, uk

Donald Trump Demonstrating How Much Of Our Political System Is Based On Tradition & Custom, Not Rules

from the is-that-good-or-bad? dept

President-elect Donald Trump has said he might do away with regular press briefings and daily intelligence reports. He wants to retain private security while receiving secret service protection, even after the inauguration. He is encouraging members of his family to take on formal roles in his administration, testing the limits of anti-nepotism statutes. And he is pushing the limits of ethics laws in trying to keep a stake in his business.

In a series of decisions and comments since his election last month -- from small and stylistic preferences to large and looming conflicts -- Trump has signaled that he intends to run his White House much like he ran his campaign: with little regard for tradition. And in the process of writing his own rules, he is shining a light on how much of the American political system is encoded in custom, and how little is based in the law.

Filed Under: customs, donald trump, politics, rules

What's At Stake In Apple/FBI Fight: Who Gets To Set The Rules That Govern Your Privacy & Security

from the this-is-important dept

We live in a software-defined world. In 2000, Lawrence Lessig wrote that Code is Law — the software and hardware that comprise cyberspace are powerful regulators that can either protect or threaten liberty. A few years ago, Mark Andreessen wrote that software was eating the world, pointing to a trend that is hockey sticking today. Software is redefining everything, even national defense. But, software is written by humans. Increasingly, our reality will obey the rules encoded in software, not of Newtonian physics. Software defines what we can do and what can be done to us. It protects our privacy and ensures security, or not. Software design can be liberty-friendly or tyranny-friendly.

This battle is over who gets to control software, and thus the basic rules of the world we live in. Who will write the proverbial laws of physics in the digital world? Is it the FBI and DOJ? Is it the US Congress? Is it private industry? Or is it going to be individuals around the world making choices that will empower us to protect ourselves — for better or for worse?

The big question then becomes: Are people going to be forced to live in a surveillance-friendly world? Or will the public be able to choose products — phones, computers, apps — that keep our private information, conversations, and thoughts secure?

Right now, the FBI wants to decide these questions with reference to a law that was originally passed in 1789. The All Writs Act allows courts to “issue all writs necessary or appropriate in aid of their respective jurisdictions and agreeable to the usages and principles of law.” Obviously, Congress wasn’t considering iPhone security at the time. The AWA has no internal limits and provides no guidance for courts on how to weigh individual privacy interests with corporate liberty and business interests with public safety interests. It is an utterly inappropriate vehicle for compelling forensic assistance.

If the All Writs Act can be used in this way — to force a company to develop forensic software that the government wants to deploy in a single case of terrorism — it could be used in any number of other (currently unforeseen) circumstances.

In other words, design mandates will be next. In fact, maybe it’s already happening behind our backs. When the Snowden documents showed that Microsoft had created surveillance backdoors in Skype, Outlook.com, and Hotmail, the company issued a statement. It said:

Finally when we upgrade or update products legal obligations may in some circumstances require that we maintain the ability to provide information in response to a law enforcement or national security request. There are aspects of this debate that we wish we were able to discuss more freely. That’s why we’ve argued for additional transparency that would help everyone understand and debate these important issues.

At the Center for Internet and Society, we’ve been trying to figure out what those legal obligations are. I wonder if these AWA arguments are part of it.

To make sound policy in this space, the public needs to know what the government is forcing companies to do, the full picture. This San Bernardino case is just one salvo in the ongoing war between a surveillance-friendly world and a surveillance-resistant world. The stakes for liberty, security, and privacy — for control over our software-defined world — are high.

Filed Under: fbi, government, jennifer granick, people, privacy, rules, security, technology
Companies: apple

Self-Driving Cars Have Twice The Accidents, But Only Because Humans Aren't Used To Vehicles Following The Rules

from the I'm-sorry-you-hit-me,-Dave dept

"Last year, Rajkumar offered test drives to members of Congress in his lab’s self-driving Cadillac SRX sport utility vehicle. The Caddy performed perfectly, except when it had to merge onto I-395 South and swing across three lanes of traffic in 150 yards (137 meters) to head toward the Pentagon. The car’s cameras and laser sensors detected traffic in a 360-degree view but didn’t know how to trust that drivers would make room in the ceaseless flow, so the human minder had to take control to complete the maneuver."

"Turns out, though, their accident rates are twice as high as for regular cars, according to a study by the University of Michigan’s Transportation Research Institute in Ann Arbor, Michigan. Driverless vehicles have never been at fault, the study found: They’re usually hit from behind in slow-speed crashes by inattentive or aggressive humans unaccustomed to machine motorists that always follow the rules and proceed with caution."

Filed Under: accidents, autonomous vehicles, cars, driving, rules, self driving cars
Companies: google

Tom Friedman: If We Don't Sign The TPP Agreement, The World Will Be Overtaken By ISIS, Anarchy And China

from the who-said-what-now? dept

Because these deals are not just about who sets the rules. They’re about whether we’ll have a rule-based world at all. We’re at a very plastic moment in global affairs — much like after World War II. China is trying to unilaterally rewrite the rules. Russia is trying to unilaterally break the rules and parts of both the Arab world and Africa have lost all their rules and are disintegrating into states of nature. The globe is increasingly dividing between the World of Order and the World of Disorder.

When you look at it from Europe — I’ve been in Germany and Britain the past week — you see a situation developing to the south of here that is terrifying. It is not only a refugee crisis. It’s a civilizational meltdown: Libya, Yemen, Syria and Iraq — the core of the Arab world — have all collapsed into tribal and sectarian civil wars, amplified by water crises and other environmental stresses.

What does all this have to do with trade deals? With rising disorder in the Middle East and Africa — and with China and Russia trying to tug the world their way — there has never been a more important time for the coalition of free-market democracies and democratizing states that are the core of the World of Order to come together and establish the best rules for global integration for the 21st century, including appropriate trade, labor and environmental standards. These agreements would both strengthen and more closely integrate the market-based, rule-of-law-based democratic and democratizing nations that form the backbone of the World of Order.

As Obama told his liberal critics Friday: If we abandon this effort to expand trade on our terms, “China, the 800-pound gorilla in Asia will create its own set of rules,” signing bilateral trade agreements one by one across Asia “that advantage Chinese companies and Chinese workers and ... reduce our access ... in the fastest-growing, most dynamic economic part of the world.” But if we get the Pacific trade deal done, “China is going to have to adapt to this set of trade rules that we’ve established.” If we fail to do that, he added, 20 years from now we’ll “look back and regret it.”

Filed Under: free trade, isis, order, rules, tom friedman, tpp, trade, trade agreements

The CIA Will Keep Killing Civilians With Drone Strikes Because The 'Rules' For Drone Strikes Aren't Actually Rules

from the more-like-a-list-of-'it-would-be-nice-if...'-requests dept

Extrajudicial killing by pilotless air strikes is just something our government does now. Weaponized drones are sent out to eliminate enemies of the United States, supposedly under the guidance of the Dept. of Justice and some presidential policy directives. But the rules aren't rules. They appear to be set in stone when the legal authority behind these drone strikes is questioned. But they're much more fluid when they "need" to be... like, say, after a drone strike takes out more than its intended target. [h/t Chris Soghoian]

Last week, the U.S. officials disclosed that two Western hostages, U.S. and Italian aid workers Warren Weinstein and Giovanni Lo Porto, were killed on Jan. 15 by a U.S. drone strike aimed at al Qaeda militants in Pakistan…

Last week, Mr. Obama apologized for the killings and took personal responsibility for the mistake. He called the operation “fully consistent with the guidelines under which we conduct counterterrorism efforts in the region...”

President Barack Obama tightened rules for the U.S. drone program in 2013, but he secretly approved a waiver giving the Central Intelligence Agency more flexibility in Pakistan than anywhere else to strike suspected militants, according to current and former U.S. officials.

About once a month, staff members of the congressional intelligence committees drive across the Potomac River to C.I.A. headquarters in Langley, Va., and watch videos of people being blown up.

As part of the macabre ritual the staff members look at the footage of drone strikes in Pakistan and other countries and a sampling of the intelligence buttressing each strike, but not the internal C.I.A. cables discussing the attacks and their aftermath.

When Ms. Feinstein was asked in a meeting with reporters in 2013 why she was so sure she was getting the truth about the drone program while she accused the C.I.A. of lying to her about torture, she seemed surprised.

“That’s a good question, actually,” she said.

Filed Under: cia, drones, pakistan, rules