The Human Cost Of FOSTA

from the wasn't-it-supposed-to-save-lives dept

As you'll recall in the run up to passing FOSTA last year, supporters of the bill -- backed in secret by Hollywood lobbyists whose sole goal was to create liability for internet companies and force them to install filters -- kept insisting that it was all about "protecting women." There was an infamously misleading Public Service Announcement that supporters of the bill put together, staring into the camera and talking grimly about how necessary it was to amend Section 230 to save women. It starred a bunch of famous actors, including Amy Schumer, Tony Shalhoub, Josh Charles, Seth Meyers, and others.

Of course, since FOSTA passed, it has yet to be used against any website. Indeed, the website that everyone kept holding up as proof for why FOSTA was needed, Backpage, was actually shut down a week before FOSTA became law under existing laws.

And yet, FOSTA has created tremendous real world damage. A bunch of sites and individuals have been silenced out of fear that it might be used against them, creating massive chilling effects -- including chilling effects on advocacy and information providing groups who try to help sex trafficking victims, but who now may violate FOSTA in continuing to do that work.

Lura Chaberlian has now published a deep dive into how FOSTA is a "hostile law" with "a human cost" for Fordham Law School. The quick summary of the paper is that FOSTA hasn't done anything to help sex trafficking victims, but has created real harms for many women, especially those engaged in consensual sex work.

According to the 485 members of Congress who supported the law and the numerous celebrities who appeared in public service announcements evangelizing it, the Allow States and Victims to Fight Online Sex Trafficking Act of 20176 (“FOSTA”) was going to save people. FOSTA enjoyed a glowing narrative as a panacea for sexual corruption in the United States: it would reduce deaths, prevent rapes, and gut the marketplace for abusive sexual activity. Pimps would no longer be able to so readily sell a woman’s body, and children would be safe from predation. These results were as good as guaranteed because a significant amount of sex trafficking occurs online. FOSTA would make it a crime for websites to continue allowing malefactors to advertise for this abhorrent behavior on their platforms. With trafficking off the internet, the sex industry would shrivel. The right parties would be held responsible. No one would get hurt.

Within one month of FOSTA’s enactment, thirteen sex workers were reported missing, and two were dead from suicide. Sex workers operating independently faced a tremendous and immediate uptick in unwanted solicitation from individuals offering or demanding to traffic them. Numerous others were raped, assaulted, and rendered homeless or unable to feed their children. These egregious acts of violence and economic devastation are directly attributable to FOSTA’s enactment. Meanwhile, law enforcement professionals have complained that their investigations into sex-trafficking cases have been “blinded”—they no longer have advertisements to subpoena, digital records to produce for prosecutors, and leads that can bring them to live crime scenes full of evidence, like hotel rooms. This blindness is not for lack of anything to see: one report suggests that online sex trafficking is as prevalent as ever.

Just to be clear, in the actual report, in just those two paragraphs, there are 17 footnotes to articles detailing every statement made (the full paper has 330 such footnoted citations). This is a huge collection of evidence around the very real harms of FOSTA. As the paper notes, rather than saving lies FOSTA is "a law with a body count" attached to it:

FOSTA directly endangers individuals who perform commercial sexual services by driving these transactions away from the relative protection of the internet and back onto the street. Traditionally, solicitation of a sex worker’s services took place during an in-person encounter that also functioned as an advertisement for business: a brothel or, more recently, the street. Street work is more dangerous than indoor work and can even be lethal. Rape and assault are prevalent and seen as inevitable, and workers are at risk of violence from clients and law enforcement alike. As the internet became a ubiquitous utility, sex workers were able to move the negotiation and solicitation stages of their business to online forums that did not demand physical presence. Sex workers gained the means to create an electronic record of client communications, screen potential clients, and communicate with one another about dangerous clients, safe spaces, and other industry-specific health and safety tips. The shift online revolutionized the industry, imbuing sex work with a previously nonexistent level of safety and decreasing the need for third parties as security or advertisement intermediaries. The effect was striking: a 2017 study found that “from 2002 to 2010, when Craigslist’s erotic-services site was active and solicitation moved indoors, the female homicide rate fell by seventeen percent.”

Incredibly, the paper highlights how FOSTA is likely to create more sex trafficking since sex workers may feel pressured to have pimps for protection, which they didn't need previously.

FOSTA confines commercial sex to its most dangerous model. Since FOSTA’s enactment, sex workers have reported an increase in communication from “pimps” claiming that their services are necessary. Although some sex workers work with third parties voluntarily, others may feel pressured into a situation that could easily become sex trafficking, meaning that FOSTA could actually facilitate sex trafficking by forcing consensual sex workers into coercive situations. Further, the workers most endangered by street-based sex work tend to be from marginalized communities. Women of color are disproportionately arrested and prosecuted for prostitution-related offenses, and forcing sex work into the street will only increase these arrests. In addition to scrubbing advertisements for consensual sex from online forums, FOSTA threatens access to secondary online resources used for protection and verification.284 None of these consequences has a valid relationship to FOSTA’s purported aim.

So, despite that dramatic PSA above, so far FOSTA has:

• Not helped take down Backpage (existing laws did that)
• Led to widespread internet censorship, including information designed to help sex trafficking victims
• Put sex workers in much greater risk, leading to multiple deaths and disappearances
• Facilitated more sex trafficking by pushing sex workers into the waiting arms of traffickers for "protection"
• Not shown any actual decrease is sex trafficking or sex trafficking advertisements.

Oh, and no officials have actually used the law yet.

So, maybe, someone should be asking Amy Schumer, Tony Shalhoub, Josh Charles, Seth Meyers, and those others how they feel about this law that they were instrumental in getting passed. Or, better yet, someone should be asking whoever it was who put them up to be spokespersons for this terrible and unconstitutional law.

Filed Under: cda 230, fosta, safety, sex trafficking

Shoddy Software Is Eating The World, And People Are Dying As A Result

from the sometimes-it's-too-late-to-issue-an-update dept

Two recent crashes involving Boeing 737 Max jets are still being investigated. But there is a growing view that anti-stall software used on the plane may have caused a "repetitive uncommanded nose-down", as a preliminary report into the crash of the Ethiopian Airlines plane puts it. Gregory Travis has been a pilot for 30 years, and a software developer for more than 40 years. Drawing on that double expertise, he has written an illuminating article for the IEEE Spectrum site, entitled "How the Boeing 737 Max Disaster Looks to a Software Developer" (free account required). It provides an extremely clear explanation of the particular challenges of designing the Boeing 737 Max, and what they tell us about modern software development.

Airline companies want jets to be as cost-effective as possible. That means using engines that are as efficient as possible in converting fuel into thrust, which turns out to mean engines that are as big as possible. But that was a problem for the hugely-popular Boeing 737 series of planes. There wasn't enough room under the wing simply to replace the existing jet engines with bigger, more fuel-efficient versions. Here's how Boeing resolved that issue -- and encountered a new challenge:

The solution was to extend the engine up and well in front of the wing. However, doing so also meant that the centerline of the engine's thrust changed. Now, when the pilots applied power to the engine, the aircraft would have a significant propensity to "pitch up," or raise its nose.

The solution to that problem was the "Maneuvering Characteristics Augmentation System," or MCAS. Its job was simply to stop the human pilots from putting the plane in a situation where the nose might go up too far, causing the plane to stall -- and crash. According to Travis, even though the Boeing 737 Max has two flight management computers, only one is active at a time. It bases its decisions purely on the sensors that are found on one side of the plane. Since it does not cross-check with sensors on the other side of the plane, it has no way of knowing if a sensor is producing wildly inaccurate information. It assumes that the data is correct, and responds accordingly:

In a pinch, a human pilot could just look out the windshield to confirm visually and directly that, no, the aircraft is not pitched up dangerously. That's the ultimate check and should go directly to the pilot's ultimate sovereignty. Unfortunately, the current implementation of MCAS denies that sovereignty. It denies the pilots the ability to respond to what's before their own eyes.

Like someone with narcissistic personality disorder, MCAS gaslights the pilots. And it turns out badly for everyone. "Raise the nose, HAL." "I’m sorry, Dave, I’m afraid I can’t do that."

The coders who wrote the MCAS software for the 737 Max don't seem to have worried about the risks of using sensors from just one side in the computer's determination of an impending stall. This major design blunder may have cost the lives of hundreds of people, and shows that "safety doesn’t come first -- money comes first, and safety's only utility in that regard is in helping to keep the money coming," according to Travis. But he points out that it also reveals something more general, and much deeper: the growing use of software code that is simply not good enough.

I believe the relative ease -- not to mention the lack of tangible cost -- of software updates has created a cultural laziness within the software engineering community. Moreover, because more and more of the hardware that we create is monitored and controlled by software, that cultural laziness is now creeping into hardware engineering -- like building airliners. Less thought is now given to getting a design correct and simple up front because it's so easy to fix what you didn’t get right later.

Every time a software update gets pushed to my Tesla, to the Garmin flight computers in my Cessna, to my Nest thermostat, and to the TVs in my house, I'm reminded that none of those things were complete when they left the factory -- because their builders realized they didn't have to be complete. The job could be done at any time in the future with a software update.

Back in August 2011, Netscape founder and VC Marc Andreessen wrote famously that "software is eating the world". He was almost right. It turns that shoddy software is eating the world, sometimes with fatal consequences.

Follow me @glynmoody on Twitter, Diaspora, or Mastodon.

Filed Under: 737 max, eating the world, safety, software, unfinished, updates
Companies: boeing

Research Paper Shows Militarized SWAT Teams Don't Make Cops -- Or The Public -- Any Safer

from the treating-citizens-like-enemy-combatants-is-never-a-good-idea dept

A study has been released confirming what many have suspected: militarization of law enforcement doesn't make communities safer, has zero effect on officer safety, and is rarely deployed as advertised when agencies make pitches for the acquisition of military gear.

The most frequent recipient of military tools and training are SWAT teams. Professor Jonathan Mummolo's research -- published by the National Academy of Sciences -- gained unprecedented access to SWAT deployment numbers, thanks to a public records request and a Maryland state law requiring documentation of every SWAT raid performed. (That law was allowed to expire by legislators who apparently felt it provided too much transparency and accountability.)

With these numbers, Mummolo was able to compare SWAT deployments to other stats, as well as see just how often SWAT teams were deployed to handle dangerous situations like robberies, shootings, hostage-taking, etc. What he discovered was, sadly, unsurprising. Police officials talk about the necessity of SWAT teams and military gear using references to barricaded suspects, terrorist attacks, active shooters…. pretty much anything but what they actually use them for. From the paper [PDF]:

[R]oughly 90% of SWAT deployments in that state over 5 fiscal years were conducted to serve search warrants. Previous work has shown that the use of SWAT teams to serve warrants, a practice which escalated as a result of the war on drugs, is an extremely disruptive event in the lives of citizens and often involves percussive grenades, battering rams, substantial property damage, and in rare cases deadly altercations stemming from citizens’ mistaken belief that they are experiencing a home invasion. [...] less than 5% of deployments involved a “barricade” scenario, which typically involves an armed suspect refusing to surrender to police. Violence to people and animals is rare, and gun shots are fired 1.2% of the time—roughly 100 deployments during this period. While the data suggest that indiscriminate violence is less common than some anecdotal reports suggest, they also show that the vast majority of SWAT deployments occur in connection with non-emergency scenarios, predominately to serve search warrants.

Similarly unsurprising is data showing SWAT teams are deployed far more often in areas with a higher concentration of African American residents. Mummolo's research shows a 10% increase in African American population resulted in a 10.5% increase in SWAT deployments.

All the gear obtained by police agencies to make officers safer doesn't seem to have an effect on officer safety. The data shows negligible effects on officer injuries or deaths. Despite being touted as essential tools to combat a supposed increase in criminal firepower, SWAT teams and their military gear spend more time serving warrants than facing dangerous situations. Maryland SWAT stats -- compared against other data reported by law enforcement agencies -- results in this conclusion:

[T]here is no evidence that acquiring a SWAT team lowers crime or promotes officer safety.

Surveys conducted by Mummolo show SWAT teams -- and police militarization in general -- have a negative effect on public perception. SWAT teams make the places they're frequently deployed seem less safe, even if crime stats don't back that up. Dressing up in military gear increases distrust of the law enforcement agency -- something especially pronounced in African American respondents.

Mummolo's conclusion, based on stats supplied by law enforcement agencies, is devastating. And it's likely to be ignored by every law enforcement agency in Maryland.

Given the concentration of deployments in communities of color, where trust in law enforcement and government at large is already depressed, the routine use of militarized police tactics by local agencies threatens to increase the historic tensions between marginalized groups and the state with no detectable public safety benefit. While SWAT teams arguably remain a necessary tool for violent emergency situations, restricting their use to those rare events may improve perceptions of police with little or no safety loss.

SWAT teams arose out of a need for elite response units to send to especially dangerous situations. It's quickly devolved into nothing more than a sideshow for warrant service -- an excuse to treat citizens like enemy combatants while needlessly escalating situations until they can justify the absurdly overblown tactics and weaponry being deployed.

Filed Under: militarized police, police, public safety, safety, swat teams, warrior cop

Arizona Bans Self-Driving Car Tests; Still Ignores How Many Pedestrians Get Killed

from the plenty-of-blame-to-go-around dept

By now, most folks have read about the fact that Uber (surprise) was responsible for the first ever pedestrian fatality caused by a self-driving car in the United States. Investigators in the case have found plenty of blame to go around, including a pedestrian who didn't cross at a crosswalk, an Uber driver who wasn't paying attention to the road (and therefore didn't take control in time), and Uber self-driving tech that pretty clearly wasn't ready for prime time compared to its competitors:

"Uber’s robotic vehicle project was not living up to expectations months before a self-driving car operated by the company struck and killed a woman in Tempe, Ariz.

The cars were having trouble driving through construction zones and next to tall vehicles, like big rigs. And Uber’s human drivers had to intervene far more frequently than the drivers of competing autonomous car projects."

All of the companies that contribute tech to Uber's test vehicle have been rushing to distance themselves from Uber's failures here. Many of them are laying the blame at the feet of Uber, including one company making it clear that Uber had disabled some standard safety features on the Volvo XC90 test car in question:

"Uber Technologies Inc. disabled the standard collision-avoidance technology in the Volvo SUV that struck and killed a woman in Arizona last week, according to the auto-parts maker that supplied the vehicle’s radar and camera.

“We don’t want people to be confused or think it was a failure of the technology that we supply for Volvo, because that’s not the case,” Zach Peterson, a spokesman for Aptiv Plc, said by phone. The Volvo XC90’s standard advanced driver-assistance system “has nothing to do” with the Uber test vehicle’s autonomous driving system, he said."

Mobileye, the company that makes the collision-avoidance technology behind Aptiv's tech, was also quick to pile on, noting that if implemented correctly, their technology should have been able to detect the pedestrian in time:

"Intel Corp.’s Mobileye, which makes chips and sensors used in collision-avoidance systems and is a supplier to Aptiv, said Monday that it tested its own software after the crash by playing a video of the Uber incident on a television monitor. Mobileye said it was able to detect Herzberg one second before impact in its internal tests, despite the poor second-hand quality of the video relative to a direct connection to cameras equipped to the car."

In response to Uber's tragic self-driving face plant, Arizona this week announced that it will be suspending Uber's self-driving testing technology in the state indefinitely:

Plenty have justly pointed out that Arizona also has plenty of culpability here, given the regulatory oversight of Uber's testing was arguably nonexistent. That said, Waymo (considered by most to be way ahead of the curve on self-driving tech) hasn't had similar problems, and there's every indication that a higher quality implementation of self-driving technology (as the various vendors above attest) may have avoided this unnecessary tragedy.

Still somehow lost in the finger pointing (including Governor Doug Ducey's "unequivocal commitment to public safety") is the fact that Arizona already had some of the highest pedestrian fatalities in the nation (of the human-caused variety). There were ten other pedestrian fatalities the same week as the Uber accident in the Phoenix area alone, and Arizona had the highest rate of pedestrian fatalities in the nation last year, clearly illustrating that Arizona has some major civil design and engineering questions of its own that need to be answered as the investigation continues.

Again, there's plenty of blame to go around here, and hopefully everybody in the chain of dysfunction learns some hard lessons from the experience. But it's still important to remember that human-piloted counterparts cause 33,000 fatalities annually, a number that should be dramatically lower when self-driving car technology is inevitably implemented (correctly).

Filed Under: arizona, autonomous vehicles, pedestrians, safety, self-driving cars
Companies: uber

Study On Craigslist Shutting 'Erotic Services' Shows SESTA May Hurt Those It Purports To Help

from the good-intentions-do-not-make-good-policy dept

The last two posts I wrote about SESTA discussed how, if it passes, it will result in collateral damage to the important speech interests Section 230 is intended to protect. This post discusses how it will also result in collateral damage to the important interests that SESTA itself is intended to protect: those of vulnerable sex workers.

Concerns about how SESTA would affect them are not new: several anti-trafficking advocacy groups and experts have already spoken out about how SESTA, far from ameliorating the risk of sexual exploitation, will only exacerbate the risk of it in no small part because it disables one of the best tools for fighting it: the Internet platforms themselves:

[Using the vilified Backpage as an example, in as much as] Backpage acts as a channel for traffickers, it also acts as a point of connection between victims and law enforcement, family, good samaritans, and NGOs. Countless news reports and court documents bear out this connection. A quick perusal of news stories shows that last month, a mother found and recovered her daughter thanks to information in an ad on Backpage; a brother found his sister the same way; and a family alerted police to a missing girl on Backpage, leading to her recovery. As I have written elsewhere, NGOs routinely comb the website to find victims. Nicholas Kristof of the New York Times famously “pulled out [his] laptop, opened up Backpage and quickly found seminude advertisements for [a victim], who turned out to be in a hotel room with an armed pimp,” all from the victim’s family’s living room. He emailed the link to law enforcement, which staged a raid and recovered the victim.

And now there is yet more data confirming what these experts have been saying: when there have been platforms available to host content for erotic services, it has decreased the risk of harm to sex workers.

The September 2017 study, authored by West Virginia University and Baylor University economics and information systems experts, analyzes rates of female homicides in various cities before and after Craigslist opened an erotic services section on its website. The authors found a shocking 17 percent decrease in homicides with female victims after Craigslist erotic services were introduced.

The reasons for these numbers aren't entirely clear, but there does seem to be a direct correlation in the safety to sex workers when, thanks to the availability of online platforms, they can "move indoors."

Once sex workers move indoors, they are much safer for a number of reasons, Cunningham said. When you’re indoors, “you can screen your clients more efficiently. When you’re soliciting a client on the street, there is no real screening opportunity. The sex worker just has to make the split second decision. She relies on very limited and complete information about the client’s identity and purposes. Whereas when a sex worker solicits indoors through digital means, she has Google, she has a lot of correspondence, she can ask a lot of questions. It’s not perfect screening, but it’s better.”

The push for SESTA seems to be predicated on the unrealistic notion that all we need to do to end sex trafficking is end the ability of sex services to use online platforms. But evidence suggests that removing the "indoor" option that the Internet affords doesn't actually end sex work; it simply moves it to the outdoors, where it is vastly less safe.

In 2014, Monroe was a trafficking victim in California. She found her clients by advertising on SFRedbook, the free online erotic services website. One day, she logged into the site and discovered that federal authorities had taken it down. Law enforcement hoped that closing the site would reduce trafficking, but it didn’t help Monroe. When she told her pimp SFRedbook was gone, he shrugged. Then he told her that she would just have to work outdoors from then on.

“When they closed down Redbook, they pushed me to the street,” Monroe told ThinkProgress. “We had a set limit we had to make a day, which was more people, cheaper dates, and if you didn’t bring that home, it was ugly.” Monroe, who asked that her last name be withheld for privacy reasons, had been working through Redbook in hotel rooms almost without incident, but working outdoors was much less safe.

“I got raped and robbed a couple of times,” she said. “You’re in people’s cars, which means nobody can hear you if you get robbed or beaten up.”

A recurrent theme here on Techdirt is that, as with any technology policy, no matter how well-intentioned it is, whether or not it is a good policy depends on its unintended consequences. Not only do we need to worry about how a policy affects other worthwhile interests, but it also needs to consider how it affects the interest it seeks to vindicate. And in this case SESTA stands to harm the very people it ostensibly seeks to help.

Does that mean Congress should do nothing to address sex trafficking? Of course not, and it is considering many more options that more directly address the serious harms that arise from sex trafficking. Even Section 230 as it currently exists does not prevent the government from going after platforms if they directly aid it. But all too often regulators like to take shortcuts and target platforms simply because bad people may be using them in bad ways. It's a temptation that needs to be resisted for many reasons, but not the least of which is that doing so may enable bad people to behave even worse.

Filed Under: erotic services, safety, sesta, sex workers
Companies: craigslist

Our Humanity

from the this-is-not-a-game dept

Over the last few months, we've had a very, very small, but still vocal group of folks in our comments who have gotten angry every time we've been critical of Donald Trump -- even when we were making nearly identical complaints about him as we did about Barack Obama and Hillary Clinton. That group of people probably won't like this post very much, though I do hope they'll read it with open minds. We're not a political blog. We cover technology and innovation, as well as the legal, economic and policy issues related to those things. Over the years, that's included issues related to civil liberties and civil rights. We don't see these things as being separate. They are all connected and intertwined. We've even spent plenty of time discussing immigration, though focusing on high tech and entrepreneur immigration.

But I don't think there's any need for me to try to justify why I'm making this post on Techdirt today. This is about humanity. And if you want to complain in the comments that you don't want to read this on a "tech" site, well, then maybe take a second and think about what this says about you. Basically my entire family came to America between around 1890 and 1920 -- most of them escaping religious persecution elsewhere. My great grandmother had to hide in the bottom of a boat to escape from where she lived. Many came through Ellis Island, and were welcomed into America. My grandfathers built up businesses here. One fought bravely against Nazis (literally) in World War II for the US in Europe and North Africa, and came back to the US and built a company that (among other things) was a huge supplier for the Boy Scouts of America. While they may have struggled at times, my family came to America and was embraced by America, thrived in America and has always loved America. My wife is an immigrant. Her family moved here when she was young to give her and her siblings a better life. And that's what they found. America embraced them and they embraced America back. They're all US citizens.

All weekend long, I've been reading all sorts of accounts about President Trump's executive order. Some of it has been thoughtful. Some of it has been hysterical. Some of it has been painful. Some of it has been ridiculous.

But it all comes back to one thing: this is about our humanity.

The "excuses" that some have been spewing for the executive order make no sense. They say this is about "safety," yet there is no evidence that the people being kept out were a risk to our safety. As many have noted, not a single terrorist attack has come from people from those countries. They say this is about "extreme vetting" but ignore that refugees already go through a ridiculously long and thorough "extreme vetting" process that can take years. They say that this is just an "inconvenience" to a "small group" of people, ignoring that they are basically upending the lives of entire families -- families including those with permanent resident status, who have been valuable, contributing members to our country for years and years and years.

This is madness.

They say that this is necessary to protect us at home, but even ignoring everything above, it's hard to see how this doesn't make us less safe. How can anyone read this essay by Kirk Johnson and not realize how much harm we're doing. Johnson has devoted a big part of his life to helping Iraqis who literally put their lives at risk to help Americans, and then were ignored by America. Read what he's written and ask yourself what foreigner will sign up to help America again in the future?

They say this is about "the rule of law," but then explain why Customs and Border Patrol are literally ignoring court orders and refusing to even speak to members of Congress? They say this is about stopping threats at home, but that doesn't explain at all why the White House failed to have the relevant experts review the executive order before it was put in place, or why multiple national security experts have noted this will clearly make us less safe. And, of course, nothing explains why the White House directly overruled Homeland Security saying this wouldn't apply to permanent residents (and then required DHS to later come out and try to clarify).

Again, this goes back to a story about basic humanity. And our country massively failing.

I know there are lots of people speculating on a variety of things around all of this. There are explanations that this is part of a "shock doctrine" move to sow chaos and confusion and deligitimize organizations before the really bad policy is put into place. And perhaps that's true. It's certainly something to watch for. But, as someone who tries to look at every policy proposal based on a "does this make sense" or "does this make the world a better place" metric -- and not on a "does this help my team" scale -- it must be stated that the executive order Donald Trump signed late last week, that was put into effect over the weekend is not just a disaster. It hasn't just created a constitutional crisis with parts of the executive branch ignoring the judiciary. It's not just a policy that is impacting millions of lives.

It's simply inhumane.

This is about humanity, and anyone who has any sense of humanity has a responsibility to speak up about it and to say that this is not right. If you get angry about this post, and think you need to insult us and attack me or this site, I would only recommend that you first take stock of your life, and think about what message you are sending out into the world when you do so.

Filed Under: civil liberties, decency, donald trump, humanity, immigration, refugees, safety, security

If You Want To Believe This Country Is Falling Apart, Just Ask Those Who Are Supposed To Be Keeping It Together

from the lies,-damn-lies,-and-statistical-fuckery dept

If you really want to believe the nation is unsafe and under threat from foreigners of all kinds, the government entities in charge of ensuring your safety are more than happy to oblige your dark fantasies.

No one should be surprised that the [Texas] Department of Public Safety overstated the number of "high risk" arrests they made as part of the border surge, as AP's Paul Weber ably reported last week. "Among the 'high-threat' incidents was a trailer that unlatched from an RV and rolled into oncoming traffic, killing another driver in a town more than 150 miles from the border. Other crimes lumped in with suspected killers and human traffickers were speeding teenagers and hit-and-runs that caused no serious injuries."

Nothing sells like fear. And the Department of Public Safety is in need of some sales. There's $800 million in border security dollars at stake. At least. The DPS would like $300 million more this year because it's just damn unsafe to share a border with a foreign country.

If securing that money requires portraying any influx of Mexican citizens as an apocalyptic crimewave, the DPS can certainly do that. There are no limits to its statistical manipulations. Grits for Breakfast points to the Corpus-Christi Caller's derisive editorial detailing the DPS's bullshittery.

The DPS classified 1,800 arrests as high-threat. And apparently many of them actually were. But, according to an Associated Press analysis, many of these arrests turned out to be for drunken driving, failure to pay child support and minor drug possession. The DPS didn't bother to differentiate user amounts from smuggler amounts in its statistics. It also considered 60 counties to be border-region, which undoubtedly would tax the imaginations of even our best and brightest middle school geography teachers.

It's not just a border thing. The same number are used to nail down Drug War dollars. The DPS says "high threat" traffickers, conveniently obscuring the fact that nearly 30% of the busts it references were for less than a gram of cocaine or marijuana.

The DPS responded to the AP investigation with the rather astounding claim that the numbers it was inflating to obtain more border security dollars weren't being misrepresented to obtain more funding.

In response to the AP's findings, the Department of Public Safety said it will recommend removing child support evaders from the list and signaled a willingness to stop classifying other arrests as "high threat." However, it defended the data overall, saying it isn't intended to measure border security, even though the figures are included in briefings to lawmakers.

Whatever. Lawmakers certainly believed the DPS was making border security "measurements" with its twisted facts. That's all that matters. While there are some disbelievers, like Rep. Terry Canales ("It's deceptive to say the least..."), there were certainly far more who bought into the "fear for your safety" narrative.

And why wouldn't they? Using illegal immigrants to gather tax dollars is a longstanding Texas tradition. If the DPS feels comfortable calling deadbeat dads "high threats," it's only because its role models -- a long string of indistinguishable governors (Rick Perry, Greg Abbott) and alleged serial killer Sen. Ted Cruz -- have built sustainable political careers by capitalizing on a fearful narrative not actually backed up by numbers. And if it's not Mexican immigrants, it's ISIS setting up franchises right over the fence.

So, yeah... this:

It's not just a Texas thing. The federal government does the same thing and has for years. The Drug War hasn't resulted in any less funding over the past forty years despite steep drops in crime rates and legalization efforts in multiple states. The existential threat of terrorism makes sure everyone from the DHS to local PDs have plenty of grant money to buy surveillance tech to hunt down amateur photographers and fast food thieves.

Donald Trump's speeches have portrayed America as a war zone populated by criminals, sounding for all the world like he still believes it's the mid-80s and everyone's just now hearing about crack. Clinton is little better, willing to sacrifice encryption in the name of national security and put boots on the ground in response to state-sponsored hacking efforts.

The truth is America has never been safer. Crime rates have generally remained at historic lows for much of this decade. For all the talk about a "war on cops," officers are safer than they've been in fifty years. Law enforcement wants us to belive sex trafficking is an epidemic, but long, well-funded investigations routinely fail to turn up any evidence of this. Any number of law enforcement and parenting groups portray every passing vehicle and pseudonymous social media account as potential child molesters, but the pedo playground they believe the internet is simply doesn't exist.

All these histrionics have almost nothing to do with safety or any government agency's concern about the wellbeing of those putting money in their pockets. It's about the money. It always has been. The primary goal of any government agency is to secure the same amount of funding as last year, if not a little more. Whatever it takes to achieve that goal is deemed acceptable, even if it means using stats to lie to those controlling the purse strings.

Filed Under: department of public safety, hyperbole, law enforcement, national security, overhype, safety, security, texas

Will We Ever Really Get Flying Cars?

from the but-i-want-my-flying-car! dept

If you listen to some entrepreneurs and investors, the flying car – a longstanding staple of science fiction – is right around the corner. Working prototypes exist. At least two companies already take orders for the vehicles, with deliveries promised next year.

The last decade has seen the introduction of practical consumer videoconferencing, voice recognition, drones, self-driving cars and many other items that once were found only in science fiction stories. It therefore might seem plausible that practical flying cars are around the corner. They aren't. Indeed, massive safety, infrastructure and technology problems make them a near impossibility.

The first concern is safety. While flying a commercial airline is always safer than driving oneself the same distance, it's an entirely different story if one looks at per-trip fatality rates. The Department of Transportation estimates that Americans take about 350 billion car trips per-year and experience about 30,000 fatal accidents; roughly one fatal accident per 11 million trips. By contrast, there are roughly 35 million scheduled air flights around the world each year. Over the past decade, the number of commercial aviation incidents that have proved fatal has averaged 17 annually. This means about one of every 2 million commercial air flights ends in death.

We see these fatalities every year, despite pilots' years of intense training, planes' extensive safety equipment requirements, regular maintenance checks and airlines' need to maintain sterling reputations for safety. All of these provide far more safeguards than anything that applies to cars on the road.

It's true that there are some factors that might make flying cars safer than commercial jetliners. They would travel at lower speeds and lower altitudes, for instance. But there's no practical way to subject them to the same safety and training standards imposed on commercial airplanes if they are to become anything like a consumer product. Indeed, the per-trip fatality rates for private planes already is very likely higher than commercial airliners, but there are no worldwide statistics available. Safety advocates would make a plausible case for banning flying cars on these grounds alone.

Even if one thinks these risks are acceptable—and they probably are, given the potential advantages of flying cars—that doesn't solve the even greater infrastructure or technological problems. The current working models of flying cars need runways to take off and land. Bringing them into regular use would require runways just about everywhere, without obviating the need for parking lots. The world's busiest airport, Atlanta's Hartsfield-Jackson, accommodates slightly less than 2,500 aircraft movements each day on its five runways and 4,700 acres. Any sizable office building would need its own version of Hartsfield-Jackson if people were to commute to work via their flying cars. The space to build facilities this size for flying cars simply doesn't exist anywhere near any city of any size.

New technologies could theoretically obviate the need for runways. One Japanese team has shown off a modified lightweight drone supposedly capable of vertical takeoff and landing like a helicopter. But making these vehicles practical would require breakthroughs that appear to be decades away. Existing helicopters and military "jump jets" still require a significant amount of space to land, are even noisier than commercial jets and drink huge amounts of fuel. As such, they're not really used for travel. Commercially produced helicopters have existed since the 1940s and aren't currently used for scheduled commercial service anywhere in the United States. Technological breakthroughs could eventually solve these problems, but it's unlikely that a few years of flying-car development will overcome problems that have bedeviled helicopter designers for more than seven decades.

While the promised 2017 deliveries of working flying cars seem unlikely, it's far from impossible that a commercially produced civilian airplane with the kinds of retractable wings and safety equipment that would allow it to be driven on highways might make it to market within the next decade. But widely available flying cars, more likely than not, will remain clearly in the realm of science fiction.

Filed Under: flying cars, innovation, regulations, safety

The FBI's Not-So-Compelling Pitch For Sacrificing Security For Safety

from the the-public-should-decide-this,-says-agency-seeking-compelled-action-from-a-priva dept

The FBI's attempt to use an All Writs order to force Apple to help it break into a locked iPhone is seemingly built on a compelling case: a large-scale shooting involving people with ties to terrorist groups. This is exactly the sort of case Comey hoped would help push his anti-encryption agenda forward. Or so it seems.

But is the case really that "compelling," especially in the legal sense of the word, which requires the court to weigh the imposition on Apple against the public's interest in seeing wrongdoers punished/future terrorist attacks prevented?

Conor Friedersdorf, writing for The Atlantic, finds the agency's "compelling" case to be far less interesting than the FBI imagines it is.

Even so, there are many factors that make me underwhelmed by the San Bernardino case, too. The killers deliberately destroyed other devices but didn’t bother destroying this one. It was a work phone issued by San Bernardino County. Until some time prior to the killings it was backing up to iCloud, and the FBI was able to get those backups.

]So once again, law enforcement personnel got information about some of what was on the phone. They’re missing a mere fraction of its contents. And one would guess that in the time between the last iCloud backup and the terrorist attack, Syed Farook did not suddenly start updating his work iPhone’s contacts with the addresses of his terrorist buddies, but refrained from calling or texting them (which the phone company could tell the FBI).

The FBI likely knows there's little chance much of investigative worth will be found on this phone. It wants the precedent, not the iPhone's contents. That's why Comey is telling anyone who will listen about other cases where encrypted phones have led to "dead ends." Comey's pitch for an Apple-assisted break-in presumes locked phones are literally helping people get away with murder. Friedersdorf notes that Lawfare's Ben Wittes -- arguing on behalf of the FBI -- cites testimony Comey gave to Congress in which he discusses a pregnant woman who was murdered last summer. Her phone was found near her body but the FBI has been unable to access the contents.

Again, Comey is making serious presumptions about the worth of the phone's contents to investigators. Taking a more logical approach to the facts of the case, Freidersdorf points out this phone is likely to be as useless as the phone central to the FBI's current actions.

For the first 230 years of U.S. history, police officers managed to investigate murders without the benefit of any evidence from smartphones belonging to the victim. Keep that baseline in mind, because any information that the cops get from the Louisiana victim’s device leaves them better off than all prior generations of law enforcement. And they presumably did get some useful information, because a locked device doesn’t prevent them from going to the phone company and getting access to call, text, and location data generated by the device.

It doesn’t stop the authorities from going to Uber to see when the victim last took a ride, to her cloud backup to see what was last uploaded, to her email client to see if she sent or received any messages through that medium, and on and on and on.

Admittedly, there could be something only on the device relevant to the murder. The victim could’ve recorded a quick voice memo. She could’ve jotted a note to herself. She could’ve snapped a photograph of the killer in the moment before he acted. But you’ve gotta think that the odds are against there being conclusive evidence on the phone that isn’t available elsewhere, not only because so much data is available in multiple places, but because the killer left the phone with the victim.

Encryption has turned smartphones into Chekov's Device: if a locked phone is owned by a criminal or found with a crime victim, the automatic assumption is that it houses relevant information of high investigatory value.

Comey is carefully picking his examples when arguing for greater law enforcement access… for the most part. A mass shooting that left 14 dead. A murdered pregnant woman. A fender bender at a busy intersection?

Marcy Wheeler also quotes testimony from Comey.

I’d say this problem we call going dark, which as Director Clapper mentioned, is the growing use of encryption, both to lock devices when they sit there and to cover communications as they move over fiber optic cables is actually overwhelmingly affecting law enforcement. Because it affects cops and prosecutors and sheriffs and detectives trying to make murder cases, car accident cases, kidnapping cases, drug cases. It has an impact on our national security work, but overwhelmingly this is a problem that local law enforcement sees.

Yes, the FBI would like Apple to help it break into an iPhone because law enforcement needs a leg up in traffic enforcement. If the FBI is given what it wants, the precedent will allow local law enforcement agencies to seek the same assistance any time the most mundane of investigations runs into a locked phone.

James Comey said (but didn't mean) the public needs to determine for itself whether they'd rather have security or safety (and presumably apply that conclusion to every member of the public who diagrees with them). But as Friedersdorf points out, every individual member of the public is free to make that decision for themselves, without having to drag in either party or 1789's All Writs Act.

The fact that there’s an unsolved murder case where some evidence might or might not be on a locked phone doesn’t seem like a compelling anecdote demonstrating the need to weaken security on everyone’s consumer devices. And if you’re worried that you’ll be killed and the lock on your smartphone will prevent the cops from finding your killer, by all means, disable the lock screen or leave a copy of your code in a safety deposit box. Everyone is free to decide when the costs of having strong security outweigh the benefits.

This is a decision any individual can make on their own. It doesn't have to involve the government compelling companies to purposefully weaken protective measures. Any member of the "nothing to hide" crowd can shut off anything meant to keep others (criminals or law enforcement) from accessing their phones' contents. Anyone who thinks the government has a "right" to access the contents of their phone should do whatever they can to ensure the government actually has that access -- provided it's limited to their own devices.

Comey says the public should consider the balance between safety and security in light of his agency's efforts. What's left unsaid is that the public has always had the ability to consider the tradeoffs and act on those conclusions. It didn't need the FBI's permission. Or Apple's. But this isn't about the public's ability to determine its own security/safety balance and applying it on a case-by-case basis. This is about the FBI seeking to have that balance determined by a magistrate judge and applied to everyone, regardless of the public's determination of where that balance should actually lie.

Filed Under: encryption, fbi, iphones, safety, security
Companies: apple

Dissecting And Dismantling The Myths Of The DOJ's Motion To Compel Apple To Build A Backdoor

from the dishonest-doj dept

While everyone's waiting for Apple's response (due late next week) to the order to create a backdoor that would help the FBI brute force Syed Farook's work iPhone, the DOJ wasted no time in further pleading its own case, with a motion to compel. I've gone through it and it's one of the most dishonest and misleading filings I've seen from the DOJ -- and that's saying something. Let's dig in a bit:

Rather than assist the effort to fully investigate a deadly terrorist attack by obeying this Court's Order of February 16, 2016, Apple has responded by publicly repudiating that Order. Apple has attempted to design and market its products to allow technology, rather than the law, to control access to data which has been found by this Court to be warranted for an important investigation. Despite its efforts, Apple nonetheless retains the technical ability to comply with the Order, and so should be required to obey it.

This part is only marginally misleading. The key point: of course Apple has designed a product that allows technology to control access because that's how encryption works. It's as if the DOJ still doesn't understand that. Here's a simple, if unfortunate, fact for the DOJ: there are always going to be some forms of communications that it doesn't get to scoop up. Already we know that Farook and his wife destroyed their two personal iPhones. Why not just recognize that fully encrypted phones are the equivalent of that? No one seems to be whining about the destroyed iPhones and what may have been lost even though the very fact that they were destroyed, and this one was not, suggests that if there was anything important on any of his phones, it wasn't this one. There are also things like communications between, say, a husband and wife in their own home. The DOJ can never get access to those because the two people are dead. Think of that like their brains were encrypted and their death made the key get tossed.

There are lots of situations where the physical reality is that the DOJ cannot recover communications. It's not the end of the world. It's never been the end of the world.

Apple, now (finally) trying to design encryption systems that make it so no one else can get in sees this is the best way to protect the American public, because it means that their own information is much safer. It means fewer phones get stolen. It means fewer people are likely to have their information hacked. It means much more safety for the vast majority of the public. And I won't even get into the fact that it was the US government's own hacking of private data that pushed many companies to move more quickly towards stronger encryption.

The government has reason to believe that Farook used that iPhone to communicate with some of the very people whom he and Malik murdered. The phone may contain critical communications and data prior to and around the time of the shooting that, thus far: (1) has not been accessed; (2) may reside solely on the phone; and (3) cannot be accessed by any other means known to either the government or Apple. The FBI obtained a warrant to search the iPhone, and the owner of the iPhone, Farook's employer, also gave the FBI its consent to the search. Because the iPhone was locked, the government subsequently sought Apple's help in its efforts to execute the lawfully issued search warrant. Apple refused.

"May contain" is a pretty weak standard, especially noting what I said above. Furthermore, if there were communications with Farook's victims, then shouldn't that information also be accessible via the phones of those individuals as well? And if they already know that there was communication between the two, much of that data should be available elsewhere, in terms of metadata of a phone call, for example.

Apple left the government with no option other than to apply to this Court for the Order issued on February 16, 2016.

Actually, there are plenty of other options, including traditional detective work, looking for information from other sources or just recognizing that sometimes you don't get every piece of data that exists. And that's okay.

The Order requires Apple to assist the FBI with respect to this single iPhone used by Farook by providing the FBI with the opportunity to determine the passcode. The Order does not, as Apple's public statement alleges, require Apple to create or provide a "back door" to every iPhone; it does not provide "hackers and criminals" access to iPhones; it does not require Apple to "hack [its] own users" or to "decrypt" its own phones; it does not give the government "the power to reach into anyone's device" without a warrant or court authorization; and it does not compromise the security of personal information. To the contrary, the Order allows Apple to retain custody of its software at all times, and it gives Apple flexibility in the manner in which it provides assistance. In fact, the software never has to come into the government's custody.

And here's where the misleading stuff really starts flowing. It absolutely is a backdoor. Anything that makes it easier for a third party to decrypt data without knowing the key is a backdoor. That's the definition of a backdoor. That it comes in the form of making it substantially easier to brute force the passcode doesn't change the fact that it's still a backdoor.

And, yes, this impacts "every" iPhone. As Senator Ron Wyden correctly notes, if the precedent is set that Apple can be forced to do this for this one iPhone, it means it can be forced to do it for all iPhones. No, this single piece of code may not be the issue -- though there are some concerns that even creating this code could lead to some problems if the phone connects to a server -- but forcing a company to hack its own customers puts everyone at risk.

And yes, there is no legitimate way to describe this without claiming that it's hacking Apple's own customers. The whole point of the system is to get around the fact that they don't have the key, and building a tool to disable security features and then allow a brute force attack on the passcode is very much exactly "hacking" Apple's own customers. Sure, this one still requires a warrant, but once Apple is pushed to create that kind of code -- and other companies are forced to build similar backdoors, the technology itself is being designed with extra vulnerabilities that will put many more people at risk. It's not just about the DOJ seeing what's on this damn phone.

The fact that Apple can retain control over the software is a total red herring. No one cares about that. It's about the precedent of a court requiring a company to hack its own customers, as well as forcing them to create a backdoor that can be used in the future -- even to the point of possibility requiring such backdoors in future products.

In the past, Apple has consistently complied with a significant number of orders issued pursuant to the All Writs Act to facilitate the execution of search warrants on Apple devices running earlier versions of iOS. The use of the All Writs Act to facilitate a warrant is therefore not unprecedented; Apple itself has recognized it for years. Based on Apple's recent public statement and other statements by Apple, Apple's current refusal to comply with the Court's Order, despite the technical feasibility of doing so, instead appears to be based on its concern for its business model and public brand marketing strategy.

And the misleading bullshit gets ratcheted up a notch. First of all, we already went through why the "Apple helped us in the past" story is wrong. This is totally different. One is giving access to unencrypted information that Apple had full access to. The other is building a system to hack away security features in order to hack into an encrypted account. Very, very different. Second, the whole idea that better protecting its customers is nothing more than "a brand marketing strategy" is insulting. Should the US government want the American public to be protected from criminals and malicious hackers and attacks? The best way to do that is with encryption. The fact that consumers are demanding that they be safer is not an "Apple marketing strategy" it's Apple looking out for the best interests of its customers.

And I won't even dig deep into the fact that one of the big reasons why the public is clamoring for more protection these days is because the US government ran roughshod over the Constitution over the past few years to suck up all kinds of information it shouldn't have.

Later in the motion, the DOJ again argues that there's no "unreasonable burden" on Apple to hack its own customers. It trots out a similar line that was in the original application for the order, saying "what's the big deal -- we're just asking for software, and Apple makes software, so no burden."

While the Order in this case requires Apple to provide or employ modified software, modifying an operating system which is essentially writing software code in discrete and limited manner is not an unreasonable burden for a company that writes software code as part of its regular business. The simple fact of having to create code that may not now exist in the exact form required does not an undue burden make. In fact, providers of electronic communications services and remote computing services are sometimes required to write some amount of code in order to gather information in response to subpoenas or other process. Additionally, assistance under the All Writs Act has been compelled to provide something that did not previously exist the of the contents of devices seized pursuant to a search warrant. In United States v. Fricosu..., a defendant's computer whose contents were was seized, and the defendant was ordered pursuant to the All Writs Act to assist the government in producing a copy of the contents of the computer. Here, the type assistance does not even require Apple to assist in producing the contents; the assistance is rather to facilitate the FBI's attempts to test passcodes.

Again, this is both ridiculous and extremely misleading. Creating brand new software -- a brand new firmware/operating system is fraught with challenging questions and potential security issues. It's not just something someone whips off. If done incorrectly, it could even brick the device entirely, and can you imagine how the FBI would react then? This is something that would require a lot of engineering and a lot of testing -- and still might create additional problems, because software is funny that way. Saying "you guys write software, so writing a whole new bit of software isn't a burden" is profoundly ignorant of the technological issues. Update: If you want a long and detailed post from someone who absolutely knows how iPhone forensics works, and how incredibly involved creating this software would be, go read this blog post right now. In it, Jonathan Zdziarski, notes that the DOJ is flat out lying in the way it describes what it's asking Apple to do, and it would be incredibly involved, and would create all sorts of risks of the code getting out.

Second, the Fricosu case is quite different. That was compelling someone to give up their own encryption key -- something that not all courts agree with by the way, as some view it as a 5th Amendment or 1st Amendment violation. That's quite different than "write a whole new software thing that works perfectly the way we want it to."

As noted above, Apple designs and implements all of the features discussed, writes and signs the routinely patches security or functionality issues in its operating system, and releases new versions of its operating system to address issues. By comparison, writing a program that turns off features that Apple was responsible for writing to begin with would not be unduly burdensome.

This shows a profound technological ignorance. Yes, Apple updates its operating system all the time, but yanking out security features is a very different issue, and could have much wider impact. It might not, but to simply assume that it's easy seems profoundly ignorant of how software and interdependencies work. Again, the DOJ just pretends it's easy, as if Apple can just check some boxes that say "turn off these features." That's not how it works.

Moreover, contrary to Apple's recent public statement that the assistance ordered by the Court "could be used over and over again, on any number of devices" and that "[t]he government is asking Apple to hack our own users," the Order is tailored for and limited to this particular phone. And the Order will facilitate only the FBI's efforts to search the phone; it does not require Apple to conduct the search or access any content on the phone. Nor is compliance with the Order a threat to other users of Apple products. Apple may maintain custody of the software, destroy it after its purpose under the Order has been served, refuse to disseminate it outside of Apple, and make clear to the world that it does not apply to other devices or users without lawful court orders. As such, compliance with the Order presents no danger for any other phone and is not "the equivalent of a master key, capable of opening hundreds of millions of locks."

We discussed some of this above, but the issue is not the specific code that Apple will be forced to write, but rather the very fact that it will be (contrary to the DOJ's claim) forced to hack their own phones to eliminate key security features, in order to allow the FBI to get around the security of the phone and access encrypted content. If the court can order it for this phone, then yes, it can order it for any iPhone, and that's the key concern. Furthermore, again having Apple tinker with the software can introduce security vulnerabilities -- and already this discussion has revealed a lot about how hackers might now attack the iPhone. I'm all for full disclosure of how systems work, so that's okay. But the real issue is what happens next. If Apple looks to close this "loophole" in how its security works in the next iPhone update, will the court then use the All Writs Act to stop them from doing so? That's the bigger issue here, and one that the DOJ completely pretends doesn't exist.

To the extent that Apple claims that the Order is unreasonably burdensome because it undermines Apple's marketing strategies or because it fears criticism for providing lawful access to the government, these concerns do not establish an undue burden. The principle that "private citizens have a duty to provide assistance to law enforcement officials when it is required is by no means foreign to our traditions."

Again, this is a made up talking point. Protecting user privacy, as they demand it, is not a "marketing strategy." It's a safety and security strategy. You'd think, of all agencies, the FBI would appreciate that.

Anyway, you can go through the entire 35 page filing yourself, but these were the key points, and almost all of them are misleading. It should be interesting to see Apple's response next week.

Filed Under: all writs act, backdoors, doj, encryption, fbi, going dark, hacking, motion to compel, safety, security
Companies: apple