Senators Press Wireless Carriers On Streaming Video Throttling

from the ill-communication dept

Three U.S. Senators are pressuring wireless carriers for answers after recent studies showed they routinely throttle video services -- not to protect the network from congestion -- but to simply make an extra buck.

One of the core goals of net neutrality was to prevent ISPs from imposing arbitrary restrictions on the network just to harm competitors or boost revenues. Of course lax enforcement and now dismantled rules have made that hard to stop. As a result, ISPs like Comcast routinely impose completely arbitrary and unnecessary usage caps, then exempt their own content from those limits, but punishing users if they step outside the Comcast walled garden. Wireless carriers have similarly throttled music, games and videos, then begun charging users more money if they want those services to operate as the creators intended.

Even with net neutrality rules intact, the FCC didn't really do a good job understanding how these arbitrary restrictions (like usage caps and zero rating) could prove anti-competitive. And in the year or two since things have only gotten worse, with wireless carriers like Verizon throttling all video on its network unless you pay the company for an even more expensive plan. The perils of this should be obvious--especially for Americans who already pay some of the highest prices for mobile data in the developed world.

Historically, ISPs have tried to claim they only throttle video when it causes network congestion, with net neutrality generally allowing such network management. But recent studies out of Northeastern have shown that this throttling has nothing to do with managing network congestion, and everything to do with erecting artificial barriers consumers then have to pay more to overcome. David Choffnes, whose data for these studies is being collected via his WeHe app, also recently found that Sprint has been throttling Skype (a potential competitor to Sprint's own services).

Last week, Senators Edward Markey, Richard Blumenthal, and Ron Wyden sent joint letters to AT&T, Verizon, and T-Mobile, demanding answers as to why they throttle, which services they throttle, and whether they clearly inform users of the throttling (in Sprint's Skype instance, they didn't).

"We write to express our concern that mobile carriers may be inappropriately throttling and prioritizing internet traffic from common mobile apps without the knowledge of their customers. All online traffic should be treated equally, and internet service providers should not discriminate against particular content or applications for competitive advantage purposes or otherwise."

So far the FCC and major carriers haven't wanted to much talk about Choffnes or Northeastern's findings. Choffnes recently informed me in an interview that his goal is to bring some crowd-sourced transparency to network performance in the wake of the repeal of net neutrality. He was quick to highlight the inherent problem with letting ISPs non-transparently hamstring companies they're actively trying to compete with (Netflix vs. AT&T, for example):

"In a neutral network, all of these services can compete on a level playing field to offer a product that attracts the most users,” he said. “When an Internet provider targets a service for throttling, the playing field can tilt in favor of one service over another.”

“This is particularly problematic if the Internet provider's service is favored, because they can use this advantage to drive users away from competing products and to ones belong to the Internet provider,” Choffnes added. “And because the competition is limited by the Internet service they are given, in some cases there may nothing they can do to regain equal footing."

While the major carriers have until December 6 to answer, it's unlikely carriers will face much in the way of repercussions during FCC boss Ajit Pai's watch. Pai was not only happy to kill net neutrality and gut FCC authority at telecom lobbyist request, the net neutrality repeal replaced hard rules on transparency with entirely voluntary guidelines that ISPs can ignore at their leisure with absolutely no meaningful repercussions.

Keep in mind, that ISPs are currently trying their best to behave ahead of next February's court showdown over net neutrality (which could restore the 2015 rules). Should they win that fight, the kind of nickel-and-diming they engage in will progressively be less and less subtle.

Filed Under: broadband, fcc, net neutrality, senate, streaming, wireless
Companies: at&t, comcast, t-mobile, verizon

Ron Wyden Wants Federal Government To Do More To Protect Personal Devices/Accounts Used By Senators And Staffers

from the small-fix-with-bigger-potential-repercussions dept

Ron Wyden is writing letters again. This time he wants to know why the federal government isn't protecting the personal devices and email accounts used by federal officials. Attacks by state-sponsored hackers are never going to go away, and Wyden feels this lack of protection will make personal devices easy targets. From Wyden's letter [PDF] to Senate majority leaders:

Press reports from January of this year indicate that Fancy Bear--the notorious Russian hacking group--targeted senior congressional staff in 2015 and 2016. My office has since discovered that Fancy Bear targeted personal email accounts, not official government accounts. And the Fancy Bear attacks may be the tip of a much larger iceberg. My office has also discovered that at least one major technology company has informed a number of Senators and Senate staff members that their personal email accounts were targeted by foreign government hackers.

Given the significance of this threat, I was alarmed to learn that SAA cybersecurity personnel apparently refused to help Senators and Senate staff after these attacks The SAA informed each Senator and staff member who asked for help that it may not offer cybersecurity assistance for personal accounts. The SAA confirmed to my office that it believes it may only use appropriated funds to protect official government devices and accounts.

This seems a little odd, but there's a good reason the SAA doesn't extend coverage to personal devices. As Pwn All The Things pointed out on Twitter, personal devices can be used for personal things, and we don't want our elected officials using tax dollars for personal reasons.

This is a good example of a rule constructed for laudable reasons -- the strong firewall to stop legislators using govt money for campaigning and personal things is there for a reason -- ending up with bad consequences on edge-cases like defending high-value accounts from hackers

To protect against hacking attempts, Wyden is introducing legislation that would eliminate the SAA silos. The bill would allow the SAA to "provide cybersecurity assistance" for personal devices on an opt-in basis. We'll have to see how this plays out when implemented. It may make it more difficult to discern if any federal funds were misused by Senators or their staff.

On the other hand, it will help secure devices some government employees mistakenly believe aren't prime targets for state-sponsored hacking. It takes a certain amount of obtuseness to reach this conclusion, considering how heavily some government officials rely on their personal devices for communications with other government officials. The old FOIA dodge is still a popular one, and the difficulty of separating official work from personal work -- especially during election years -- likely means personal devices are used far more frequently than their government-issued ones.

While it's good the government as a whole is continually working towards more robust security, the fact is the private sector offers plenty of options for government officials to better secure their personal devices. Personal responsibility is still underutilized at the federal level, which makes them no better (or worse) than much of the general public.

Filed Under: congress, cybersecurity, federal government, nation state attackers, ron wyden, senate

'Oversight' Hearing Fails Utterly To Hold FCC Accountable For Lying To Congress About Fake DDOS Attack

from the ill-communication dept

FCC "oversight" hearings continue to be comically lacking in the actual oversight department. As we noted previously, today was Congress' opportunity to hold the FCC and agency head Ajit Pai accountable for making up a DDOS attack and then lying (repeatedly) about it to the press, FBI investigators, and Congress. As we've previously stated, both e-mails obtained via FOIA and an FCC Inspector General report (pdf) found that the FCC bizarrely made up a DDOS attack to try and explain away the fact that John Oliver viewers pissed about the net neutrality repeal crashed the FCC comment system.

The IG's report and internal e-mails clearly illustrate that not only did FCC CIO make up a DDOS, but several FCC staffers then misled Congress repeatedly about the total lack of evidence supporting that claim. The false statements were bad enough to warrant them being forwarded to the DOJ, which refused to prosecute anyone. But the e-mails also highlight how the FCC's press office repeatedly misled numerous press outlets, and even went so far as to issue statements denigrating reporters like Gizmodo's Dell Cameron for being "irresponsible" as they slowly uncovered the fake claims.

In a functional democracy, this is the sort of thing that would be covered extensively at a hearing purportedly designed specifically to hold the FCC accountable to Congress and the public. In said fictional healthy democracy, Congress might even, you know, actually do something about it.

But today's hearing was little more than a joke, rife with lots of giggling, football references, and numerous softball questions -- but few if any hard inquiries about the DDOS attack that wasn't. The closest thing Pai experienced to actually being pressured came from Senator Brian Schatz. But when pressed as to what he knew and when, Pai again threw his employees under the bus, denying that he had any knowledge of or role in the FCC's efforts to mislead Congress and public. The exchange is here for those interested:

In the exchange, Pai said he suspected there was no foul play from the beginning and that the "DDOS" was just the John Oliver effect. When pressed as to why Pai didn't do more to correct the false claims earlier, Pai said he "wanted you to get this information sooner" but remained quiet at the behest of the FCC IG (which has yet to respond to press inquiry). "I made the judgment that we had to adhere to the [IG's] request," claimed Pai, "even though I knew we would be falsely attacked for having done something inappropriate,” Pai said. “The story in this report vindicated my position."

Except the IG's report doesn't vindicate Pai's position, and somebody at the hearing should have pointed that out. In fact, the IG's report shows that it wasn't just the FCC CIO that had been making false DDOS claims for the better part of the last year. There's ample evidence, had anybody on the oversight committee actually wanted to press the issue, that numerous FCC employees repeatedly and intentionally doubled down on claims Pai now claims he knew weren't true.

For example, the IG report found that at least three staffers provided false statements to not only Congress, but also to FBI investigators trying to determine the scope of the alleged attack. And throughout the inquiry Pai's press shop issued statements attacking press outlets for being "irresponsible" simply for reporting the fact there was no evidence or "analysis" to support the FCC's allegation:

"The FCC has never stated that it lacks any documentation of this DDoS attack itself," the agency states. "And news reports claiming that the Commission has said this are without any basis and completely irresponsible. In fact, we have voluminous documentation of this attack in the form of logs collected by our commercial cloud partners."

But none of that was true. There was no DDOS attack and there was no evidence, "voluminous" or otherwise. Again, there's every indication that the FCC doubled down on the fake DDOS claim because it wanted to downplay media reports showing that millions of Americans were pissed about the death of net neutrality (it wasn't public outrage, we were attacked!). It's the same reason why the FCC refused to do anything about the bogus comments that plagued the repeal's net neutrality comment period: it wanted to push the Trumpian narrative that the massive public anger over the attack net neutrality wasn't real.

The fact that Pai's press shop was actively spreading false statements and maligning reporters makes it pretty obvious that Pai actively participated in or was at least aware of the FCC's head fake. But at no point during the "oversight" hearing was this avenue of inquiry pursued. Instead, users who tuned in for a reckoning got to enjoy Ted Cruz once again misrepresenting what net neutrality was, and gushing missives from telecom-sector allies like Senator John Thune on Pai's (artificial) love and adoration of neglected rural broadband markets.

Aside from the fake DDOS attack, the hearing was yet another missed opportunity to seriously hold the FCC to account on a number of issues, including making up data and ignoring the public in the rush to repeal net neutrality, gutting funding for rural broadband, eroding consumer privacy protections, killing efforts to improve cable box competition, propping up predatory prison telco monopolies and every other little anti-consumer, pet project Ajit Pai has embraced as leader of the agency. But instead of "oversight," users that tuned in this morning got something that looked much more like a bipartisan game of patty cake.

Filed Under: ajit pai, brian shatz, david bray, ddos, fcc, john oliver, lies, oversight, senate, ted cruz

Election Security Has Become A Partisan Issue As Senate Votes Down Funding

from the bad-ideas dept

It shouldn't matter which party you belong to (or if you belong to no party at all): fixing our totally broken election security should be a priority. This is a topic we've written about on Techdirt for nearly 20 years. The broken system of electronic voting has always been a security disaster, and now with more direct attempts to influence elections happening, it should be even more of a priority. And yet, following the lead in the House, this week the Senate voted down an amendment from Senator Patrick Leahy providing more funding for election security.

The vote was almost exactly along partisan lines, with only one crossover (Senator Bob Corker was the only Republican who voted for the amendment). While there were some arguments made against the bill, they don't make much sense:

Sen. Blunt said that states are responsible for running their elections, not the federal government, and that providing more funds would give the impression of federal overreach.
Sen. Lankford said on the floor Wednesday, referencing the omnibus funds, “the $380 million amount is what was needed for the moment," and indicated he didn't want to fund states beyond that right now.

There can be reasonable questions in how this money is being spent, and what's being done to actually secure elections, but the fact that this seems to be becoming a partisan issue should worry us all. And, I know some of you will be tempted to do this, but claiming that Republicans are against this because insecure technology helps them get elected is not a serious response. That's not only cynical, but almost certainly incorrect.

However, at a time when Congress (including many of the Senators who voted against this) have been grandstanding about tech companies being used to influence elections, the fact that they would then not really care that much about our woefully undersecured voting infrastructure just seems ridiculous. For years, we've argued that when tech policy issues get partisan, they get stupid, and it would be a real shame for election security, of all topics, to become stupidly partisan.

Filed Under: election security, funding, partisanship, patrick leahy, senate

Senators Ask FCC Why It Did Nothing To Stop Their Names From Being Fraudulently Used During Net Neutrality Repeal

from the fake-plastic-trees dept

Last year you'll recall that somebody abused the nonexistent privacy protections at the FCC website to flood the net neutrality repeal proceeding with millions of fake comments. While the vast majority of real people oppose the repeal, a bad actor was able to either fraudulently use the identities of real people (like myself), or hijack the identities of dead people to spam the proceeding with bogus support. The goal: undermine public trust in the public comment period in order to downplay the massive opposition to the FCC's handout to AT&T and Comcast.

Up to this point, the FCC has done less than nothing to investigate the fraud or prevent it from happening again, largely because it aided the FCC's agenda. In fact, the FCC went so far as to block a law enforcement investigation into who was behind the fraud.

Hoping to pull the scandal back onto a front burner, Senators Jeff Merkley and Pat Toomey this week sent a letter to the FCC stating that they've discovered that their names were also used to post fake comments during the repeal. The two demanded the FCC implement some kind of CAPTCHA system to help police automated bogus comments (a bot seems to have posted millions of bogus comments in alphabetical order), and asked what the agency was doing to prevent the problem from occurring again:

"Late last year, the identities of as many as two million Americans were stolen and used to file fake comments during the Federal Communications Commission’s (FCC’s) comment period for the net neutrality rule,” the Senators wrote in a letter to Pai. “We were among those whose identities were misused to express viewpoints we do not hold. We are writing to express our concerns about these fake comments and the need to identify and address fraudulent behavior in the rulemaking process."

The FCC has been hammered for months over this scandal and has responded with the policy and regulatory equivalent of a shrug. I was told by the agency that there was nothing that could be done after my own identity was fraudulently used to support the repeal. So far, there's been absolutely no repercussions for the FCC or its staffers, though a GAO investigation is currently ongoing. It's worth noting that this kind of behavior isn't exclusive to the FCC, with other Trump regulatory actions also being hammered with bogus support via bot over the last year.

Filed Under: ajit pai, comments, fake names, fcc, jeff merkley, net neutrality, pat toomey, senate

Senate IT Tells Staffers They're On Their Own When It Comes To Personal Devices And State-Sponsored Hackers

from the not-the-best-way-to-handle-an-impossible-situation dept

Notification of state-sponsored hacking attempts has revealed another weak spot in the US government's defenses. The security of the government's systems is an ongoing concern, but the Senate has revealed it's not doing much to ensure sensitive documents and communications don't end up in the hands of foreign hackers.

The news of the hacking attempt was greeted with assurances that nothing of value was taken.

That gap in security was brought front and center for Senate IT staffers on Jan. 12, when cybersecurity firm Trend Micro announced findings that seven months earlier, the same Russian government hacking group responsible for hacking Democratic Party targets in 2016 had created a phishing campaign that specifically targeted Senate staffers’ emails.

There’s no indication that the attempts were successful, and Trend Micro immediately alerted the FBI and the Office of the Sergeant at Arms, the agency responsible for Senate security, the firm said. Hours after Trend Micro’s report, multiple Senate staffers told BuzzFeed News, the sergeant-at-arms called a private meeting of Senate IT personnel to assure them that there was no real threat, as it had blocked the avenues the hackers would have tried to use.

It blocked those avenues, but Senate IT left a lot of avenues wide open. According to the Buzzfeed report, those in this meeting were told the protections offered would not include personal devices or email accounts. This makes some sense, as personnel have a responsibility to ensure their devices/accounts are as secure as possible if they're going to be using them for government work.

Laws and policies have been put in place to deter people from taking their sensitive work home with them. But they address a problem government agencies often exacerbate by treating employees as always on duty, even where they're off the clock. Multiple top government officials have been caught storing sensitive documents on private devices or in private accounts. Hillary Clinton underwent an FBI investigation because of this. Two years ago, a teenage hacker got a hold of documents detailing US military operations by gaining access to the CIA director's AOL account.

So, drawing a line at personal devices seems like the right thing to do, but only if you ignore the attack vectors left open by this policy. Even banning personal devices from government offices has its problems -- going far beyond the fact that this policy is pretty much unenforceable when there are thousands of staffers to keep an eye on.

Reached for comment, a sergeant-at-arms representative declined to give a formal statement, but told BuzzFeed News that its cybersecurity team’s specific directive is to protect Senate email accounts and Senate-issued devices.

But that could be a problem if a Senate staff member – there are thousands – uses a Senate device to also access personal email. If the staffer downloads a malicious program from personal email on a Senate-issued computer, that program could gain access to the device.

So… I don't know… throw the CFAA at them? [I'm joking, DOJ. Please don't do this.] There's no great solution to this problem. You can push the responsibility back on the person who became the attack vector but that just leaves sensitive government systems as weak as the weakest person with access. And employees should rightfully be wary of government attempts to "secure" devices and accounts, which could lead to lots of snooping into non-government communications.

It's impossible to secure everything but Senate IT shouldn't be so quick to wall off personal devices and accounts. Ignoring attack vectors doesn't solve the problem. Consistent enforcement of policies governing the handling of sensitive documents and communications might reduce the chances of a breach. But the problem remains the government's to deal with. As a former White House staffer notes in the article, the tools government employees need to do their jobs effectively aren't all supplied by the government. Many are supplied by third parties and may only run (or run well) on personal devices. The government can't be expected to be all things to all employees, but maybe it should consider extending its protective services to the devices and accounts it unofficially expects staffers to use.

Filed Under: encryption, hackers, it, privacy, security, senate, surveillance