Israeli Exploit Developer Caught Negotiating Spyware Sales With Saudi Government

from the got-'em-right-in-the-optics dept

More ugly news has surfaced about Israeli malware developer NSO Group. Over the past year, investigations have uncovered sales of phone-targeting spyware to countries known mostly for their human rights violations. Even less questionable governments have purchased NSO's software ostensibly for law enforcement purposes only to use it to target activists, journalists, and government critics.

There's no telling how US agencies will deploy this malware, but there's no question federal entities like the DEA think NSO spyware would be a useful addition to their investigative tool kits. The US government doesn't appear to be worried about getting in bed with tech companies willing to sell software to blacklisted countries, so NSO Group is still a viable option.

Haaretz has obtained information showing NSO is willing to sell its exploits to its own enemies. Unfortunately, Haaretz has also decided to paywall its discovery, so we'll be pointing you to the Times of Israel's reporting instead.

An Israeli company that specializes in cyber espionage tools reportedly negotiated a multi-million-dollar deal with Saudi Arabia to sell a technology that allows governments to hack their citizens’ cellphones, and to listen to calls as well as conversations that take place near the phones.

Representatives from the Herzliya-based NSO Group held meetings with Saudi officials in Vienna and, apparently, also in a Gulf State to negotiate a $55 million sale of their Pegasus 3 software, the Haaretz daily reported on Sunday.

These negotiations occurred shortly before Mohammed bin Salman kicked his purge machinery into high gear. Unfortunately, the documents (which surfaced due to a lawsuit filed against NSO by an employee who says the company screwed him on commissions) don't say whether or not the Saudi government chose to purchase this software and/or whether it was used to help MBS hunt down his political opponents.

From what has been seen, NSO tried to play it both ways while negotiating a deal with the Saudis. It refused to identify the person behind an anti-government Twitter account but did offer to demonstrate the effectiveness of tools designed to hijack targets' cellphones.

In response to the recent stream of criticism, NSO Group also tried to have it both ways:

The NSO Group has insisted in the past that it sells its software to clients on the condition that it be used only against crime and terrorism, and has shirked responsibility in cases where it was allegedly used for civil rights abuses.

"We made them promise to only use the tools for good" is a pretty weak defense of sales to countries like Uzbekistan and Kazakhstan. And it certainly doesn't excuse approaching the Saudi government with tools NSO certainly knew would not be used for good. Then again, our president just made it clear no amount of murdered journalists is going to stand in the way of selling weapons to Mohammed bin Salman's government, so there's really no taking the high road in international relations should it be discovered the Saudi government is using Israeli tools to hunt down dissenters… or Israeli natsec personnel.

Filed Under: espionage, exploits, israel, jamal khashoggi, journalists, mohammed bin salman, saudi arabia, spying
Companies: nso group

Popular Spanish Soccer Mobile App Has Been Turning Users Into Piracy-Spotters Via Mobile Devices

from the unwitting-spy-network dept

As readers here will already know, the GDPR is now in full swing in Europe, with all of its crippling and stupid regulation in the name of personal privacy. It's a hilariously overly broad law that has had the happy coincidental effect of forcing companies that store personal data to at least be more upfront about how they are using that data. This effect has caused some to embrace the GDPR as wholly good, which is exactly the wrong conclusion to draw. Instead, the GDPR swings way too far in the direction of users controlling their personal data mostly by reaching way too far and keeping its language as vague and broad as possible, something that is already causing chaos in the digital marketplace.

And, yet, it cannot be ignored that the revelations of just how users' data are being abused by some bad actors keep coming. The latest of these concerns the mobile app for La Liga, Spain's most popular soccer league. La Liga recently revealed, having its hand forced by the GDPR, that users of its mobile app were unwittingly part of La Liga's spy network for uncovering unauthorized broadcasts of soccer matches at public venues.

The La Liga app, which is the official streaming app for Spain’s most popular football league, has reportedly been using the microphones on fans’ phones to root out unauthorized broadcasts of matches in public venues like bars and restaurants.

It sounds exactly like the kind of surveillance people are afraid of when it comes to modern technology, but as is often the case, the La Liga app technically asks users in Spain for permission to access their mics, according to Spanish Website El Diario.

Technically, yes, except that this request is buried in the fine print of an opt-in request the app makes for user permissions that nobody ever reads. One need only review the horror of many users of the app at this news to understand that many (most? all?) of the app's users had absolutely no idea that they were serving a soccer league's attempt at ratting out their favorite watering holes and restaurants. It also appears that this technique has been in place for years, and La Liga only drew recent attention to it due to the GDPR being enacted.

La Liga has pushed back on the concerns of its users and the press coverage, stating that it doesn't retain any of this data locally and that it converts the recordings into pure code, which is something of a non-sequitor. Either the data gathered is useful because it combines GPS data and audio recordings in a way that can pinpoint where a user is and what is on the television screens there... or it isn't. Whatever the technical specifics, the end result is a soccer league peeking in on soccer fans as they watch matches, with most of those fans having no idea that this was occurring at all.

Again, the GDPR is not a solution to this problem. For proof of that, you can note that La Liga says in its statements that everything here is above board. This has far more to do with just how much important privacy-implicating notifications are buried in fine print that goes unread by the masses.

Why anyone would download the La Liga app in the future would be a mystery to me.

Filed Under: copyright, fotball, gdpr, la liga, privacy, spain, spying
Companies: la liga

Navy Officer Working For The NSA Caught Trying To Search Her Boyfriend's Son's Phone

from the self-starter-goes-for-illegal-snooping-right-out-of-the-gate dept

The NSA often makes statements following document leaks about its undying interest in protecting the rights of Americans, no matter how much might be swept up intentionally/incidentally by its surveillance programs. Undoubtedly, there is some sincerity in this statement. But the following story, based on information liberated by a Jason Leopold FOIA request, shows the NSA can be sincere about its desire to protect Americans' privacy while still doing very little to uphold that ideal.

A Navy officer stationed in Iraq “deliberately and without authorization” used an NSA database to try to pry into the mobile phone of her boyfriend’s son, according to a top secret NSA inspector general report obtained by BuzzFeed News.

The NSA discovered the violation about a month after it happened. The officer was undergoing training and had already taken two courses pertaining to the search and use NSA collections. But when this violation occurred, she had been given full access to NSA data stores to complete her final course.

During a training exercise, she entered her boyfriend’s son’s telephone number into a search field and tried to access data covering the span of a month on the prepaid telephone number. That phone was also used by other members of her boyfriend’s family, the report said.

But the officer had an excuse: according to the report [PDF], she said it was the "only telephone number she could think of at the time." The Inspector General found this excuse to be dubious at best.

"She could not explain why this telephone number came to mind instead of her own telephone number or any other number."

Now, here's where we get to the NSA's professed respect for Americans' Fourth Amendment rights. The level of respect will vary from person to person. Obviously, the Navy officer had zero respect for her boyfriend's son's rights. More troubling, her instructor apparently felt this violation wasn't a big deal.

When she entered the phone number, the system displayed a "bright red warning sign." This scared the officer but her instructor's response showed little concern about the violation the officer was attempting to engage in.

[H]er trainer, an Army officer, told her “not to worry” and to just clear out the various search fields on the database.

Neither the Navy officer nor her trainer reported the incident.

The NSA discovered the violation during an audit and reported it. This is good, but it's also limited to what the NSA chooses to report.

The Inspector General has noted in the past it is limited in its oversight abilities by the NSA and its reporting systems. The IG often has trouble compiling the information needed to make a determination about potential violations and there have been times where the NSA has actually destroyed information the IG has needed for investigations.

Much of what we know about the NSA's violations is self-reported. But this relies on the agency being forthcoming -- something it's not particularly known for. The gap between what's discovered and what's handed over by the agency has been noticed by its Congressional oversight and the FISA court. The latter, in particular, has noted the agency often delivers notification of violations months or years after the violations occur and has been routinely unwilling to clarify technical issues when discussing violations with the court.

In this case, the Navy officer claimed the violation was an "accident" that occurred during training. The Inspector General's office, however, viewed it as a deliberate misuse of highly-sensitive data. It appears the NSA sided with the officer. The only "punishment" handed out was another round of training. So, when the NSA claims it's doing everything it can to protect Americans from unlawful surveillance, it's a half-truth at best. If it was doing everything it could, it would have pushed this officer out of the rotation and replaced her with someone more likely to uphold the ideals the NSA claims it holds.

Filed Under: audits, nsa, spying, surveillance

David Boies Accused Of Running Horrifying Spy Operation Against Harvey Weinstein's Accusers

from the and-reporters dept

David Boies is one of the highest profile lawyers in the country. I first became aware of him when he (as outside counsel) represented the Justice Department in the overreaching antitrust case against Microsoft in the 1990s. However, I think most people became aware of him when he represented Al Gore in Bush v. Gore. Since then, nearly every time he's popped up in Techdirt, it's been doing really, really sketchy things. He was the lawyer for SCO in that company's insane "set open source on fire" lawsuit against IBM over Linux. He represented Oracle in its ridiculous lawsuit against Google over whether APIs are covered by copyright*. He represented Sony Pictures after its email was hacked and threatened lots of journalists -- including us! -- for publishing stories based on those leaked emails (we told him "go pound sand.") And, honestly, until earlier this week, I thought the most egregious efforts by Boies had been his connection to Theranos, the disgraced medical devices company, where Boies wasn't just a lawyer for the company, but on the board, and participated in terrible and far-reaching attempts to punish whistleblowers at the company.

But, it turns out that Boies' activity in trying to stifle whistlebowers and reporters regarding Theranos and Sony Pictures were just the warm up act for a truly horrifying bit of business revealed by Ronan Farrow in the New Yorker this week. It was widely reported that Boies was a key player on Harvey Weinstein's legal team, responding to the claims of sexual harassment and assault, but the Farrow article shows just how deep the campaign went, with Boies allegedly orchestrating an "army of spies" to try to trick Weinstein's accusers and reporters working on the story to reveal what they knew. The whole article is incredible, but here's just a snippet, involving one of Weinstein's most outspoken victims, Rose McGowan:

In May, 2017, McGowan received an e-mail from a literary agency introducing her to a woman who identified herself as Diana Filip, the deputy head of sustainable and responsible investments at Reuben Capital Partners, a London-based wealth-management firm. Filip told McGowan that she was launching an initiative to combat discrimination against women in the workplace, and asked McGowan, a vocal women’s-rights advocate, to speak at a gala kickoff event later that year. Filip offered McGowan a fee of sixty thousand dollars. “I understand that we have a lot in common,” Filip wrote to McGowan before their first meeting, in May, at the Peninsula Hotel in Beverly Hills. Filip had a U.K. cell-phone number, and she spoke with what McGowan took to be a German accent. Over the following months, the two women met at least three more times at hotel bars in Los Angeles and New York and other locations. “I took her to the Venice boardwalk and we had ice cream while we strolled,” McGowan told me, adding that Filip was “very kind.” The two talked at length about issues relating to women’s empowerment. Filip also repeatedly told McGowan that she wanted to make a significant investment in McGowan’s production company.

Filip was persistent. In one e-mail, she suggested meeting in Los Angeles and then, when McGowan said she would be in New York, Filip said she could meet there just as easily. She also began pressing McGowan for information. In a conversation in July, McGowan revealed to Filip that she had spoken to me as part of my reporting on Weinstein. A week later, I received an e-mail from Filip asking for a meeting and suggesting that I join her campaign to end professional discrimination against women. “I am very impressed with your work as a male advocate for gender equality, and believe that you would make an invaluable addition to our activities,” she wrote, using her wealth-management firm’s e-mail address. Unsure of who she was, I did not respond.

Filip continued to meet with McGowan. In one meeting in September, Filip was joined by another Black Cube operative, who used the name Paul and claimed to be a colleague at Reuben Capital Partners. The goal, according to two sources with knowledge of the effort, was to pass McGowan to another operative to extract more information. On October 10th, the day The New Yorker published my story about Weinstein, Filip reached out to McGowan in an e-mail. “Hi Love,” she wrote. “How are you feeling? . . . Just wanted to tell you how brave I think you are.” She signed off with an “xx.” Filip e-mailed McGowan as recently as October 23rd.

In fact, “Diana Filip” was an alias for a former officer in the Israeli Defense Forces who originally hailed from Eastern Europe and was working for Black Cube, according to three individuals with knowledge of the situation. When I sent McGowan photos of the Black Cube agent, she recognized her instantly. “Oh my God,” she wrote back. “Reuben Capital. Diana Filip. No fucking way.”

And, yes, apparently it was Boies who signed the contract that made all this possible:

Boies personally signed the contract directing Black Cube to attempt to uncover information that would stop the publication of a Times story about Weinstein’s abuses....

Oh, and the latter part of that sentence is fairly stunning as well:

... while his firm was also representing the Times, including in a libel case.

That seems like a pretty massive conflict of interest, which Boies denied:

Boies confirmed that his firm contracted with and paid two of the agencies and that investigators from one of them sent him reports, which were then passed on to Weinstein. He said that he did not select the firms or direct the investigators’ work. He also denied that the work regarding the Times story represented a conflict of interest.

You know who did think it was a pretty bad conflict of interest? The NY Times. Boy, was the NY Times pissed off:

We learned today that the law firm of Boies Schiller and Flexner secretly worked to stop our reporting on Harvey Weinstein at the same time as the firm's lawyers were representing us in other matters. We consider this intolerable conduct, a grave betrayal of trust, and a breach of the basic professional standards that all lawyers are required to observe. It is inexcusable and we will be pursuing appropriate remedies.

And, by Tuesday night the Times had fired Boies:

Like other large firms, the Boies firm asked us to waive certain conflicts in advance. We understood that to mean that it could openly bring actions that may be adverse to our interests and we would be free to terminate our relationship with the firm if we felt the new representation posed a serious conflict. We never contemplated that the law firm would contract with an intelligence firm to conduct a secret spying operation aimed at our reporting and our reporters. Such an operation is reprehensible, and the Boies firm must have known that its existence would have been material in our decision whether to continue using the firm. Whatever legalistic arguments and justifications can be made, we should have been treated better by a firm that we trusted.

Boies is now trying to salvage his reputation by apologizing:

“I regret having done this. It was a mistake to contract with, and pay on behalf of a client, investigators who we did not select and did not control. I would never knowingly participate in an effort to intimidate or silence women or anyone else, including the conduct described in the New Yorker article. That is not who I am.”

Let's be clear though: this is absolute bullshit by David Boies. It is who he is. Again, he's threatened plenty of media properties in the past -- including us -- with bogus threats attempting to stifle a free press and to intimidate reporters into not covering his big name clients. He did it with Theranos. He did it with Sony Pictures. And it certainly appears that he did much more than that for Harvey Weinstein under significantly more shocking circumstances.

So isn't it about time that people took Boies down off the pedestal he's been on for many years? He may be famous, but he's been doing horrible things for the rich and powerful, often attacking and threatening a free press for years. Hiring spies for Harvey Weinstein is just the latest -- and perhaps most horrific -- example.

* Boies "representation" of Oracle in that case resulted in what remains a truly classic benchslap from Judge William Alsup for Boies making downright silly claims about programming.

JUDGE ALSUP: All right. I have -- I was not good -- I couldn't have told you the first thing about Java before this trial. But, I have done and still do a lot of programming myself in other languages. I have written blocks of code like rangeCheck a hundred times or more. I could do it. You could do it. It is so simple. The idea that somebody copied that in order to get to market faster, when it would be just as fast to write it out, it was an accident that that thing got in there. There was no way that you could say that that was speeding them along to the marketplace. That is not a good argument.

MR. BOIES: Your Honor --

JUDGE ALSUP: You're one of the best lawyers in America. How can you even make that argument? You know, maybe the answer is because you are so good it sounds legit. But it is not legit. That is not a good argument.

MR. BOIES: Your Honor, let me approach it this way, first, okay. I want to come back to rangeCheck. All right.

JUDGE ALSUP: RangeCheck. All it does is it makes sure that the numbers you're inputting are within a range. And if they're not, they give it some kind of exceptional treatment. It is so -- that witness, when he said a high school student would do this, is absolutely right.

MR. BOIES: He didn't say a high school student would do it in an hour, all right.

JUDGE ALSUP: Less than -- in five minutes, Mr. Boies.

MR. BOIES: Well, Your Honor --

JUDGE ALSUP: If you know the language. Once you know the language, it is a five-minute proposition.

And, on an additional note, if you haven't yet, you should read Sarah Jeong's absolutely delightful profile of Judge Alsup and his coding hobby.

Filed Under: david boies, free press, harvey weinstein, intimidating the press, reporters, spying, squelching stories
Companies: black cube, ny times

IOT Devices Provide Comcast A Wonderful New Opportunity To Spy On You

from the monitor-and-monetize-ALL-the-things! dept

For some time now we've noted how poorly secured IOT devices provide a myriad of opportunities for hackers looking for new attack vectors into homes and businesses. That's of course when these devices aren't just coughing up your personal data voluntarily. Whether it's your smart fridge leaking your Gmail credentials or your internet-connected TV transmitting your personal conversations over the internet unencrypted, we've noted time and time again how IOT manufacturers consistently make privacy and security an afterthought -- one that's going to ultimately cost us more than some minor inconvenience.

But in addition to the internet of broken things being a privacy and security dumpster fire, these devices are providing a wonderful new opportunity for larger ISPs looking to monetize the data you feed into their networks on a daily basis. A new study out of Princeton recently constructed a fake home, filled it with real IOT devices, and then monitored just how much additional data an ISP could collect on you based in these devices' network traffic. Their findings? It's relatively trivial for ISPs to build even deeper behavior profiles on you based on everything from your internet-connected baby monitor to your not so smart vibrator.

We've long noted that while encryption and VPNs are wonderful tools for privacy, they're not some kind of panacea -- and the researchers found the same thing here:

"...encryption doesn’t stop ISPs from knowing which internet-of-things devices their users have, nor does it stop them seeing when we use those devices. In the Princeton study, ISPs could track a user’s sleep patterns by detecting when a sleep tracker was connecting to the internet. It also revealed that ISPs could identify when a home security camera detected movement and when someone was watching a live stream from their security camera."

Similar concerns have been raised (and promptly ignored in most areas) regarding information collected from smart energy meters by your power utility, since power usage can similarly provide all manner of monetizeable insight into your daily behavior. The researchers do note that more sophisticated users could use a VPN to confuse their ISP, but the full study indicates there will be some impact on network performance that could be a problem on slower connections:

"The authors say there might be ways to cut down the snooping abilities of ISPs. One possible defence involves deliberately filling a network with small amounts of traffic. This could be done by running all your internet traffic through a VPN and then programming the VPN to record and play back that traffic even when the IOT device is not in use, making it tricky for ISPs to work out when a particular device is actually being used. However, this would probably slow down the network, making it a somewhat impractical defence against network observations."

Aren't you glad Congress recently voted to kill consumer broadband privacy protections solely for the financial benefit of Comcast, AT&T, Verizon and Charter (Spectrum)? Those fairly basic rules required that ISPs be entirely transparent about what data they're collecting and who they're selling it to. The rules, proposed after Verizon was caught modifying user data packets to track online behavior (without telling anyone), also would have required customers opt in to more sensitive financial data collection. Without them, oversight of ISP data collection is sketchy at best, no matter what large ISPs and their friends claim.

While the lack of ISP transparency as to what's being collected and sold is one problem, so too is the fact that most of these devices offer little to no insight or control over what kind of data and information they're transmitting. That leaves the onus entirely on the consumer to try and cobble together an imperfect array of technical solutions to minimize ISP snooping and protect themselves (often impossible for your average grandparent or Luddite), or to take the smarter path in the smart home era and resort to older, dumber technologies whenever and wherever possible.

Filed Under: encryption, iot, privacy, security, smart devices, spying, surveillance
Companies: comcast

Vizio Fined $2.2 Million For Not Telling Customers Their TVs Were Spying On Them

from the I-always-feel-like-somebody's-watching-me dept

Security isn't the only thing being ignored as hardware vendors rush to connect televisions, toasters, and tea kettles to the internet. Consumer privacy and data-collection transparency has also become a distant afterthought as companies rush to cash in on the ocean of data these connected-devices collect. The "smart" television sector has been notably problematic, with Samsung busted a few years back for not only recording customer living room conversations, but transmitting that data unencrypted back to the company mothership.

These are lessons that hardware vendors appear incapable or unwilling to learn. Case in point: this week the FTC announced that it had struck a $1.2 million settlement with discount TV vendor Vizio. According to the full FTC complaint (pdf), Vizio began using the company's smart televisions to track user behavior in 2014, without informing customers that this was happening. The FTC notes that Vizio for years heavily advertised a "Smart Interactivity" feature that "enables program offers and suggestions." But the complaint notes this feature never provided customers with a single suggestion.

But it did provide Vizio with a wonderful new way to collect and store a huge variety of consumer data under the pretense of adding consumer functionality. MAC addresses, IP addresses, nearby WiFi network names, metadata were all hoovered up and stored. And when the FTC says viewing data, it means that Vizio used pixel analysis to compile personal data on every program and device connected to the Vizio set:

"According to the agencies’ complaint, starting in February 2014, VIZIO, Inc. and an affiliated company have manufactured VIZIO smart TVs that capture second-by-second information about video displayed on the smart TV, including video from consumer cable, broadband, set-top box, DVD, over-the-air broadcasts, and streaming devices.

In addition, VIZIO facilitated appending specific demographic information to the viewing data, such as sex, age, income, marital status, household size, education level, home ownership, and household value, the agencies allege. VIZIO sold this information to third parties, who used it for various purposes, including targeting advertising to consumers across devices, according to the complaint."

Again, this in and of itself isn't that controversial, especially in the age of location data and cell phones. The fact that Vizio chose not to tell anyone this data was being collected is where the company ran afoul of the FTC. An FTC blog post has a little more detail on just how specific this data was, and to whom it was sold:

"And let’s be clear: We’re not talking about summary information about national viewing trends. According to the complaint, Vizio got personal. The company provided consumers’ IP addresses to data aggregators, who then matched the address with an individual consumer or household. Vizio’s contracts with third parties prohibited the re-identification of consumers and households by name, but allowed a host of other personal details – for example, sex, age, income, marital status, household size, education, and home ownership. And Vizio permitted these companies to track and target its consumers across devices."

It's here that we'll remind you that the "anonymization" of data doesn't mean much. Time and time again, studies have shown that anonymized data sets aren't really anonymous, given that it only takes a few additional contextual clues (the likes of which companies that collect this sort of data already have) to ferret out personal identities.

It's not really clear how many settlements of this type it's going to take before "smart" hardware vendors acknowledge that being transparent with consumers (which frankly is neither onerous or particularly difficult for them in the 400-page EULA era) is important. And should we continue to weaken FCC and FTC privacy oversight of ISPs and hardware vendors (as is strongly implied by both agencies), that's less likely than ever to happen anytime soon.

Filed Under: ftc, smart tv, spying
Companies: vizio

Documents Show Chicago PD Secretly Using Forfeiture Funds To Buy Surveillance Equipment

from the no-accountability,-no-oversight dept

The Chicago Reader has put together a massive, must-read investigation into the Chicago Police Department's secret budget. The Chicago PD has -- for years now -- used the spoils of its asset forfeiture program to obtain surveillance equipment like Stingrays. This discretionary spending is done off the city's books, allowing the CPD to avoid anything that might prevent it from acquiring surveillance tech -- like meddling city legislators… or the public itself.

Since 2009, the year CPD began keeping electronic records of its forfeiture accounts, the department has brought in nearly $72 million in cash and assets through civil forfeiture, keeping nearly $47 million for itself and sending on almost $18 million to the Cook County state's attorney's office and almost $7.2 million to the Illinois State Police, according to our analysis of CPD records.

The Chicago Police Department doesn't disclose its forfeiture income or expenditures to the public, and doesn't account for it in its official budget. Instead, CPD's Bureau of Organized Crime, the division tasked with drug- and gang-related investigations, oversees the forfeiture fund in what amounts to a secret budget—an off-the-books stream of income used to supplement the bureau's public budget.

The Reader found that CPD uses civil forfeiture funds to finance many of the day-to-day operations of its narcotics unit and to secretly purchase controversial surveillance equipment without public scrutiny or City Council oversight.

It sounds like a lot of money -- $72 million in civil forfeiture funds -- and it is. But it's not like this money comes from a few large busts that have seriously affected the city's drug trade. That may be the rationale for the PD's convictionless seizing of property and cash (just like "terrorism" is often cited when acquiring surveillance tech ultimately destined for plain vanilla law enforcement use). But in reality, the forfeiture's rarely do anything more than financially cripple a large number of individuals who have little to anything to do with drug trafficking. The Chicago Reader reports that the median seizure in Illinois is only $530 -- hardly an amount one associates with criminal empires. In fact, the normal cash seizure probably sounds more like the following than a breathtaking dismantling of a local drug-running crew.

Ellie Mae Swansey, a 72-year-old retiree living on a fixed income, had her 2001 PT Cruiser seized two years ago when Chicago police arrested her son for drug manufacturing. The costs of simply beginning the long, circuitous, extremely-frustrating battle to reclaim her vehicle were prohibitive.

In order to have a chance at getting their property returned, claimants must put down a bond toward their asset when first submitting the official paperwork. This means that Swansey had to pay $140 (10 percent of her car's value) just to start the process. Then, to appear in court, she had to pay an additional $177 fee.

To Swansey, who lives on a $655-per-month social security check, these costs are substantial. Successful claimants will have 90 percent of their bond returned; unsuccessful claimants get nothing back.

The extensive investigation, compiled from dozens of FOIA request (more on than in a bit), notes that 90% of the seized funds spent by the CPD went to expected, above-board expenses: vehicles, cellphones, etc. But the rest of it went other places, obscured by redactions and withheld documents. Payments to cellphone forensics companies like CellBrite were uncovered, as were purchases of a license plate reader installed near the CPD's infamous Homan Square detention center black site, and $417,000-worth of cell tower spoofers.

The Chicago PD will continue to roll over retirees like Swansey because the laws governing forfeiture in Illinois have completely corrupted the incentives. It's not about law enforcement or crime prevention. It's about autonomy, power, and a steady flow of spendable cash.

When a government agency is allowed to handle the forfeiture proceeds it brings in—as is the case with both CPD and the Cook County state's attorney's office—it controls both "the sword and the purse," like an army that is also its own taxing authority. This is according to Lee McGrath, legislative counsel for the Institute for Justice, which seeks to reform civil asset forfeiture laws across the country.

And for what? What has been the end result of this massive amount of supposedly drug-focused seizures and spending?

[T]he prices of many drugs have decreased and purity has increased since the [drug] war began.

The second part of this story is just as interesting. It details how the Chicago Reader managed to get its hands on this stash of documents. It began with a FOIA request for Stingray documents from the Chicago PD. In between the redactions, the PD accidentally gave up its quasi-"black budget" account numbers.

On October 13, 2014, Christopher Kennedy, from CPD's Gang Investigations Division, wrote to Nicholas Roti, then chief of the department's Bureau of Organized Crime:

"Because this equipment will be used for [REDACTED] investigations in to [sic] [word missing] [I] recommend that it be paid for with both 1505 and 1505ML funds in equal amounts," he wrote.

Several requests later, Lucy Parson Lab (government transparency activists) and the Chicago Reader confirmed that these accounts were tied to asset forfeiture. Moving on from there, however, required some outside assistance. The Reader was going to be asking for a lot of documents and it would have been easy for the Chicago PD to deny such a request from a single entity as "unduly burdensome."

But several public records requesters, each using their own name? Not as easy.

To get over this hurdle, Lucy Parsons Labs launched a collaboration with MuckRock, a FOIA and transparency website, asking ordinary users to send FOIA requests on our behalf.

Lucy Parsons Labs drafted a sample FOIA request for users to download and submit. We also managed the responses from CPD—MuckRock's platform automatically followed up with CPD when the department was late responding to a request. Once checks came back from CPD, Lucy Parsons members collected the data in a centralized location and classified each purchase as being either part of routine police activities or as part of broader surveillance efforts. Eleven of our 13 community requesters used the MuckRock FOIA platform to submit and manage their requests.

This is how you beat a system predisposed to telling you "no." A "burdensome" request split 20 ways is no longer a burden. Sure, the Chicago PD might have experienced a bit more of a crunch fulfilling these, but it couldn't use the law to deny releasing documents it almost certainly would have preferred to keep under wraps.

Filed Under: asset forfeiture, chicago, chicago police department, illinois, spying, surveillance

Yes, Police Are Snooping Through Criminal Databases For Personal Reasons All The Time

from the as-long-as-zero-fucks-are-given,-nothing-will-change dept

The more journalists and other FOIA enthusiasts gain access to public records, the more we discover that a combination of access and power tends to result in abuse. Even as this abuse goes unaddressed, law enforcement agencies are striving to add more personal information to their databases, extending far past the usual "name/last known location" to encompass a vast array of biometric data.

Privacy watchdogs have been fighting against these for good reason: very little is known about the contents of these databases or the controls put in place to protect the info from inappropriate access. What is known is that these databases are misused by law enforcement officers routinely. What's also been discovered is that this routine misuse is rarely ever punished to the extent the law allows. Warnings about possible jail time are meaningless when the usual punishment usually ranges from nothing at all to short suspensions.

The Associated Press has obtained another pile of documents from public records request that show little has changed. Abuse of access is still a common occurrence, as is the lack of meaningful consequences. There's no almost no oversight and no federal law enforcement body holding agencies accountable for misuse of databases under their control.

No single agency tracks how often the abuse happens nationwide, and record-keeping inconsistencies make it impossible to know how many violations occur.

But the AP, through records requests to state agencies and big-city police departments, found law enforcement officers and employees who misused databases were fired, suspended or resigned more than 325 times between 2013 and 2015. They received reprimands, counseling or lesser discipline in more than 250 instances, the review found.

Unspecified discipline was imposed in more than 90 instances reviewed by AP. In many other cases, it wasn't clear from the records if punishment was given at all. The number of violations was surely far higher since records provided were spotty at best, and many cases go unnoticed.

What was uncovered from the incomplete set of records is the expected behavior. Give someone access to a wealth of other people's personal information and it will be used for personal reasons. Law enforcement officers have misused the databases to stalk and harass exes, look up women they find attractive, and to search for something to discredit journalists and other critics.

Violations frequently arise from romantic pursuits or domestic entanglements, including when a Denver officer became acquainted with a hospital employee during a sex-assault investigation, then searched out her phone number and called her at home. A Mancos, Colorado, marshal asked co-workers to run license plate checks for every white pickup truck they saw because his girlfriend was seeing a man who drove a white pickup, an investigative report shows.

In Florida, a Polk County sheriff's deputy investigating a battery complaint ran driver's license information of a woman he met and then messaged her unsolicited through Facebook.

Officers have sought information for purely personal purposes, including criminal records checks of co-workers at private businesses. A Phoenix officer ran searches on a neighbor during the course of a longstanding dispute. A North Olmsted, Ohio, officer pleaded guilty this year to searching for a female friend's landlord and showing up in the middle of the night to demand the return of money he said was owed her.

Most abuse of law enforcement databases goes undiscovered. The systems generally have no way to tell appropriate use from inappropriate use. Officials who did agree to speak on the record noted that the usual indication of misuse tends to be complaints filed by those targeted by the illegal searches. And that generally only happens when officers perform other illegal or abusive actions, like the previously-mentioned stalking and harassment.

Any attempt to quantify these illegal searches is likely fruitless for the time being. The police haven't shown much interest in policing themselves, and the DOJ has never floated the idea of collecting data on database misuse. Violations are not required to be reported to the FBI. That agency performs spot checks of database requests, but uses a small sampling and the audits are far from comprehensive. Even when records do exist, law enforcement agencies are reluctant to release them. Several records requests by the AP were denied.

On top of that, laws covering access to law enforcement databases vary from locality to locality, and even at the federal level, the issue of illegal vs. inappropriate still hasn't been conclusively determined. The DOJ often displays tremendous enthusiasm when wielding the CFAA against citizens for "unauthorized access," but seems far less willing to do so when law enforcement officers use criminal databases for personal reasons.

It's almost impossible to deter inappropriate behavior when nearly everyone involved takes a hands off approach to the issue. Trying nothing obviously isn't working. And the more that's harvested by the government under the auspices of law enforcement, the more data there is available to be abused.

This is just another item in a long list of law enforcement abuses that has gone unaddressed for decades now -- either internally or by the federal government. Trust is something that's earned. Trust shouldn't just be handed over, and that level should deteriorate as abuse is exposed, rather than remain unchanged. But that's not what has happened over the years. Instead, law enforcement agencies benefit from a perpetual benefit of a doubt. The end result is obvious: agencies and their employees have no problem abusing trust because they've expended no effort in "earning" it.

Filed Under: abuse, databases, law enforcement, police, privacy, spying

Court Says Man Can Sue Maker Of Web-Monitoring Software For Wiretap Act Violations

from the webwatching-your-way-to-an-easier-divorce! dept

The Sixth Circuit Court of Appeals has decided a man whose communications were snagged by commercial spyware can sue the software's maker for violating federal wiretap law.

The plaintiff, Javier Luis, became involved in an online relationship with an unhappily married woman. Her husband, Joseph Zang, installed Awareness Technologies' "WebWatcher" on his wife's computer in order to keep tabs on her online communications. After discovering his communications had been intercepted, Luis sued the software's maker (along with the husband, who has already settled with Luis and is no longer listed as a defendant).

The Appeals Court doesn't form an opinion on the strength of Luis's claims -- only noting that they're strong enough to survive dismissal. Awareness Software will be able to more fully address the allegations in the lower court on remand, but for now, the Appeals Court finds [PDF] the software's "contemporaneous interception" of electronic communications to be a potential violation of the Wiretap Act.

Two allegations in the complaint support this inference. First, Luis alleges that the communications at issue “were not originally stored on the computer’s hard drive.” The communications were instead acquired by Awareness “as [they were] being written and communicated between senders and recipients.” This allegation directly supports the proposition that the communications were still “in flight” for the purposes of 18 U.S.C. § 2511.

[...]

Second, Luis alleges that “WebWatcher immediately and instantaneously rout[e]s the intercepted communications to their [i.e., Awareness’s] servers located in California.” (Emphasis in original.) This allegation directly supports an inference of contemporaneous interception because, if WebWatcher does in fact “immediately and instantaneously” copy and send communications “as [they are] being written,” then the acquisition of the communications likely occurs before the communications have come to rest in electronic storage.

Somewhat illogically, Awareness suggested that the supporting evidence provided by Luis could have referred to a different product (not made by Awareness) that has an identical name.

Awareness is of course correct that some possibility exists that the marketing materials might refer to another device carrying the trademark “WebWatcher” that is unaffiliated with Awareness’s own WebWatcher. This argument, however, is far-fetched at best, and the more “plausible inference,” see id. at 682, is that the materials do in fact apply to Awareness’s WebWatcher that Joseph allegedly used.

Slightly more logically, it suggested that it cannot be held liable under the Wiretap Act because it's the end user that actually violates the Act when they install the software and put it to use. This is what the lower court found in its decision, based on a Report and Recommendation (R & R) put together by a magistrate judge.

With respect to the claimed violation of 18 U.S.C. § 2511, the R&R concluded that Awareness itself did not “intercept” Luis’s communications because it was Joseph [Zang]—not Awareness—that installed the WebWatcher program on the computer used by Catherine. And with respect to the claimed violation of 18 U.S.C. § 2512, the R&R concluded that Awareness could not be held liable simply for manufacturing a product that others—such as Joseph—used to violate the Wiretap Act.

Awareness also argued that WebWatcher's interception of communications wasn't "contemporaneous" and therefore isn't a violation of the Wiretap Act. Instead, it claimed it grabbed communications in "near real-time" and stored a copy on its servers for access by users. The Appeals Court notes that Awareness's own promotional efforts seem to tell a different story.

The marketing materials attached to Luis’s complaint support this conclusion. As Luis notes, the materials state that WebWatcher lets its users review a person’s electronic communications “in near real-time, even while the person is still using the computer.” The materials further note that any deviation from real-time monitoring results not from delays regarding when the communications are acquired, but from variations in “the Internet connection speed of the computer being monitored.”

This near real-time monitoring is significant. If a WebWatcher user can in fact review another person’s communications in near real time, then WebWatcher must be acquiring the communications and transferring them to Awareness’s servers as soon as the communications are sent. The program, in other words, does not wait for the communications to be stored; instead, the program as described captures and reroutes the communications so that a WebWatcher user can review the communications at nearly the same time as they are being transmitted.

In addition, the marketing materials state that “[e]ven if a document is never even saved, WebWatcher still records it.” This feature indicates that WebWatcher does not wait for electronic communications to be saved in a computer’s electronic storage. Rather, the product records the communications as they are being sent, without regard for whether a copy is ever placed in the storage of the affected computer. This aspect of WebWacher’s operations thus implies that the alleged acquisition of Luis’s communications indeed occurred while the communications were still “in flight.”

The court also notes that Awareness's own marketing materials suggest there are few wholly-legal uses for its WebWatcher software. Given its function, most end user deployment is almost certain to violate federal or state wiretap laws. (This explains the following disclaimer on the WebWatcher site: "Awareness Technologies Terms of Use and End User Licensing Agreement require that you only install its software on computers that you own or have permission to monitor and that you inform all users of those computers that they are being monitored.") Because of this, the court finds that Awareness cannot dodge civil liability simply because it performs no interception of communications until a purchaser installs and deploys its software.

[W]e today hold that a defendant such as Awareness—which allegedly violates § 2512(1)(b) by manufacturing, marketing, and selling a violative device—is subject to a private suit under § 2520 only when that defendant also plays an active role in the use of the relevant device to intercept, disclose, or intentionally use a plaintiff’s electronic communications.

So even though Awareness itself did not initiate the specific action that “intercepted, disclosed, or intentionally used” Luis’s communications in violation of the Wiretap Act, it is alleged to have actively manufactured, marketed, sold, and operated the device that was used to do so. This is enough to establish that Awareness was “engaged in” a violation of the Wiretap Act in a way that defendants such as those in Treworgy and Amato—who simply possessed wiretapping devices—were not.

The dissenting opinion, however, points out that allowing the plaintiff to pursue Awareness under the Wiretap Act not only shifts some responsibility off the shoulders of the person who initiated the interception (the aggrieved husband) but also more than "liberally construes" the content of Javier Luis's pro se filing.

The majority accepts Luis’s argument on appeal that the complaint directly implicates Awareness in paragraph 77. But this reading is much more than just charitable—it grasps at straws. In describing how WebWatcher operates, Paragraph 77 uses only a possessive pronoun that lacks any antecedent: “WebWatcher immediately and instantaneously routs the intercepted communications to their servers located in California to be stored for their subscribers to later retrieve at their leisure.” Awareness is neither named nor the subject of the action. This paragraph, located amidst Luis’s allegations against the other defendants, does not give rise to the plausible inference that Awareness intentionally intercepted Luis’s communications.

[...]

It does not put Awareness on notice that it—the manufacturer and seller— could be liable for anonymous customer Joseph Zang’s misuse of the WebWatcher. Luis’s novel theory of liability does not appear even to have been tried, much less to have been successful, in any previous case. Neither Awareness nor the district court should have been expected to divine it from Luis’s allegations against the other defendants. I would affirm the district court’s dismissal of Luis’s § 2511 claim against Awareness. I would affirm the dismissal of Luis’s state-law claims for the same reason.

That's the downside of this reversal by the Appeals Court: manufacturers and developers will now face an increased risk of civil litigation if their products could possibly be used to violate laws. This negative side effect is diminished somewhat by Awareness's participation in the interception -- the storage of communications on its servers -- but it's still the sort of thing that could encourage speculative litigation aimed at the target with the deepest pockets, rather than the entity that actually broke the law.

Filed Under: javier luis, joseph zang, spying, web monitoring, webwatcher, wiretap, wiretap act
Companies: awareness technologies, webwatcher