New GCHQ Boss Blames Tech Industry For 'Facilitating Murder' And Being Terrorists' 'Command-And-Control' Center

from the say-what-now? dept

So, we weren't too impressed with previous GCHQ (the UK equivalent of the NSA) boss, Sir Iain Lobban, who insisted that GCHQ didn't do "mass surveillance" so long as you defined "mass" and "surveillance" the way he does (and not the way the English language does). This statement was made just days before it was revealed that the GCHQ (contrary to its own claims) gets access to NSA data without a warrant.

New GCHQ boss Robert Hannigan has taken to the potentially pay-walled pages of the Financial Times to convince the world that he's a complete nutjob in charge of one of the most powerful spy agencies in the world. His message: basically "terrorists use technology, and because you hate terrorists, we should all be happy to have tech companies share all your private data with us to catch terrorists." Or something like that. Hannigan honestly seems to believe that the public is really on the government's side against the tech companies they use every day. That seems like rather large miscalculation of his audience.

Hannigan's pitch relies on (of course) spreading as much FUD as possible, starting with ISIS:

Terrorists have long made use of the internet. But Isis’s approach is different in two important areas. Where al-Qaeda and its affiliates saw the internet as a place to disseminate material anonymously or meet in “dark spaces”, Isis has embraced the web as a noisy channel in which to promote itself, intimidate people, and radicalise new recruits.

The extremists of Isis use messaging and social media services such as Twitter, Facebook and WhatsApp, and a language their peers understand. The videos they post of themselves attacking towns, firing weapons or detonating explosives have a self-conscious online gaming quality. Their use of the World Cup and Ebola hashtags to insert the Isis message into a wider news feed, and their ability to send 40,000 tweets a day during the advance on Mosul without triggering spam controls, illustrates their ease with new media. There is no need for today’s would-be jihadis to seek out restricted websites with secret passwords: they can follow other young people posting their adventures in Syria as they would anywhere else.

Got it? Terrorists use the same services you and I do, and they're really, really mean. So, why is the public so upset that GCHQ wants to snoop on what everyone's doing on those services? For bonus points, he also tosses in some child porn fears as well.

GCHQ and its sister agencies, MI5 and the Secret Intelligence Service, cannot tackle these challenges at scale without greater support from the private sector, including the largest US technology companies which dominate the web. I understand why they have an uneasy relationship with governments. They aspire to be neutral conduits of data and to sit outside or above politics. But increasingly their services not only host the material of violent extremism or child exploitation, but are the routes for the facilitation of crime and terrorism. However much they may dislike it, they have become the command-and-control networks of choice for terrorists and criminals, who find their services as transformational as the rest of us. If they are to meet this challenge, it means coming up with better arrangements for facilitating lawful investigation by security and law enforcement agencies than we have now.

Then, finally, he blames the tech companies for not recognizing that by spying on everyone, GCHQ is just trying to protect the free and open society we all love, and assumes that the public is really on his side:

To those of us who have to tackle the depressing end of human behaviour on the internet, it can seem that some technology companies are in denial about its misuse. I suspect most ordinary users of the internet are ahead of them: they have strong views on the ethics of companies, whether on taxation, child protection or privacy; they do not want the media platforms they use with their friends and families to facilitate murder or child abuse. They know the internet grew out of the values of western democracy, not vice versa. I think those customers would be comfortable with a better, more sustainable relationship between the agencies and the technology companies.

There are lots of things that facilitate murder and child abuse that plenty of people are still fine using. I drive a car. Cars kill lots of people. I use a camera. Cameras are often key to child porn. Phones are frequently used in crimes. Yet, I'm not so ridiculous as to blame any of these tools for the scummy people who use them for bad purposes. And it bothers me that the head of the UK's technology spying effort doesn't seem to understand that distinction. Actually, it doesn't just bother me, it frightens me.

As we celebrate the 25th anniversary of the spectacular creation that is the world wide web, we need a new deal between democratic governments and the technology companies in the area of protecting our citizens. It should be a deal rooted in the democratic values we share. That means addressing some uncomfortable truths. Better to do it now than in the aftermath of greater violence.

Note what Hannigan left out: what's wrong with the existing deal? What's wrong with making a specific case for why you need specific information to a court and then getting a warrant? Why do we need a "new deal" that involves giving a government increasingly broad access to all that data -- especially when the very same intelligence community that has that data has a rather long history of abusing it, violating human rights, stifling free speech and criticism and harassing those who oppose it?

In a companion article, the Financial Times notes that, with US tech companies hardening their networks against the intelligence community, the UK has been locked out from the easy access it used to have, which explains some of Hannigan's exasperation. I'm sure it must suck when you used to be able to sift broadly through a variety of private information without everyone realizing it. And having that treasure trove of private data ripped away must not be much fun. But privacy is, in fact, a democratic ideal, contrary to Hannigan's belief that the public is willing to give it up just to stave off some bad guys thousands of miles away. Besides, as the article notes, when the UK government demands access, where should US companies draw the line:

One senior executive at a US tech group said any agreement to circumvent the current process, which requires law-enforcement groups to seek a court order before a company hands over data, would be “eliminating due process and that could be a dangerous situation”.

“What should we do if the Saudi or Russian government also demanded information be handed over on the spot?” he said.

It seems that the intelligence community and the surveillance state has gotten somewhat fat and lazy in the last few years, with so much access to so much data. Back in the old days, they had other ways to get what they needed without violating everyone else's privacy. It's time they learned how to get back to that sort of system that fits much better with our basic ideals of democracy and freedom than this desire to have access to absolutely everything does.

Filed Under: gchq, iain lobban, privacy, robert hannigan, surveillance, tech companies

Tech Companies Increasingly Telling Users When Law Enforcement Comes Asking For Data

from the good-for-them dept

In the past, we've noted that Twitter, alone among major tech companies, had made it a corporate policy to not just roll over when law enforcement came asking for user data, even alerting users that law enforcement was seeking their data, and giving them the chance to try to block the requests. Apparently, now a bunch of other big tech companies have started doing the same thing:

Google already routinely notified users of government data requests but adopted an updated policy this week detailing the few situations in which notification is withheld, such as when there is imminent risk of physical harm to a potential crime victim. “We notify users about legal demands when appropriate, unless prohibited by law or court order,” the company said in a statement.

Lawyers at Apple, Facebook and Microsoft are working on their own revisions, company officials said, although the details have not been released. All are moving toward more routinely notifying users, said the companies, which had not previously disclosed these changes.

“Later this month, Apple will update its policies so that in most cases when law enforcement requests personal information about a customer, the customer will receive a notification from Apple,” company spokeswoman Kristin Huguet said.

If you're looking for who to thank about this turn of events, there are two places to point. First: the good folks at EFF. For the past few years, it's been publishing its Who Has Your Back? chart looking at how companies respond to government requests for data. Each year, this list has convinced more and more companies to improve how they protect their users, and how they push back on government requests. And, the reason why so many companies are rushing to change their policies is because the EFF is about to release its latest version. Yet another reason to be happy the EFF exists.

Second, of course, is Ed Snowden. While not entirely directly at issue here -- since things like FISA Court Orders and National Security Letters are subject to gag orders barring companies from telling their users -- the generally heightened interest in government access to information provided to internet services has certainly created a culture where these companies can't get away with just rolling over for the government any more.

Of course, you could argue that it's taken these companies too long to get here -- and that's absolutely true -- but better late than never.

Oh yeah. Guess who's really upset about all of this:

The Justice Department disagrees, saying in a statement that new industry policies threaten investigations and put potential crime victims in greater peril.

“These risks of endangering life, risking destruction of evidence, or allowing suspects to flee or intimidate witnesses are not merely hypothetical, but unfortunately routine,” department spokesman Peter Carr said, citing a case in which early disclosure put at risk a cooperative witness in a case. He declined to offer details because the case was under seal.

Once again, it seems like the DOJ and others think that anything that makes their job harder is somehow wrong. But that's incorrect. The whole point of protecting freedom is that it's supposed to be hard for law enforcement to spy on people and arrest them. That's how it's supposed to work.

Filed Under: doj, law enforcement, privacy, protecting users, subpoenas, tech companies, warrants
Companies: apple, eff, facebook, google, microsoft, twitter, yahoo

Big Tech Companies Agree To Pay Up Over Hiring Collusion

from the as-they-should dept

Last month, we pointed out that Google, Apple, Adobe and Intel would almost certainly settle, rather than face an ongoing lawsuit concerning their collusive hiring practices, in which they promised not to poach employees from one another in an effort to keep employees longer and (more importantly for them) to keep salaries down. That has now come to pass, with the four companies agreeing to pay out $324 million to settle the charges. This is good. As we noted in our original story, the hiring collusion was shameful and, worse, antithetical to the kind of job shifting and idea sharing that helped make Silicon Valley into Silicon Valley.

For many years, I've given a series of talks (often to foreign executives and government officials) about why Silicon Valley turned into Silicon Valley. Everyone assumes it's the obvious stuff about lots of venture capital or access to good colleges. And so they try to mimic that, back where they came from. But as you dig down into the Silicon Valley story, you quickly realize that, while those things helped, the true secret sauce is the easy job mobility here, with people constantly shifting jobs -- and sharing ideas across many different companies. What comes out of that is more innovation and the important big breakthroughs that have made this entire industry possible. A few top execs, led by Steve Jobs, tried to throw sand in those wheels, stupidly believing that it was more important to protect poaching of their own employees, ignoring how that also limited their own ability to cross-fertilize ideas and bring in top performers from other companies.

The history of Silicon Valley is littered with stories of job hopping, employment diasporas and the like. Look at how many successful companies that were formed in the past decade have some connection to PayPal, for example. Easy job mobility is a key factor in Silicon Valley to allow innovation to happen, and hopefully this ugly incident puts the issue behind the tech industry, and they can go back to actually innovating.

Filed Under: collusion, hiring, poaching, tech companies
Companies: adobe, apple, google, intel

Most Big Internet Companies Speak Out For Major Surveillance Reform

from the about-time dept

Since the Snowden leaks began we've highlighted that the US internet companies should be furious about the NSA's actions, because it was almost certainly going to harm their ability to get any business outside of the US. Some of the companies seemed to be lying low, and we argued they should be speaking out and fighting back. While many of them did decide to sue for greater transparency, we argued that transparency was just one issue, and not even the most important one. About a month ago, with the revelations of the NSA infiltrating data centers, it appeared to finally dawn on the major internet companies that this was a serious issue.

Basically all of the largest internet companies -- with the exception of Amazon (and Apple, if you consider them an internet company) have now launched a website demanding major reforms for government surveillance. Facebook, Yahoo, Twitter, Microsoft, Google, LinkedIn and AOL have all joined in this effort, with a bunch of specific requests:

1. Limiting Governments' Authority to Collect Users' Information
2. Increase Oversight and Accountability (such as by making FISA an adversarial process)
3. Transparency About Government Demands
4. Respecting the Free Flow of Information
5. Avoiding Conflicts Among Governments

With the website, they've also sent a specific open letter to the government highlighting why this is important, focusing on the rights of individuals and the ability to keep their information private.

We understand that governments have a duty to protect their citizens. But this summer’s revelations highlighted the urgent need to reform government surveillance practices worldwide. The balance in many countries has tipped too far in favor of the state and away from the rights of the individual — rights that are enshrined in our Constitution. This undermines the freedoms we all cherish. It’s time for a change.

For our part, we are focused on keeping users’ data secure — deploying the latest encryption technology to prevent unauthorized surveillance on our networks and by pushing back on government requests to ensure that they are legal and reasonable in scope.

We urge the US to take the lead and make reforms that ensure that government surveillance efforts are clearly restricted by law, proportionate to the risks, transparent and subject to independent oversight.

Some will, undoubtedly, argue that this is all just noise for the sake of public perception, but compare what these companies are doing to the major telco companies, which not only have refused to comment on all of this, but have actively fought efforts by their own shareholders to make them just slightly more transparent (up to the level many internet companies were even before the Snowden leaks).

The question, now, is how much effort these companies will really put into getting Congress to change the laws. There are a number of different bills in Congress. Having the tech companies assist the efforts for real reform would certainly be helpful.

Filed Under: internet, nsa, reform, surveillance, tech companies
Companies: aol, facebook, google, linkedin, microsoft, twitter

It's Finally Dawning On Tech Companies That All This NSA Stuff Is Bad For Them

from the more-of-that-please dept

We've been arguing since the beginning of the Snowden leaks, that the tech industry should be much angrier than it is about all of this, because the fallout and blowback from this is going to impact these companies quite a bit. To date, the big tech companies have been fighting back, but it's mostly focused on the transparency issue, arguing in court that the gag orders barring them from talking about what the government has legally compelled them to do, is a violation of their First Amendment rights. And that's correct and an important fight, but we've been disappointed that the tech companies haven't supported even greater reforms and changes, including greater privacy protections. But that might be changing.

Obviously, the news of the NSA infiltrating private network links between data centers should make these companies even angrier. It appears that Google is getting there, though Yahoo still doesn't seem to realize what just happened.

However, in an interesting move that at least hints at potential further realization from the tech industry that they need to support user privacy rights, the big guys -- Google, Facebook, Apple, Microsoft, Yahoo and AOL -- have all sent a letter to Congress in support of the USA Freedom Act. In it, they once again talk up the importance of greater transparency. But, also, for the first time that I can remember, they appear to be arguing for even more:

Transparency is a critical first step to an informed public debate, but it is clear that more needs to be done. Our companies believe that government surveillance practices should also be reformed to include substantial enhancements to privacy protections and appropriate oversight and accountability mechanisms for those programs.

And, even with the letter being sent today, it was almost certainly written and approved before yesterday's revelations -- meaning that this was before they realized the NSA was trying (and succeeding) to backdoor into their networks without their knowledge. Hopefully they'll start pushing for even more significant reforms as well. Some have argued that the tech industry has been complicit in the NSA surveillance efforts, while others have suggested they were compelled, or even tricked/hacked into it. The evidence suggests a combination of all of those factors (in varying degrees across the different companies). But if they want to actually regain the trust of their users, they should stand up for the rights of their users and support the efforts to create real change and to stop illegal surveillance, rather than just increasing transparency.

Filed Under: civil liberties, nsa, nsa surveillance, reform, tech companies, usa freedom act
Companies: aol, apple, facebook, google, microsoft, yahoo

Feds Trying To Get Master Encryption Keys From Tech Companies

from the of-course-they-are dept

This is hardly surprising, but Declan McCullagh is reporting that the feds have been trying to get various tech companies to hand over their master encryption keys so that the NSA and FBI can decrypt any of the messages they scoop up. So far the tech companies have been resisting:

"The government is definitely demanding SSL keys from providers," said one person who has responded to government attempts to obtain encryption keys. The source spoke with CNET on condition of anonymity.

The person said that large Internet companies have resisted the requests on the grounds that they go beyond what the law permits, but voiced concern that smaller companies without well-staffed legal departments might be less willing to put up a fight. "I believe the government is beating up on the little guys," the person said. "The government's view is that anything we can think of, we can compel you to do."

It's unclear from the article if any companies have given in and provided the keys, but it sounds like at least most of the big ones are fighting it. Microsoft and Google both directly denied that they would hand over such a master key. Lots of other companies didn't respond to Declan's questions. Of course, it's no surprise that the government would ask. They've been asking for access and backdoors to just about everything.

If they can't convince the companies that this is legal and required, you can fully expect that a law will be proposed shortly which will more or less require companies to hand over such keys.

"The requests are coming because the Internet is very rapidly changing to an encrypted model," a former Justice Department official said. "SSL has really impacted the capability of U.S. law enforcement. They're now going to the ultimate application layer provider."

Once again, perhaps it's time to think about moving away from a situation in which all our "cloud" data is stored in a few centralized spots. You can still get the benefits of a cloud, even if you control the data yourself -- if only companies would open up and allow users to point their services at data stored elsewhere.

Filed Under: doj, encryption, fbi, master keys, nsa, privacy, surveillance, tech companies

If 'Just Metadata' Isn't An Issue, Why Can't Tech Companies Reveal 'Just Metadata' About NSA Surveillance?

from the simple-questions dept

You may have heard the news today that a bunch of big tech companies -- including Google, Facebook, Microsoft, Apple, Twitter, Mozilla, Reddit, Tumblr and others -- have sent a strong letter to a variety of government officials, both in the administration and Congress, demanding greater transparency, and the ability to reveal more information about the government's various surveillance programs that compel the tech companies to participate:

We the undersigned are writing to urge greater transparency around national security-related requests by the US government to Internet, telephone, and web-based service providers for information about their users and subscribers.

First, the US government should ensure that those companies who are entrusted with the privacy and security of their users’ data are allowed to regularly report statistics reflecting:

• The number of government requests for information about their users made under specific legal authorities such as Section 215 of the USA PATRIOT Act, Section 702 of the FISA Amendments Act, the various National Security Letter (NSL) statutes, and others;
• The number of individuals, accounts, or devices for which information was requested under each authority; and
• The number of requests under each authority that sought communications content, basic subscriber information, and/or other information.

Second, the government should also augment the annual reporting that is already required by statute by issuing its own regular “transparency report” providing the same information: the total number of requests under specific authorities for specific types of data, and the number of individuals affected by each.

As an initial step, we request that the Department of Justice, on behalf of the relevant executive branch agencies, agree that Internet, telephone, and web-based service providers may publish specific numbers regarding government requests authorized under specific national security authorities, including the Foreign Intelligence Surveillance Act (FISA) and the NSL statutes. We further urge Congress to pass legislation requiring comprehensive transparency reporting by the federal government and clearly allowing for transparency reporting by companies without requiring companies to first seek permission from the government or the FISA Court.

This follows on a somewhat somewhat similar letter from Reps. Jim Sensenbrenner and Zoe Lofgren to Attorney General Holder and Director of National Intelligence Clapper, urging them "to authorize U.S. companies to release information regarding national security requests for user data."

Both letters point out that they're just looking for the ability to reveal specific numbers about orders received and user accounts impacted, but obviously not further information that might reveal the details of any investigations. Basically, they're asking for "just the metadata."

You may have spotted the irony, pointed out by Ashkan Soltani: Defenders of many of the government's surveillance programs have repeatedly trotted out the "just metadata" argument for why all of this surveillance is no problem, claiming that mere metadata doesn't reveal anything important. Yet, when it comes to their own metadata about their own surveillance programs, suddenly it will reveal all their secrets? (And I won't even get into the fact that only some of the surveillance programs are "just metadata").

So, which is it, feds? Is "just metadata" nothing too important, or does it reveal everything?

Filed Under: jim sensenbrenner, metadata, national security letters, nsa surveillance, surveillance, tech companies, zoe lofgren
Companies: apple, facebook, google, microsoft, mozilla, reddit, tumblr, twitter, yahoo

NSA Boss Asks Congress For Blanket Immunity For Companies That Help NSA Spy On Everyone

from the but-of-course dept

This will come as no surprise to anyone, but NSA boss General Keith Alexander is pestering Congress for a new law which would provide blanket immunity for companies helping the NSA collect data on everyone.

Gen. Keith Alexander has petitioned Capitol Hill for months to give Internet service providers and other firms new cover from lawsuits when they rely on government data to thwart emerging cyberthreats.

Basically, he's arguing that if the NSA orders companies to do something illegal, the companies shouldn't be liable for that. There's some logic behind that, because when you get an order from the government, you often feel compelled to obey. But, of course, the reality is that this will give blanket cover for companies voluntarily violating all sorts of privacy laws in giving the NSA data. And, theoretically you could then sue the government over those violations, but we've seen in the past how well that goes over. First, the courts won't give you "standing" if you can't prove absolutely that your data was included. Then, if you get past that hurdle, the government will claim "national security" or sovereign immunity to try to get out of the case. And, even if it gets past all of that, and you win against the government, the feds shrug their shoulders and say "now what are you going to do?"

And, of course, rather than narrowly target this immunity, it appears that Alexander would like it as broad as possible.

One former White House aide told POLITICO that Alexander has been asking members of Congress for some time to adopt bill language on countermeasures that’s “as ill-defined as possible” — with the goal of giving the Pentagon great flexibility in taking action alongside Internet providers. Telecom companies, the former aide said, also have been asking Alexander for those very legal protections.

Given the revelations of the past few weeks, this seems like the exact wrong direction for Congress to be heading. We should want companies to push back against overaggressive demands from the government for information. Giving them blanket immunity would be a huge mistake and only enable greater privacy violations.

Filed Under: blanket immunity, immunity, keith alexander, nsa, nsa surveillance, spying, tech companies

Washington Post Quietly Backtrcks On Claim That Tech Companies Knowingly Gave NSA Data, As Denials Get Stronger

from the hmmm dept

The Next Web is noting that the Washington Post has quietly backtracked on its original claim that tech companies "participated knowingly" in the PRISM spying program. And, at the same time, some of the denials appear to be getting stronger. Google's CEO, Larry Page, posted a blog post with the interesting title, What the ...?:

First, we have not joined any program that would give the U.S. government—or any other government—direct access to our servers. Indeed, the U.S. government does not have direct access or a “back door” to the information stored in our data centers. We had not heard of a program called PRISM until yesterday.

Second, we provide user data to governments only in accordance with the law. Our legal team reviews each and every request, and frequently pushes back when requests are overly broad or don’t follow the correct process. Press reports that suggest that Google is providing open-ended access to our users’ data are false, period. Until this week’s reports, we had never heard of the broad type of order that Verizon received—an order that appears to have required them to hand over millions of users’ call records. We were very surprised to learn that such broad orders exist. Any suggestion that Google is disclosing information about our users’ Internet activity on such a scale is completely false.

Mark Zuckberberg has now posted a similar denial to Facebook:

Facebook is not and has never been part of any program to give the US or any other government direct access to our servers. We have never received a blanket request or court order from any government agency asking for information or metadata in bulk, like the one Verizon reportedly received. And if we did, we would fight it aggressively. We hadn't even heard of PRISM before yesterday.

When governments ask Facebook for data, we review each request carefully to make sure they always follow the correct processes and all applicable laws, and then only provide the information if is required by law. We will continue fighting aggressively to keep your information safe and secure.

Some have pointed out that these claims can still be read carefully to mean that other forms of data access potentially did happen, though some of the direct claims are pretty strong. It's also noteworthy that Page and Zuckerberg seem to mimic each other's word usage. Furthermore, it does seem odd that the President more or less confirmed the existence of the program, which all these tech companies are denying. Does that mean that something else is going on? Is the NSA doing this without letting the companies know? It's certainly unclear at this point, but it's going to come out eventually.

Filed Under: knowingly, larry page, mark zuckerberg, prism, surveillance, tech companies
Companies: facebook, google

Tech Companies Deny Letting NSA Have Realtime Access To Their Servers, But Choose Their Words Carefully

from the worth-watching dept

We've already talked about James Clapper, the Director of National Intelligence choosing weasel words to pretend they're saying that they weren't spying on Americans when they really were, and now some are arguing that the tech companies are doing the same exact thing. All of the tech companies listed have been denying their involvement, but again, the words are being chosen carefully, and there's a reasonable argument that they're denying certain specific claims while really side-stepping the bigger issue.

Comparing denials from tech companies, a clear pattern emerges: Apple denied ever hearing of the program and notes they “do not provide any government agency with direct access to our servers and any agency requesting customer data must get a court order;” Facebook claimed they “do not provide any government organisation with direct access to Facebook servers;” Google said it “does not have a ‘back door’ for the government to access private user data”; And Yahoo said they “do not provide the government with direct access to our servers, systems, or network.” Most also note that they only release user information as the law compels them to.

But the PRISM program’s reported access to data and the now repeatedly confirmed widespread access to phone records and other types of digital data appears to be almost exactly what the 2008 Protect America Act (PAA) allows Foreign Intelligence Surveillance Act (FISA) courts to compel tech companies to do — as many warned around the time of its passage. If tech companies are not providing direct access to their servers but are cooperating with the PRISM program, that leaves at least one other option: Companies are providing intelligence agencies with copies of their data.

Note the fine distinction. Giving the NSA a clone of their data wouldn't be giving them "access to our servers." It would be giving copies to the NSA... and then the NSA could "access" its own servers. And you were wondering why the NSA needed so much space in Utah. If they're basically running a replica of every major big tech company datacenter, it suddenly makes a bit more sense. Of course, at this point there's no evidence that this is necessarily the case -- and some are insisting that the denials are legit, and that the Washington Post's story is not entirely accurate. But... the wording here is extra careful, and the government's report really does seem to indicate that these companies are deeply involved.

By the way, if you'd like to dig in on annotating the various tech companies' denials, someone put them all up at RapGenius, the site for annotating text (not just rap songs).

Filed Under: nsa, surveillance, tech companies
Companies: aol, apple, google, microsoft, skype, yahoo