Some Thoughts On What, Exactly, The DOJ's 'Inaccurate Assertion' Might Be Concerning Secret Legal Opinion

from the some-informed-speculation dept

Earlier today we posted a story about Senator Ron Wyden's letter to Attorney General Loretta Lynch, in which he asks (yet again) for the DOJ to disclose a secret 2003 legal opinion, and also notes that it appears the DOJ lied to the court in a FOIA lawsuit by the ACLU, as the DOJ seeks to block an attempt to force it to release that document. In our post, we pointed to an excellent post by Marcy Wheeler exploring some of the possible "misrepresentations" that the DOJ may have made in its filing -- however, her site, EmptyWheel.net is getting hit today with some sort of attack and the story is down. As we both agree that this is an important story that needs to be seen, at Marcy's request, we're reposting her story here.

I've written a bunch of times about an OLC memo Ron Wyden keeps pointing to, suggesting it should be declassified so we all can know what outrageous claims DOJ made about common commercial service agreements. Here's my most complete summary from Caroline Krass' confirmation process:

Ron Wyden raised a problematic OLC opinion he has mentioned in unclassified settings at least twice in the last year (he also wrote a letter to Eric Holder about it in summer 2012): once in a letter to John Brennan, where he described it as "an opinion that interprets common commercial service agreements [that] has direct relevance to ongoing congressional debates regarding cybersecurity legislation." And then again in Questions for the Record in September.

Having been ignored by Eric Holder for at least a year and a half (probably closer to 3 years) on this front and apparently concerned about the memo as we continue to discuss legislation that pertains to cybersecurity, he used Krass' confirmation hearing to get more details on why DOJ won't withdraw the memo and what it would take to be withdrawn.

Wyden: The other matter I want to ask you about dealt with this matter of the OLC opinion, and we talked about this in the office as well. This is a particularly opinion in the Office of Legal Counsel I've been concerned about — I think the reasoning is inconsistent with the public's understanding of the law and as I indicated I believe it needs to be withdrawn. As we talked about, you were familiar with it. And my first question — as I indicated I would ask — as a senior government attorney, would you rely on the legal reasoning contained in this opinion?

Krass: Senator, at your request I did review that opinion from 2003, and based on the age of the opinion and the fact that it addressed at the time what it described as an issue of first impression, as well as the evolving technology that that opinion was discussing, as well as the evolution of case law, I would not rely on that opinion if I were–

Wyden: I appreciate that, and again your candor is helpful, because we talked about this. So that's encouraging. But I want to make sure nobody else ever relies on that particular opinion and I'm concerned that a different attorney could take a different view and argue that the opinion is still legally valid because it's not been withdrawn. Now, we have tried to get Attorney General Holder to withdraw it, and I'm trying to figure out — he has not answered our letters — who at the Justice Department has the authority to withdraw the opinion. Do you currently have the authority to withdraw the opinion?

Krass: No I do not currently have that authority.

Wyden: Okay. Who does, at the Justice Department?

Krass: Well, for an OLC opinion to be withdrawn, on OLC's own initiative or on the initiative of the Attorney General would be extremely unusual. That happens only in extraordinary circumstances. Normally what happens is if there is an opinion which has been given to a particular agency for example, if that agency would like OLC to reconsider the opinion or if another component of the executive branch who has been affected by the advice would like OLC to reconsider the opinion they will come to OLC and say, look, this is why we think you were wrong and why we believe the opinion should be corrected. And they will be doing that when they have a practical need for the opinion because of particular operational activities that they would like to conduct. I have been thinking about your question because I understand your serious concerns about this opinion, and one approach that seems possible to me is that you could ask for an assurance from the relevant elements of the Intelligence Community that they would not rely on the opinion. I can give you my assurance that if I were confirmed I would not rely on the opinion at the CIA.

Wyden: I appreciate that and you were very straightforward in saying that. What concerns me is unless the opinion is withdrawn, at some point somebody else might be tempted to reach the opposite conclusion. So, again, I appreciate the way you've handled a sensitive matter and I'm going to continue to prosecute the case for getting this opinion withdrawn.

The big piece of news here — from Krass, not Wyden — is that the opinion dates to 2003, which dates it to the transition period bridging Jay Bybee/John Yoo and Jack Goldsmith's tenure at OLC, and also the period when the Bush Administration was running its illegal wiretap program under a series of dodgy OLC opinions. She also notes that it was a memo on first impression — something there was purportedly no law or prior opinion on — on new technology.

Back in November, ACLU sued to get that memo. The government recently moved for summary judgment based on the claim that a judge in DC rejected another ACLU effort to FOIA the document, which is a referral to ACLU's 2006 FOIA lawsuit for documents underlying what was then called the "Terrorist Surveillance Program" and which we now know as Stellar Wind. Here's the key passage of that argument.

The judgment in EPIC precludes the ACLU's claim here. First, EPIC was an adjudication on the merits that involved the district court's reviewing in camera the same document that is at issue in this litigation, and granting summary judgment to the government after finding that the government had properly asserted Exemptions One, Three, and Five – the same exemptions asserted here – to withhold the document. See Colborn Decl. ¶ 13; EPIC, 2014 WL 1279280, at *1. Second, the ACLU was a plaintiff in EPIC. Id. Finally, the claims asserted in this action were, or could have been, asserted in EPIC. The FOIA claim at issue in EPIC arose from a series of requests that effectively sought all OLC memoranda concerning surveillance by Executive Branch agencies directed at communications to or from U.S. citizens.2at See id. Even if the ACLU did not know that this specific memorandum was included among the documents reviewed in camera by the EPIC court, the ACLU had a full and fair opportunity to make any and all arguments in seeking disclosure of that document. Indeed, in EPIC, the government's assertion of exemptions received the highest level of scrutiny available to a plaintiff in FOIA litigation—the district court issued its decision after reviewing the document in camera and determining that the government's assertions of Exemptions One, Three, and Five were proper. Colborn Decl. ¶ 13. The ACLU's claim in this lawsuit is therefore barred by claim preclusion.

2 One of the FOIA requests at issue in EPIC sought "[a]ll memoranda, legal opinions, directives or instructions from [DOJ departments] issued between September 11, 2001, and December 21, 2005, regarding the government's legal authority for surveillance activity, wiretapping, eavesdropping, and other signals intelligence operations directed communications to or from U.S. citizens." Elec. Privacy Information Ctr. v. Dep't of Justice, 511 F. Supp. 2d 56, 63 (D.D.C. 2007).

Wyden just sent a letter to Loretta Lynch disputing some claim made in DOJ's memorandum of law.

I encourage you to direct DOJ officials to comply with the pending FOIA request.

Additionally, I am greatly concerned that the DOJ's March 7, 2016 memorandum of law contains a key assertion which is inaccurate. This assertion appears to be central to the DOJ's legal arguments, and I would urge you to take action to ensure that this error is corrected.

I am enclosing a classified attachment which discusses this inaccurate assertion in more detail.

Here are some thoughts about what the key inaccurate assertion might be:

ACLU never had a chance to argue for this document as a cybersecurity document

Even the section I've included here pulls a bit of a fast one. It points to EPIC's FOIA request (these requests got consolidated), which asked for OLC surveillance memos in generalized fashion, as proof that the plaintiffs in the earlier suit had had a chance to argue for this document.

But ACLU did not. They asked for "legal reviews of [TSP] and its legal rationale." In other words, back in 2006 and back in 2014, ACLU was focused on Stellar Wind, not on cybersecurity spying (which Wyden has strongly suggested this memo implicates). So they should be able to make a bid for this OLC memo as something affecting domestic spying for a cybersecurity purpose.

DOJ claimed only Wyden had commented publicly about the document, not Caroline Krass

DOJ makes a preemptive effort to discount the possibility that Ron Wyden's repeated efforts to draw attention to this document might constitute new facts for the ACLU to point to to claim they should get the document.

Nor is there any evidence the memorandum has been expressly adopted as agency policy or publicly disclosed. Colborn Decl. ¶¶ 23-24. Although the ACLU's complaint points to statements about the document by Senator Wyden, he is not an Executive Branch official, and his statements cannot effect any adoption or waiver

[snip]

The ACLU may argue that statements made by Senator Ron Wyden regarding the document, including in letters to the Attorney General, constitute new facts or changed circumstances. See Compl. ¶ 2 ("In letters sent to then–Attorney General Eric Holder, Senator Wyden suggested that the executive branch has relied on the Opinion in the past and cautioned that the OLC's secret interpretation could be relied on in the future as a basis for policy."). But such statements do not constitute new facts or changed circumstances material to the ACLU's FOIA claim because they do not evince any change of the Executive Branch's position vis-à-vis the document or otherwise affect its status under FOIA. See Drake, 291 F.3d at 66; Am. Civil Liberties Union, 321 F. Supp. 2d at 34. As the Senator is not an Executive Branch official, his statements about the document do not reflect the policy or position of any Executive Branch agency. See Brennan Center v. DOJ, 697 F.3d 184, 195, 206 (2d Cir. 2012); Nat'l Council of La Raza v. DOJ, 411 F.3d 350, 356-59 (2d Cir. 2005); infra at 11-12. Senator Wyden's statements are simply not relevant to whether the document has been properly withheld under Exemptions One, Three, and Five, and do not undermine the applicability of any of those exemptions. Additionally, the Senator has made similar statements regarding the document at issue in letters sent during at least the last four years. Compl. ¶ 2. Thus, the Senator's statements regarding the document are not new facts since they were available to Plaintiffs well before the district court ruled in EPIC.

That's all well and good. But the entire discussion ignores that then Acting OLC head and current CIA General Counsel Caroline Krass commented more extensively on the memo than anyone ever has on December 17, 2013 (see my transcript above). This is a still-active memo, but the then acting OLC head said this about the memo in particular.

I have been thinking about your question because I understand your serious concerns about this opinion, and one approach that seems possible to me is that you could ask for an assurance from the relevant elements of the Intelligence Community that they would not rely on the opinion. I can give you my assurance that if I were confirmed I would not rely on the opinion at the CIA.

That seems to be new information from the Executive branch (albeit before the March 31, 2014, final judgment in that other suit).

I'd say this detail is the most likely possibility for DOJ's inaccuracy, except that Krass' comments are in the public domain, and have been been written about by other outlets. It wouldn't seem that Wyden would need to identify this detail in secret.

(I think it's possible some of the newly declassified language in Stellar Wind materials may be relevant to, but I will have to return to that.)

The document may be a different document

DOJ's memo and the Paul Colborn declaration describe this as a March 30, 2003 memo written by John Yoo.

The withheld document is a 19-page OLC legal advice memorandum to the General Counsel of an executive branch agency, drafted at the request of the General Counsel, dated March 30, 2003 and signed by OLC Deputy Assistant Attorney General John Yoo. The memorandum was written in response to confidential communications from an executive branch client soliciting legal advice from OLC attorneys. As with all such OLC legal advice memoranda, the document contains confidential client communications made for the purpose of seeking legal advice and predecisional legal advice from OLC attorneys transmitted to an executive branch client as part of government deliberative processes. In light of the fact that the document's general subject matter is publicly known, the identity of the recipient agency is itself confidential client information protected by the attorney-client privilege.

But their claim that ACLU has already been denied this document under FOIA is based on the claim that this document is the same document as one identified in a Steven Bradbury declaration submitted in the Stellar Wind suit. Here's how he described the document.

DAG 42 is a 19-page memorandum, dated May 30, 2003, from a Deputy Assistant Attorney General in OLC to the General Counsel of another Executive Branch agency. This document is withheld under FOIA Exemptions One, Three, and Five.

This may be an error (if it is, Bradbury probably is correct, as March 30, 2003 was a Sunday), but a document dated March 30, 2003 cannot be the same document as one dated May 30, 2003. If it's not a simple error in dates, it may suggest that the document the DC court reviewed was a later revision, perhaps one making less outrageous claims. Moreover, as I'll show in my post on newly learned Stellar Wind information, the change in date (as well as the confirmation that Yoo wrote the memo) make the circumstances surrounding this memo far more interesting.

The document may not have been properly classified

As noted, this is a March 2003 OLC memo written by John Yoo. That's important not just because Yoo was freelancing on certain memos at the time. But more importantly, because a memo he completed just 16 days earlier violated all guidelines on classification. Here's what former ISOO head Bill Leonard had to say about John Yoo's March 14, 2003 torture memo.

The March 14, 2003, memorandum on interrogation of enemy combatants was written by DoJ's Office of Legal Counsel (OLC) to the General Counsel of the DoD. By virtue of the memorandum's classification markings, the American people were initially denied access to it. Only after the document was declassified were my fellow citizens and I able to review it for the first time. Upon doing so, I was profoundly disappointed because this memorandum represents one of the worst abuses of the classification process that I had seen during my career, including the past five years when I had the authority to access more classified information than almost any other person in the Executive branch. The memorandum is purely a legal analysis – it is not operational in nature. Its author was quoted as describing it as "near boilerplate."! To learn that such a document was classified had the same effect on me as waking up one morning and learning that after all these years, there is a "secret" Article to the Constitution that the American people do not even know about.

[snip]

In this instance, the OLC memo did not contain the identity of the official who designated this information as classified in the first instance, even though this is a fundamental requirement of the President's classification system. In addition, the memo contained neither declassification instructions nor a concise reason for classification, likewise basic requirements. Equally disturbing, the official who designated this memo as classified did not fulfill the clear requirement to indicate which portions are classified and which portions are unclassified, leading the reader to question whether this official truly believes a discussion of patently unclassified issues such as the President's Commander-in-Chief authorities or a discussion of the applicability to enemy combatants of the Fifth or Eighth Amendment would cause identifiable harm to our national security. Furthermore, it is exceedingly irregular that this memorandum was declassified by DoD even though it was written, and presumably classified, by DoJ.

Given that Yoo broke all the rules of classification on March 14, it seems appropriate to question whether he broke all rules of classification on March 30, 16 days later, especially given some squirrelly language in the current declarations about the memo.

Here's what Colborn has to say about the classification of this memo (which I find to be curious language), after having made a far more extensive withholding argument on a deliberative process basis.

OLC does not have original classification authority, but when it receives or makes use of classified information provided to it by its clients, OLC is required to mark and treat that information as derivatively classified to the same extent as its clients have identified such information as classified. Accordingly, all classified information in OLC's possession or incorporated into its products has been classified by another agency or component with original classifying authority.

The document at issue in this case is marked as classified because it contains information OLC received from another agency that was marked as classified. OLC has also been informed by the relevant agency that information contained in the document is protected from disclosure under FOIA by statute.

As far as the memo of law, it relegates the discussion of the classified nature of this memo to a classified declaration by someone whose identity remains secret.

As explained in the classified declaration submitted for the Court's ex parte, in camera review,1 this information is also classified and protected from disclosure by statute.

Remember, this memo is about some secret interpretation of common commercial service agreements. Wyden believes it should be "declassified and released to the public, so that anyone who is a party to one of these agreements can consider whether their agreement should be revised or modified."

If this is something that affects average citizens relationships with service providers, it seems remarkable that it can, at the same time, be that secret (and remain in force). While Wyden certainly seems to treat the memo as classified, I'd really love to see whether it was, indeed, properly classified, or whether Yoo was just making stuff up again during a period when he is known to have secretly made stuff up.

In any case, given DOJ's continued efforts to either withdraw or disclose this memo, I'd safe it's safe to assume they're still using it.

Filed Under: doj, john yoo, loretta lynch, olc, opinion, ron wyden, secret law

Senator Wyden Warns That The Justice Department Is Lying To The Courts; Also Still Worried About Secret Law

from the keep-plugging-at-this dept

We've been noting for years: when Senator Ron Wyden says that (1) there's a secret interpretation of a law that is at odds with the public's understanding of it, or (2) that government officials are lying, you should pay attention. It may take a while, but it always comes out eventually that he's absolutely correct. For at least five years now, we've been posting semi-regular updates to Wyden calling out the government for its secret interpretations of the law, and some of that was proven entirely accurate thanks to the Snowden revelations concerning how the PATRIOT Act and the FISA Amendments Act had been interpreted. However, since the Snowden revelations, Wyden has made it clear that that's not all. In particular, he's spoken about a Justice Department legal opinion, written by John Yoo, that Wyden insists is important and should be revealed.

A year ago, we wrote about Wyden asking then Attorney General Eric Holder to release the document, which is currently the subject of a FOIA lawsuit filed by the ACLU. He's now asking yet again for it, in a new letter to Attorney General Loretta Lynch:

As you may be aware, I have previously written to the Department of Justice regarding a particular secret legal opinion from the DOJ's Office of Legal Counsel. which has now been the subject of a recent suit under the Freedom of information Act. This opinion remains classified, but it pertains to common commercial service agreements. The DOJ's motion to dismiss the now-pending FOIA case also noted that this opinion was signed by Deputy Assistant Attorney General John Yen and dated March 30, 2003.

As I have noted in previous correspondence with the DOJ, I believe that this opinion is inconsistent with the public's understanding of the law, and should be withdrawn. I also believe that this opinion should be declassified and released to the public, so that anyone who is a party to one of these agreements can consider whether their agreement should be revised or modified. For these reasons, I encourage you to direct DOJ officials to comply with the pending FOIA request.

As we noted in our previous coverage, the contents of this memo almost certainly impact the various cybersecurity issues, in particular the Cybersecurity law (a variation on CISA) that passed and became law late last year.

But, the much bigger news comes in the following paragraph, in which Senator Wyden says that the DOJ is lying to the court in trying to kill the ACLU's FOIA request:

Additionally, I am greatly concerned that the DOJ's March 7, 2016, memorandum of law contains a key assertion which is inaccurate. This assertion appears to be central to the DOJ's legal arguments, and I would urge you to take action to ensure that this error is correct.

I am enclosing a classified attachment which discusses this inaccurate assertion in more detail.

You can see the DOJ's memorandum of law here (or embedded below) to see if you can sniff out the "key assertion which is inaccurate." Marcy Wheeler, who is damn good at this stuff, has some suggestions and thoughts, though each has some caveats. Either way, just the fact that this is a guessing game is ridiculous. The fact that the DOJ appears to be purposely misleading the court is a travesty -- but one that has become all too common these days.

In the meantime, are there any legal opinions that John Yoo authored that didn't turn out to be absolutely horrific? He wrote the legal opinion that authorized torture. And just a few weeks ago, another one of his ridiculous legal opinions (from 2002) was released, revealing his absolutely ridiculous legal rationale for warrantless wiretapping. Yoo seemed to specialize in trying to paper over basically anything illegal that the government wanted to do.

Filed Under: eric holder, foia, john yoo, loretta lynch, olc, ron wyden, secret interpretation, secret law
Companies: aclu

Lawmakers Speak Out On Apple Being Forced To Create Backdoors; Some Wisely, Some Ignorantly

from the some-good,-some-bad dept

Everyone's talking about the big legal fight that magistrate judge Sheri Pym has kicked off by ordering Apple to build a backdoor into an iPhone to get around security tools that would block attempts to decrypt the contents of the phone. As some are noting, if the ruling is not overturned it could force Congress to change the law. Over the last year or so, it had become clear that Congress did not support laws that mandate backdoors. Yes, some in Congress -- including Senators Richard Burr, Dianne Feinstein and John McCain -- have been pushing for such legislation, but most have admitted that there aren't nearly enough votes in support of that, and there are many in Congress who recognize the ridiculousness of such a law. A year ago, a congressional hearing made it clear that there was a ton of skepticism in Congress about ordering backdoors.

And now we see Congress speaking out about the court order as well. Rep. Ted Lieu -- who, people always point out, has a computer science degree, and who a year ago noted that backoors were "technologically stupid" -- has told the DailyDot that this order creates a very dangerous slippery slope:

"Can courts compel Facebook to provide analytics of who might be a criminal?" Lieu said in an email to the Daily Dot. "Or Google to give a list of names of people who searched for the term ISIS? At what point does this stop?"

Rep. Zoe Lofgren put out a detailed statement saying that the order was "an astonishing overreach of authority by the Federal government," and warned that it appeared to go against the wishes of Congress and that even if the order is upheld, it will only result in stronger encryption that can't be backdoored:

Apple, as do other technology companies, complies with lawful orders and warrants. But they are unable to deliver to the government what they do not have – in this case, a key to break into their operating system in the manner the FBI desires. It is astonishing that a court would consider it lawful to order a private American company be commandeered for the creation of a new operating system in response.

The issue of mandating back doors in encryption has been a topic of vigorous discussion in the Congress. The emerging consensus has been that creating back doors for the use of law enforcement, important as law enforcement is, would endanger Americans by generally weakening security. These weaknesses will inevitably be exploited by criminal hackers or foreign opponents. That a single magistrate should substitute her judgment for that of the duly elected President and Congress – that was already thoroughly engaged in the subject – is wrong as a matter of policy and of law.

Finally, should this order not be overturned, technology companies will have no choice but to further deploy robust encryption that would prevent their engineers from creating any system that would effectively open up previously deployed security measures.

I urge the judicial branch to swiftly overturn this misguided ruling and further urge the Director of the FBI to refrain from seeking public policy decisions from the courts that are more properly decided by the Legislative branch of government.”

Senator Ron Wyden put out a statement as well, noting how this ruling will be interpreted around the globe:

I don't take a backseat to anyone when it comes to hunting down terrorists and protecting Americans from harm. However, this unprecedented reading of a nearly 230-year-old law would create a dangerous precedent that would put at risk the foundations of strong security for our people and privacy in the digital age. If upheld, this decision could force U.S. technology companies to actually build hacking tools for government against their will, while weakening cybersecurity for millions of Americans in the process.

Furthermore, this move by the FBI could snowball around the world. Why in the world would our government want to give repressive regimes in Russia and China a blueprint for forcing American companies to create a backdoor? Companies should comply with warrants to the extent they are able to do so, but no company should be forced to deliberately weaken its products. In the long run, the real loses will be Americans' online safety and security.

Of course, not all our lawmakers are so enlightened. Senator Feinstein, despite technically representing Apple, has shown for a long time now that she has no interest at all in representing the true interests of anyone in California if it goes against the desire of the surveillance state. She basically told Apple to shut up and do what the court says. After pretending it's about protecting Californians (because San Bernardino is in California) she warns that if Apple doesn't obey it will force her and Senator Burr to push for the legislation they've already been pushing for:

I would hope that bill would not be necessary. I would hope Apple understand the seriousness of this request. I have no doubt that to deny the request would likely bring on law to change law, so that this can be done. We're in jeopardy if you cannot -- through proper evidence submitted by a probable cause warrant -- be able to open these systems.

The PBS interviewer who asked Feinstein about this also asked (twice!) about Apple's statement that creating backdoors will create opportunities for those with malicious intent to break into the phones as well, and Feinstein displays her technological ignorance by stating:

Oh I don't believe that's necessarily true.

She's wrong about that. She's literally advocating for everyone to be made less safe just so we can get a little more information on some people who we already know committed a crime. That's crazy.

And, of course, Senator Burr made a similar statement -- first by lying and pretending that the order is not about creating a backdoor:

There are no decryption demands in this case, and Apple is in no way required to provide a so-called backdoor. The FBI needs access to the phone so the agency can better piece together information about the terrorists and whom they contacted.

This is technologically ignorant as well. This is exactly what a backdoor is. Apple is being told to create a bit of software that disables security measures in order to decrypt encrypted material. That's the very definition of a backdoor. Burr goes on, pretending that weakening the safety and security of basically everyone is somehow making them more secure:

The iPhone precedent in San Bernardino is important for our courts and our ability to protect innocent Americans and enforce the rule of law. While the national security implications of this situation are significant, the outcome of this dispute will also have a drastic effect on criminal cases across the country. The newest Apple operating systems allow device access only to users — even Apple itself can’t get in. Murderers, pedophiles, drug dealers and the others are already using this technology to cover their tracks.

Yup, always bring up the holy trinity of "murderers, pedophiles and drug dealers." I'm amazed he didn't say terrorists as well. Of course, as people keep pointing out, there have always been ways for people with ill-intent to hide their communications. There's nothing in the law that says we have to be able to track every communication ever made by everyone. That's a dystopian vision -- but one that apparently Senator Burr likes.

Even worse, Burr insists that because the law "protects" Apple in other cases, it should roll over for this. And also, ridiculously, he argues that this is more about Apple's business model than protecting the safety of Americans.

Apple’s position in the San Bernardino case affirms that it has wrongly chosen to prioritize its business model above compliance with a lawfully issued court order. While the company may have routinely complied with such court orders in the past, it now claims that it cannot comply as a result of security features it has built into its newest products. Apple exists as a corporate entity with the protections provided by U.S. laws, but it cannot be allowed to pick and choose when to abide by those laws as it sees fit. We are a country of laws, and this charade has gone on long enough. Apple needs to comply with the court’s order.

Hilariously, this is the very same Senator Burr who, just months ago, was going on and on in Congress about the importance of cybersecurity, and fearmongering about "cyberattacks." What he doesn't seem to recognize is that the only real way to protect against those attacks is encryption. The very encryption he now seeks to undermine.

Others in the Senate are making similarly ignorant statements, including Senator Tom Cotton, whose statement is so over-the-top ridiculous and wrong as to almost not be worth mentioning:

"Apple chose to protect a dead ISIS terrorist's p‎rivacy over the security of the American people. The Executive and Legislative Branches have been working with the private sector with the hope of resolving the 'Going Dark' problem. Regrettably, the position Tim Cook and Apple have taken shows that they are unwilling to compromise and that legislation is likely the only way to resolve this issue. The problem of end-to-end encryption isn't just a terrorism issue. It is also a drug-trafficking, kidnapping, and child pornography issue that impacts every state of the Union. It's unfortunate that the great company Apple is becoming the company of choice for terrorists, drug dealers, and sexual predators of all sorts."

I mean, come on. Apple is not "protecting a dead ISIS terrorists' privacy," it's talking about the very real issue of whether or not courts have the power to order companies to hack their customers on behalf of the government. That's a big deal that you would think would matter to politicians.

These statements are not unsurprising, but they continue to show a level of profound ignorance about basic technology issues. The fact that Feinstein and Burr, at least, are working on legislation around an issue they so clearly have no clue about is downright scary. One hopes that the others who actually understand the technical and legal issues -- such as those at the top of this article -- will prevail in Congress.

Filed Under: all writs act, dianne feinstein, encryption, going dark, precedent, richard burr, ron wyden, ted lieu, tom cotton, zoe lofgren
Companies: apple

CIA Director Freaks Out After Senator Wyden Points Out How The CIA Spied On The Senate

from the not-so-cool-under-fire dept

If you're a CIA Director, one would assume that you know how to be cool under fire, right? Apparently that's not the case for current CIA Director John Brennan who seemed to completely freak out when Senator Ron Wyden started asking questions about the CIA's infamous decision to spy on the network and computers of Senate Intelligence Committee staffers who were compiling a report on the CIA's torture program. The details are a bit complex, but the short version is that the Intelligence Committee, which has oversight powers over the CIA, had been set up in a CIA building, with special access to CIA documents, and a special search tool. Apparently, at some point, that search tool returned a document which the CIA had never intended to share with the intelligence committee staffers. That document, called "the Panetta Review" was a draft document that then-CIA chief Leon Panetta had tasked people internal at the CIA to prepare on what the Senate Intelligence Committee staffers were likely to find as they went through the documents.

Yes, this is fairly meta. You had Senate staffers reviewing CIA documents, and at the same time, the CIA reviewing those same documents to try to get out ahead of any controversy -- and to make matters confusing, the Senate staffers then got access to that CIA review document as part of their regular searches. When the CIA was questioned about this Panetta review, they freaked out, wondering how the Senate staffers got their hands on the document, and did what the CIA does: they spied on the Senate staffers' computers and network to try to determine how they got the document in the first place. This was despite a promise from the CIA that the Senate staffers' computers and network were considered off-limits (due to an even earlier incident). That resulted in Senator Dianne Feinstein accusing the CIA of illegally spying on the Senate (its overseers). In response, Brennan first denied the spying altogether, and then insisted that it was the Senate staffers who broke the law, saying they illegally mishandled classified CIA documents in how they handled the Panetta Review.

Eventually, the DOJ decided that there wasn't enough evidence that either side broke the law, and refused to make any criminal charges either way. While both the CIA's Inspector General and a special review board Brennan himself set up found that the CIA did, in fact, spy on the Senate staffers' network and computers, and that this was inappropriate, neither seemed to say that it rose to a truly controversial level. Not surprisingly, the review board Brennan set up himself cleared him of wrongdoing.

Mixed in with all of this are remaining questions about how involved Brennan himself actually was in all of this (he refuses to say) and an ongoing request for an apology. While the CIA's Inspector General claimed that Brennan apologized for the breach, later reporting by Jason Leopold at Vice showed that Brennan had drafted an apology, but never sent it. Instead, he apparently provided a very narrow apology solely to Feinstein and then vice chair Saxby Chambliss, basically of the "I'm sorry if what did upset you" manner.

Given this, during a rare open Senate Intelligence Committee hearing, Wyden decided to quiz Brennan about all of this, leading to a rather sarcastic and testy exchange that needs to be watched to be believed: Immediately, Brennan gets snarky, noting that "This is the annual threat assessment, is it not? Yes?" implying that he doesn't think it's appropriate for Wyden to be bringing up this "other" topic in such a hearing. And it only gets worse from there. He immediately jumps to the argument, again, that it was the Senate staffers' fault for getting access to a document he didn't want them to see. He then says the CIA therefore had an "obligation" to find out how that happened. And then he, somewhat insultingly, suggests that Senator Wyden had not actually read the IG's account, or the report of the review panel that Brennan himself set up.

Wyden cuts him off, quoting directly from the report and notes that other agencies have all said it would be inappropriate to review Senate oversight computer systems, and asks Brennan if he disagrees. Brennan is clearly pissed off:

Brennan: Yes, I think you mischaracterize both their comments as well as what's in those reports. And I apologized to the Chairman and the Vice Chairman about the de minimis access and inappropriate access that CIA officers made to five emails or so of Senate staffers during that investigation. And I apologized to them for that very specific inappropriate action that was taken as part of a very reasonable investigative action. But do not say that we spied on Senate computers or files. We did not do that. We were fulfilling our responsibilities.

Wyden: I read the exact words of the Inspector General and the Review Board. You appointed the Review Board! They said nobody ought to be punished, but they said there was improper access. And my point is, in our system of government, we have responsibilities to do vigorous oversight. And we can't do vigorous oversight if there are improper procedures used to access our files.

Wyden then admits his time is up... but Brennan's so angry that he won't give up. He breaks all proper Senate hearing protocol and jumps back in, asking Wyden to say, again, that it was the Senate staffers' fault for accessing the Panetta Review:

Do you not agree there was improper access that senate staffers had to CIA internal deliberative documents? Was that not inappropriate or unauthorized?

Wyden angrily points out that everything the Senate staffers did was appropriate, and anyway, he's now asking about the CIA's activities, and points to the Inspector General review and the other review board... all the while with Brennan angrily shaking his head at Wyden. When Wyden finishes, Brennan goes back to being snarky, saying:

And I'm still awaiting the review that was done by the Senate to take a look at what the staffers actions were.

And then there's this:

Separation of powers between the executive, legislative branches, Senator, goes both ways.

In short: even if you have oversight over us, don't mess with the CIA, Senator. That's quite a statement.

He then goes on to again claim that Wyden is mischaracterizing everything, and that what the CIA did was entirely appropriate. Wyden concludes:

It's pretty hard to mischaracterize word for word quotes that use the words "improper access."

Indeed.

Filed Under: cia, john brennan, oversight, ron wyden, senate intelligence committee, separation of powers, spying, torture report

20 Years Ago Today: The Most Important Law On The Internet Was Signed, Almost By Accident

from the give-thanks dept

The internet as we know it would be a very, very different place if 20 years ago today, President Clinton hadn't signed the Communications Decency Act. To be fair, nearly all of the CDA was a horrible mess that was actually a terrible idea for the internet. A key part of the bill was about "cleaning up" pornography on the internet. However, to "balance" that out, the bill included Section 230 -- added by two Congressmen in the House of Representatives: Ron Wyden and Chris Cox. They had pushed this clause as a separate bill, the Internet Freedom and Family Empowerment Act, but it didn't get enough traction. It was only when they attached it to the Communications Decency Act (which had passed the Senate without it), that it was able to move forward. And thus, 20 years ago today, when President Clinton signed the CDA, most of the attention was on the "stopping indecency" part, and very little on the "throw in" of Section 230. And yet, there's a strong argument that Section 230 may be one of the most important laws -- perhaps the most important -- passed in the past few decades.

As you hopefully already know, a year later, in Reno v. ACLU, the Supreme Court tossed out basically all of the CDA as unconstitutional. The only tidbit of the law that remained valid? You guessed it: Section 230. And, of course, it became the key law in enabling the internet to grow the way it did. It's been said in the past, fairly accurately, that no law contributed more to the growth of the internet than CDA 230, and that's because of a fairly simple and straightforward principle. CDA 230 simply said that an internet service is not liable for actions of its users. This meant that new websites and internet services didn't need to carefully monitor and track everything that every user did to make sure it wasn't violating a law. That meant the legal risks and liability for creating services that allowed the public to create all kinds of content went way down.

Without a robust Section 230, it's difficult to see many of the most popular platforms today existing. It's no surprise that soon after CDA 230 we saw the rise of blogging and social media -- and almost always coming from American companies. Both would be significantly more difficult without Section 230's protections. In fact, much of the push for Section 230 came in response to a horrible court case, Stratton Oakmont v. Prodigy, in which an internet bulletin board commenter attacked financial firm Stratton Oakmont, and its president, for apparently being involved in criminal and fraudulent activity. Stratton Oakmont -- now perhaps well known as the firm portrayed as doing all sorts of criminal and fraudulent things in the movie The Wolf of Wall Street -- sued Prodigy for the comment and won. The liability from such a ruling scared numerous online platforms, in particular because a key part of the ruling was that because Prodigy posted "guidelines" and removed posts with offensive language, it suddenly became a "publisher" of the content, and was liable for that content.

A key, and often overlooked, part of Section 230, is that it actually does encourage sites to take proactive measures to filter content, by noting that any kind of moderation or guidelines absolutely does not remove the protections of Section 230. As such, sites get to decide for themselves whether or not to moderate their content in any way, without facing the legal risk of suddenly being declared the publisher. Other countries have no such protections, leading to some dangerous rulings, and creating something akin to a "right to be forgotten" in some instances.

There have been numerous cases testing Section 230 over the years -- and the law has remained strong and in place -- though it is still being challenged to this day. The biggest and most important case was Zeran v. AOL, the first case testing Section 230, in which the court found that Section 230 was a powerful tool that kept sites from being held responsible for content posted by users.

Section 230 has been powerful in so many ways. It has both enabled and protected free speech online by letting companies set up platforms where people can speak openly. Without it, the internet would be much more limited as a platform for communicating to the public. As the 4th Circuit noted in its ruling in the Zeran case:

The amount of information communicated via interactive computer services is therefore staggering. The specter of tort liability in an area of such prolific speech would have an obvious chilling effect. It would be impossible for service providers to screen each of their millions of postings for possible problems. Faced with potential liability for each message republished by their services, interactive computer service providers might choose to severely restrict the number and type of messages posted.

It has protected privacy, by making it clear that there was no duty for websites to monitor and track their users, to avoid any kind of liability. It has created incentives to create tremendous economic value, by making it clear that companies could be formed to enable public communications, such as blogging, forums and social media -- without being sued into bankruptcy over misuse. And it has actually enabled better moderation of platforms in not making them give up protections, if they choose how to moderate certain content.

It is difficult to express just how important Section 230 has been over the past 20 years other than to say that, without it, it's unlikely that you would be able to comment on Techdirt today. It's also unlikely that you'd have tools like Twitter or Facebook or Yelp or AirBnb. Any service that relies on public input owes a huge debt to Section 230, and it's quite incredible that it was basically included as an "add-on" that very few noticed when it was signed.

So, as we're hanging out here on the internet today, in a place that is alive only because of Section 230, please thank (now Senator) Ron Wyden in particular for his role in creating Section 230, and pay attention, because there are very powerful forces working right now to undermine Section 230 entirely. It's been a key driver of free expression and economic growth for the past 20 years, and it would be a shame to undermine that now.

Filed Under: cda, cda 230, communications decency act, free speech, immunity, innovation, internet, liability, ron wyden, safe harbors

Senate Intelligence Committee Members Ask White House For Official Apology From CIA For Hacking Senate Computers

from the CIA:-it's-time-to-let-unacknowledged-wrongdoing-remain-unacknowledged dept

Ron Wyden, Martin Heinrich and Mazie Hirono -- all members of Senate Intelligence Committee -- have sent a letter to the President demanding an official apology from CIA head John Brennan for the agency's surveillance of Senate staffers working on the Torture Report.

"In January 2014, CIA personnel conducted an unauthorized, unprecedented search of Senate committee files, including the emails and other files of Senate staff investigating the CIA's use of torture," says the letter...

"The CIA Inspector General stated in a July 2014 report that this search involved 'improper agency access to [Senate Intelligence Committee] files.' A review board selected by CIA Director Brennan concluded in December 2014 that this CIA search 'resulted in inappropriate access to [Senate Intelligence Committee] work product'."

[...]

"We believe that it is necessary for you to ensure that senior officials in your administration recognize the importance of adhering to the rule of law," the lawmakers wrote to Obama. "We ask that you instruct Director Brennan to acknowledge that the CIA's unauthorized search of Senate files was improper and will not be repeated."

The White House and CIA have yet to comment on the letter and there's nothing in the history of the incident that suggests either will move forward on this. Obama's on short time and the CIA already cleared itself of all wrongdoing with an in-house "investigation" and further showed its disdain for independent oversight by throwing its Inspector General and his report on the spying efforts under the bus.

Jason Leopold and Vice obtained hundreds of documents through FOIA requests that appeared to show the opposite of what the CIA's internal investigation claimed. But it was the CIA that had the last word, proclaiming itself innocent and simultaneously accusing Senate staffers of improperly accessing restricted documents.

But the most damning document -- at least in the context of a demand for an official apology from the CIA -- was the apology the agency unofficially disavowed when it cleared itself of hacking allegations.

[T]he documents turned over to VICE News included a July 28, 2014 letter from Brennan that was addressed to Feinstein and Saxby Chambliss, who was then the ranking Republican on the Intelligence Committee, in which he apologized to them and admitted that the CIA's penetration of the computer network used by committee staffers reviewing the agency's torture program was improper.

The thing is, Brennan never signed or sent this apology. It just sat in a Torture Report-related file until it was FOIAed. Brennan even offered a closed-door, off-the-record apology to Dianne Feinstein, but to date, the final official word remains the CIA's: we did nothing wrong.

Filed Under: cia, john brennan, martin heinrich, mazie hirono, president obama, ron wyden, senate intelligence committee, spying, torture report

Senator Feinstein Brings Back Horrible Bill Forcing Internet Companies To Report On Your 'Suspicious' Behavior

from the it-was-a-bad-idea,-drop-it dept

Earlier this year, Senator Dianne Feinstein, who seems to be an endless well of bad ideas around surveillance, started pushing a bill that would require internet companies to report to the government any content they suspected was posted by terrorists. This bill has all sorts of problems, not the least of which is that most of the major internet companies already alert the government to any terrorist-related content that they come across. But, by mandating such reporting, it will only lead to these companies filing a bunch more reports -- much of which will be bogus, flooding the government with useless information, just to avoid running afoul of the law.

Back in September, Senator Wyden successfully forced Feinstein to drop the bill...

But, of course, in the wake of the Paris and San Bernardino attacks all bad ideas are back on the table, and Feinstein is bringing this one back as well. She's teaming up with the intelligence committee's other biggest cheerleader, Intelligence Committee boss Senator Richard Burr, to reintroduce the idea, and they put out a completely bogus statement that plays up the fearmongering angle as much as possible, about those darn ISIS people using social media.

“We’re in a new age where terrorist groups like ISIL are using social media to reinvent how they recruit and plot attacks,” Senator Feinstein said. “That information can be the key to identifying and stopping terrorist recruitment or a terrorist attack, but we need help from technology companies. This bill doesn’t require companies to take any additional actions to discover terrorist activity, it merely requires them to report such activity to law enforcement when they come across it. Congress needs to do everything we can to help intelligence and law enforcement agencies identify and prevent terrorist attacks, and this bill is a step in the right direction.”

“Terror groups have become adept at taking advantage of social media platforms to spread their message,” Senator Burr said. “Social media is one part of a large puzzle that law enforcement and intelligence officials must piece together to prevent future attacks. It’s critical that Congress works together to ensure that law enforcement and intelligence officials have the tools available to keep Americans safe. The stakes have never been higher and having cooperation with these outlets will help save lives here and abroad.”

Neither of those quotes makes any sense. Again, most companies already report stuff, and mandating it will only lead to more bogus reports to avoid liability for the companies, while potentially leading to less active monitoring since they only have to report stuff if they come across it. As for Burr's assertion that this is necessary to give law enforcement "the tools" to find this information -- that's a totally different issue. Doesn't law enforcement have computers? Can't they go to Twitter and Facebook and YouTube themselves and do searches?

Senator Wyden has already spoken out on what a bad idea this is, and how it would do the exact opposite of what Feinstein and Burr are claiming:

Let’s make sure the record is clear: The Director of the FBI testified a few months ago that social media companies are ‘pretty good about telling us what they see.’ Social media companies must continue to do everything they can to quickly remove terrorist content and report it to law enforcement.

I’m opposed to this proposal because I believe it will undermine that collaboration and lead to less reporting of terrorist activity, not more. It would create a perverse incentive for companies to avoid looking for terrorist content on their own networks, because if they saw something and failed to report it they would be breaking the law, but if they stuck their heads in the sand and avoided looking for terrorist content they would be absolved of responsibility.

I’m for smart security policies. If law enforcement agencies decide that terrorist content is not being identified quickly enough, then the solution should be to give those agencies more resources and personnel so they know where to look for terrorist content online and who to watch, and can ensure terrorist activity is quickly reported and acted upon.

Meanwhile, CDT has gone much further in explaining why this is such an astoundingly dumb idea:

Why is this proposal such a bad idea? As we described in July, it would create a requirement for all electronic communication services – social media companies, as well as Internet service providers, web hosts, cloud services, and public libraries or coffee shops that offer WiFi access – to make reports about their users’ activity based on a completely opaque set of criteria. Creating such an obligation, with its vague parameters, would drive Internet companies to one of several likely responses. Some would decide to significantly over-report their customers’ information and private communications to the US government to ensure that the company stays on the right side of the law. Others would refuse to review any content that was flagged to them, for fear that doing so would mean they obtain the “actual knowledge of any terrorist activity” that triggers the reporting obligation.

Either of these outcomes pose major problems for the free expression and privacy of Internet users. It’s also far from clear that this would generate actionable information for law enforcement or intelligence agencies. Further, this type of reporting obligation would undermine any sense of trust between Internet users and the companies that provide the service providers that enable them to access information, conduct transactions, and share their perspectives online. The proposal would essentially deputize US-based Internet companies to act as agents of the government, including potentially requiring entities such as email services to turn over the contents of private communications if they are part of the “facts and circumstances” of alleged terrorist activities – for their users both in the US and abroad.

It's a bad idea and Feinstein knows it's a bad idea, because all of this has been explained to her multiple times in the past. So why is she still proposing it?

Filed Under: dianne feinstein, freakout, informant, richard burr, ron wyden, terrorism
Companies: facebook, google, twitter, youtube

Senate Rejects All CISA Amendments Designed To Protect Privacy, Reiterating That It's A Surveillance Bill

from the the-exclamation-point dept

In case you weren't already convinced that CISA is a surveillance bill masquerading as a cybersecurity bill, today the Senate rejected four separate amendments to the bill that attempted to better protect the privacy of Americans. Senator Wyden had an amendment to require the removal of personal information before information could be shared, which was voted down 55 to 41. Senator Heller had an amendment that was basically a backstop against the Wyden amendment, saying that if the Wyden amendment didn't pass, Homeland Security would be responsible for removing such personal information. That amendment also failed by a 49 to 47 vote. Senator Leahy had an amendment that would have removed FOIA exemptions in the bill (making it much less transparent how CISA was used). That amendment was voted down 59 to 37. Senator Franken then had an amendment that would have "tightened" the definition of cybersecurity threats, so that the shared information needed to be "reasonably likely" to cause damage, as opposed to the current "may" cause damage. And (you guess it, because you're good at this), it was also voted down by a 60 to 35 vote.

Meanwhile, Marcy Wheeler notes that the revised version of the bill by Senators Burr and Feinstein, which claimed to incorporate greater transparency requirements proposed by Senator Tester, actually takes away a lot of transparency and actually makes it more difficult for Congress to learn whether or not CISA is being used for domestic surveillance:

That Burr and DiFi watered down Tester’s measures so much makes two things clear. First, they don’t want to count some of the things that will be most important to count to see whether corporations and agencies are abusing this bill. They don’t want to count measures that will reveal if this bill does harm.

Most importantly, though, they want to keep this information from Congress. This information would almost certainly not show up to us in unclassified form, it would just be shared with some members of Congress (and on the House side, just be shared with the Intelligence Committee unless someone asks nicely for it).

But Richard Burr and Dianne Feinstein want to ensure that Congress doesn’t get that information. Which would suggest they know the information would reveal things Congress might not approve of.

Once again, these kinds of actions really only make sense if CISA is being used to justify warrantless domestic surveillance. Which once again raises the question of why Congress is willing to move forward with such a surveillance bill. We just went through a whole process showing that the public is not comfortable with secret laws and secret interpretations that lead to surveillance. Why would they immediately push for a new secret law that expands surveillance and reject any and all attempts at protecting the privacy of the American public or any sort of transparency and accountability in how the bill is used?

The bill is positioned as a cybersecurity bill, but good luck finding a single computer security expert who actually thinks the bill is either useful or necessary. I've been trying and so far I can't find any.

Filed Under: al franken, cisa, dean heller, dianne feinstein, pat leahy, privacy, richard burr, ron wyden, senate, surveillance, transparency

Senate Pushes Forward With CISA As Internet Industry Pulls Its Support

from the what-are-they-thinking? dept

Despite the fact that most of the internet industry has recently come out against the ridiculous faux-cybersecurity bill CISA, the Senate today began the process of moving the bill forward with a debate. The arguments were pretty much what you'd expect. The supporters of the bill, such as Senators Dianne Feinstein and Richard Burr, went on and on about how the bill is "voluntary" and about various online hacks (none of which would have been stopped by CISA -- but apparently those details don't matter). Senator Ron Wyden responded by pointing to all the internet companies coming out against the bill, and saying (accurately) that they're doing so because they know the public no longer trusts many of those companies, and they don't want a bill that will almost certainly be used for further surveillance efforts.

Amazingly, Burr shot back with a really dishonest and misleading claim that companies that don't agree to "share" information with the government are the ones harming their users by somehow not protecting their info. That's fairly incredible. The reason that companies don't want to share info is because no one -- the companies or the public -- trust the government to not abuse the information. To turn that around and pretend that sharing the info with the government is likely to better protect user information is laughable.

The fact that the internet companies have finally come out against CISA is a really big deal. For the past few years, they've remained pretty quiet on it and related bills, because it would have granted them immunity from liability for participating in the program. So, for the tech companies, it was tough to argue against the bill, since it just protected them from legal liability. Yet, in the last few weeks, many internet companies and industry associations have (finally) spoken out against the bill, noting that it actually puts their users' privacy at risk. This also helps highlight how the claim that this is all "voluntary" is a myth, and the companies recognize that they will likely be pressured into sharing information.

Meanwhile, a bunch of amendments have been introduced along with CISA... including an absolutely terrible amendment introduced by Senator Sheldon Whitehouse that would revamp an unrelated bill, the infamous CFAA, which needs to be reformed. Except that the Whitehouse amendment makes the CFAA worse, not better.

There's still plenty of process to occur, but the ball is now rolling. There will likely be some fights and votes in the next few days, but if you don't think CISA (or this horrible CFAA amendment) should pass, now would be a good time to call your two Senators and let them know to oppose this.

Filed Under: cfaa, cisa, cybersecurity, dianne feinstein, information sharing, richard burr, ron wyden, sheldon whitehouse

How Bad Copyright Law Makes Us Less Safe... And How Regulators Have It All Backwards

from the fix-1201-now dept

For quite some time we've pointed out how problematic Section 1201 of the DMCA is. That's the part of the law that says it's copyright infringement to simply circumvent any kind of "technological protection measure" even if the reasons for doing so are perfectly legal and have nothing to do with infringement at all. And, of course, we now have the big "1201 Triennial Review" results that are about to come out. That's the system that was put in place because even Congress realized just how stupid Section 1201 was and how much innovation and research it would limit -- so it created a weird sort of safety valve. Every three years, the Copyright Office and the Librarian of Congress would work together to come up with classes of technology that are magically "exempted" from the law. Now, normally, you'd think that if you have to come up with exemptions, there's probably something wrong with the law that needs to be fixed, but that's not the way this worked.

The latest triennial review results are about to come out, and a lot of people are focused on it -- in part because of current events. As you may recall, earlier this year, we wrote about one of the exemption requests in particular: over whether or not you can tinker with the software in your car. GM was fighting against this, and we were shocked to then see the EPA side with GM (!?!?) on this issue, claiming that it's a perfectly reasonable use of copyright law to stop tinkering with cars on the off chance that some of that tinkering might lead to changing emissions to illegal levels.

Of course, just a few weeks later, we discovered that VW had been playing games with its software to avoid emissions tests and pollute the world at a much greater rate than is legal (or healthy). Many people have pointed out that, if the software wasn't all locked up, it seems likely that people would have discovered this problem much earlier. The latest to weigh in on this is Senator Ron Wyden, in a WSJ op-ed, where he explains how the EPA has this whole thing completely backwards:

This year the Environmental Protection Agency submitted comments to the Copyright Office requesting that no exemptions should be granted for car owners or researchers to access and modify the software in their vehicles. The EPA says you shouldn’t be allowed to tinker with your car because it might increase emissions from your tailpipe.

This would block any researcher who would study software in automobiles to make them safer or more environmentally friendly. This summer, security researchers demonstrated that a hacker could take over a Jeep’s systems—GPS, transmission and brakes, among others—over the Internet. This could lead to crashes and even sabotage. In this case at least, Chrysler recalled 1.4 million vehicles to patch that vulnerability, which otherwise could have gone unnoticed.

The obstacle thrown up against access to copyrighted software makes it more difficult for researchers and engineers to find similar problems in the future. Volkswagen’s falsified emissions reports were discovered by independent testing—yet the source of the problem was in the automobile’s software. Independent researchers might have found the problem sooner if not for the threat of lawsuits brought by the company under the DMCA.

In short, while the EPA is worried about individuals potentially violating the Clean Air Act or other regulations, it should be worried about the companies that are actually doing so.

And it's not just the EPA. As Wyden notes, the FDA is doing something similar, which may be even more dangerous:

The Food and Drug Administration also is getting in on the copyright game. It is telling the Copyright Office that modifying software in medical devices, and then providing them to patients without FDA approval, could put people in danger. But the distribution of untested devices is already illegal. Copyright law should not prevent researchers from taking a look at the software and thinking about how to make devices more effective and safer.

Wyden (along with Rep. Jared Polis) introduced a bill earlier this year to try to deal with this on a permanent basis, rather than through this ridiculous triennial review process. Of course, if the TPP is approved, it may be more difficult to actually make such a change.

But, really, the fact that the FDA and the EPA are making these arguments is a real sign of just how broken our copyright law is and how little many regulators understand innovation, technology and intellectual property. The EPA and the FDA come from a world of "permission-only innovation." They are both focused solely on setting up laws that "prevent bad stuff" usually through setting up testing regimes. But those regimes can be gamed -- and they don't seem to recognize that by allowing permissionless innovation to happen, it also opens up worlds of useful research and beneficial innovations, both of which could do a lot more to prevent the kinds of harm that the EPA and the FDA think they're preventing by opposing these exemptions.

There's a fundamental misunderstanding of the nature of innovation in this setup -- where regulators think that the unknown must be "dangerous" and should be prevented until proven okay. But, as history has shown, such a setup only opens up all sorts of games that the big knowledgeable players can use to dance around those regulations, and no real way for outsiders to call them on it (or to create better alternatives). Permissionless innovation is not just a slogan, it's incredibly effective -- and misusing copyright law to prevent it, out of the fear that something bad might possibly happen, without recognizing all the good that is much more likely to come from it, is really dangerous. We're only just learning that now because of what's finally come out in the news about VW, but getting rid of the stupid anti-circumvention clause in the DMCA would go a long way towards actually fixing this mess, rather than relying on bureaucrats whose defacto response is to say "don't do that."

Filed Under: 1201, anti-circumvention, copyright, copyright office, dmca, dmca 1201, emissions, epa, fda, innovation, library of congress, permissionless innovation, research, ron wyden, security