While the feds absolutely hate to reveal this kind of info, due to successful legal action by the ACLU, the Justice Department was forced to reveal information on how often they monitor electronic communications of Americans without a warrant -- using what's known as "pen register" and "trap and trace." This kind of surveillance isn't over the actual communications (that's left up to the NSA, apparently), but rather just the info on who contacted whom. For various reasons, such information is considered obtainable without needing a warrant. Not surprisingly, the data shows a rather massive increase in such surveillance by the Justice Department.
The numbers are quite incredible:
In fact, more people were subjected to pen register and trap and trace surveillance in the past two years than in the entire previous decade.
And yet, whenever anyone suggests that maybe, just maybe, there should be a little bit of oversight on these kinds of things to prevent abuse, law enforcement freaks out. Perhaps that's really because they know they're widely abusing the ability to spy on communications, and they don't want to have to admit it. The fact that it took a lawsuit just to get this information (which is required by law) to be released really says something about the state of surveillance by the federal government. And what it says is not good at all.
People are spying on you. All kinds of people. Law encorcement does it. The NSA does it. Schools are monitoring our children. But I'll tell you who is not spying on you: PC rental companies. Well, at least not anymore.
But they were spying on you before federal charges were brought against them. It turns out that seven rent to own PC companies were employing software that logged your keystrokes, retained your social media passwords, recorded your social security passwords, snapped photos of people having sex with web cams, and even allowed rental company employees to deploy a French tickler through the screen to rub people's naughty bits (fine, fine, I made that last one up).
The companies captured screenshots of confidential and personal information, logged keystrokes and took webcam pictures of people in their homes. Their aim was to track the computers belonging to costomers who were behind with their payments.
"An agreement to rent a computer doesn’t give a company license to access consumers’ private emails, bank account information, and medical records, or, even worse, webcam photos of people in the privacy of their own homes," says FTC chairman Jon Leibowitz. "The FTC orders today will put an end to their cyber spying."
Yes, thank God for the FTC, because if anyone is going to watch me have sex, it's going to be the neighbors (no, I will not close the window and draw the shades, damn it, I like the breeze!). My question is why the hell anyone, especially the company that made the spying software used, DesignerWare, thought this kind of intrusion was necessary to begin with. Hell, this isn't even the first time a rental company using this software has gotten into trouble over it. The rental companies said they needed the software to remotely shut down and wipe stolen machines, as well as to initiate a kill switch on customer's machines when they were behind in payments. Those both make sense to me. Where do we get the explanation for logging keystrokes and in any way using the web cam?
At least the FTC must have brought the hammer down for such a gross violation of privacy, right?
The rent-to-own companies are Aspen Way Enterprises, Watershed Development, Showplace, JAG Rents, Red Zone, B Stamper Enterprises and CALM Ventures. They've got off lightly, agreeing to stop using the data-collection software and to stop deceiving customers.
I'll have to keep this in mind the next time I break the law. Just agree not to do it again and everything is okay, apparently. In the meantime, anyone who is renting computers can avoid these companies.
Since the January raid of Megaupload, not a month seems to go by in which another massive error in procedures isn't revealed concerning how US and New Zealand law enforcement handled the whole process. And each time, the mistakes seem to get bigger and bigger. They had the wrong warrants. They mishandled evidence. They mishandled the extradition request. And today comes the big news. New Zealand's Prime Minister, John Key, revealed that the Government Communications Security Bureau (GCSB), the equivalent of the NSA in New Zealand, illegally intercepted communications regarding individuals in the Megaupload case and provided those details to law enforcement. Like the NSA, the GCSB is in charge of monitoring electric communications, but is not allowed to use those tools domestically, only on foreign communications. Key has now ordered an investigation.
Mr Key says the Crown has filed a memorandum in the High Court in the Megaupload case advising the Court and affected parties that the GCSB had acted unlawfully while assisting the Police to locate certain individuals subject to arrest warrants issued in the case. The Bureau had acquired communications in some instances without statutory authority.
After being informed about the matter by the Director of the GCSB on September 17, the Prime Minister referred the Bureau’s actions to the Inspector-General, Hon Paul Neazor. The Inspector-General is an independent statutory officer with the power to enquire into any matter related to a government intelligence agency’s compliance with the law.
Once again, like pretty much all of these "mishaps," this seems to suggest a rather cavalier attitude towards actually following proper procedures under the law to go after Dotcom and Megaupload. Throughout this whole process, it really does appear that law enforcement, under pressure from Hollywood, believed that Dotcom was such a criminal mastermind that they could skirt the law in all sorts of ways to try to shut him down. And each time these mishaps come to light, it just raises more and more questions about whether or not law enforcement really had any legitimate evidence or reasons to do what they did.
This is getting more ridiculous by the day. We've been covering how the NSA refuses to admit how many Americans are being spied upon via a secret interpretation of the FISA Amendments Act -- and how Congress' response is to pretend that as long as they stick their head in the sand, the NSA couldn't possibly be abusing the law. Rep. Dan Lungren literally said that he sees no reason to be worried because he hasn't seen any evidence that it's being used to spy on Americans. But that's only true if you are being willfully blind. The NSA has refused basic requests to reveal non-confidential info, ridiculously claiming it would violate the privacy of Americans to admit how many Americans were being spied upon. Meanwhile, Julian Sanchez's attempt to reveal some info via a Freedom of Information Act request is being stonewalled by the feds.
And yet Congress still wants to move forward. The House is planning to vote on extending the FISA Amendments Act in the next day or two, despite the fact that the vast majority of elected officials do not have the information on how the law is being interpreted and those who are in the know have hinted very, very, very strongly that it is being widely abused. Now, if Congress actually represented the public, it might try to stop this process and ask for some of the details. Instead, it seems to be focused on just re-upping support for this tool that has more or less enabled domestic spying on Americans.
After four years, you’d hope that some basic information or parameters of such a massive spying program would be divulged to the public, or at least your rank-and-file member of Congress, but they haven’t. Only a small handful of members have either personally attended classified briefings or have staff with high enough clearances to attend for them. Sen. Ron Wyden—who has been on the Senate Intelligence Committee for years—has even been stonewalled by the Obama administration for a year and a half in his attempts to learn basic information about the program, such as the number of Americans who have had their communications intercepted under the FAA.
Yet the House ambles on, ready to rubber stamp another five years of expansive surveillance that can pick up American communications without meaningful judicial oversight and without probable cause or any finding of wrongdoing. Instead of blind faith in the executive branch, every member of the House should demand that the administration publicly disclose the following before proceeding with reauthorization:
Copies of FISA court opinions interpreting our Fourth Amendment rights under the FAA, with redactions to protect sensitive information (the Department of Justice can write summaries of law if necessary);
A rough estimate of how many Americans are surveilled under the FAA every year;
A description of the rules that govern how American information picked up by FAA surveillance is protected.
Can you believe that 435 members of Congress who have sworn to uphold the Constitution are about to vote on a sweeping intelligence gathering law without this basic information?
If you find this worrisome (and you should), the ACLU has set up an an action page to contact your elected officials and ask them to do their jobs and find out the details before just rubber-stamping the extension of the FISA Amendments Act.
Last year, in writing about the US government's vindictive lawsuit against whistleblower and former NSA employee Thomas Drake, we also talked about William Binney -- another ex-NSA employee and whistleblower (who was also raided by the feds, though they failed to find anything they could pin on him in a lawsuit). Binney is the mathematical genius behind one of the key algorithms the NSA is using to track everyone. Here's what the New Yorker said about Binner over a year ago:
Binney expressed terrible remorse over the way some of his algorithms were used after 9/11. ThinThread, the "little program" that he invented to track enemies outside the U.S., "got twisted," and was used for both foreign and domestic spying: "I should apologize to the American people. It's violated everyone's rights. It can be used to eavesdrop on the whole world."
Now, the NY Times has something of a following, including a short documentary feature about Binney and his whistleblowing over the NSA's domestic spying. It's really worth watching as it very simply highlights how vast the domestic spying effort is, however powerful it can be -- and also how the NSA dances around the fact that it's not allowed to spy on Americans. They claim that as long as they're not actually looking at the content they record and store directly, it's just collecting the info and not actually spying on people. That is, they think that acquiring all this data is fine, so long as they don't directly query the info. But... as Binney explains, his algorithms (which have likely been updated quite a bit) can still go through all this info and build basic "profiles" of just about anyone. It's really worth watching, if only to wonder how anyone thinks this is acceptable.
I'd embed the video here, except the geniuses over at the NY Times seem to have not figured out how to allow embeds with their video player.
The documentary was put together by Laura Poitras, who notes that thanks to some over-aggressive surveillance she, too, is on a "watch-list," thanks to a documentary she did about Iraq.
I have been detained at the border more than 40 times. Once, in 2011, when I was stopped at John F. Kennedy International Airport in New York and asserted my First Amendment right not to answer questions about my work, the border agent replied, “If you don’t answer our questions, we’ll find our answers on your electronics.”’ As a filmmaker and journalist entrusted to protect the people who share information with me, it is becoming increasingly difficult for me to work in the United States. Although I take every effort to secure my material, I know the N.S.A. has technical abilities that are nearly impossible to defend against if you are targeted.
All of this attention, by the way, is to question why Congress is so intent on re-authorizing the FISA Amendments Act (FAA) which is what gives the NSA a pass on much of this spying, thanks to a "secret interpretation" of the law, which the public is not allowed to even know about. If this sounds like the sort of thing that shouldn't be allowed in a free and open society, you're just beginning to grasp the problem.
You may remember that almost exactly a decade ago, the news leaked that key Iran-Contra political operative John Poindexter, still working for the US government, had been working with the NSA to create a system called Total Information Awareness or TIA. The news quickly went viral, with people (quite reasonably) worried about the government snooping on their private data. Suddenly everyone was against this program, Poindexter was soon out of a job, and the TIA was officially put on the shelf. Except... that's not quite what happened. As you should be aware by now, the NSA has been Hoovering up pretty much every bit of data it can, sometimes using confusing loopholes or legal changes to make it possible.
What’s missing, however, is a reliable way of keeping track of who sees what, and who watches whom. After T.I.A. was officially shut down in 2003, the N.S.A. adopted many of Mr. Poindexter’s ideas except for two: an application that would “anonymize” data, so that information could be linked to a person only through a court order; and a set of audit logs, which would keep track of whether innocent Americans’ communications were getting caught in a digital net.
And let's not even waste time discussing how the NSA actually had a much cheaper program that actually did have safeguards, because the guy who exposed the world to that almost end up in jail for a few decades.
Of course, the bigger issue here is that in gathering pretty much everything they can, actually making sense of the data is becoming more and more difficult:
The N.S.A. came up with more dead ends than viable leads and put a premium on collecting information rather than making sense of it.
Of course, that doesn't mean people's privacy isn't being violated (something even the NSA itself will admit when forced -- though it still refuses to say how many Americans are having their privacy violated). So the end result is that the NSA is collecting all of this data, violating people's privacy (and, most likely, the 4th Amendment). And, out of that they're turning up very little in the way of useful leads.
That's not exactly a compelling pitch.
But, as the NYT piece notes, even though the NSA built a system more powerful and privacy invading, and less effective (and probably more costly) than the original, much decried, Total Information Awareness program, very few people seem to be raising the alarm or particularly concerned about it. Apparently, the NSA has learned the best secret of all. If you don't actually name the program something creepy and Big Brotherish, and don't have a conspiracy-theory-inspired logo to go with it, you can get away with all sorts of stuff.
There. Now don't you feel safer knowing that your tax dollars are funding this kind of thing?
We've written many times about the FISA Amendments Act (FAA), of which there is a secret interpretation that certainly appears to allow the NSA to spy on all sorts of email communications without a warrant -- something that is not at all obvious upfront (and, in fact, which many in Congress apparently do not know about). While Senators Wyden and Udall have been working hard to try to force the government to reveal either the secret interpretation or how many Americans have been spied on, the rest of Congress appears to not want to know, while rubber stamping the renewals to let the effort continue.
There have been some questions about how all of this came about, and just why law enforcement officials keep insisting the FAA is so vital. Julian Sanchez may have worked out some key details, and provides a very compelling explanation. Seven years ago, the Supreme Court ruled in the Brand X case (the same day the Grokster ruling came out), basically saying that cable networks did not qualify for "common carrier" status, because they were "information services" rather than telco services. The direct end result was that broadband providers no longer had to share lines with service providers. But, as Sanchez notes, there may have been an unrelated indirect impact: by removing the common carrier designation, the NSA may have lost its legal authority to "tap" live communications on such networks without a warrant. Sanchez explains the nitty gritty:
“If FISA’s reference to ‘common carrier’ were interpreted in accord with the Communications Act,” Kris and Wilson explain, explicitly citing the Brand X decision, “information (such as e-mail) being carried on a cable owned and offered by a cable modem service provider would not be a ‘wire communication’ under FISA, and acquisition of such information would not be ‘electronic surveillance’ under” the definition that applies to traditional phone calls.
Sanchez provides a lot more detail, which is worth reading in full, because it's quite complex. However, it suggests that the Bush administration's focus on "deregulating" cable may have undercut the NSA's "spy on everyone" program through a simple definition change. The FAA, then, was put in place (partly) to once again enable the NSA to get access to a bunch of live communications legally, whereas it's quite possible that the FISA court had found, in light of Brand X, that the efforts had been against the law. Now, you can argue that the change due to the Brand X decision is no big deal, because it was just clarifying some rules, and dealing with antiquated language in the statute. But, again, since so much of this happened in secret, if Sanchez's story is accurate, it more or less allowed the government to write very broad rules, such as those now allowing such broad surveillance.
So the FISA Amendments Act allows the government to target foreigners and capture conversations with Americans — with no warrant required, so long as they aren’t actually trying to wiretap the American via a technical loophole.
But if the government’s problem is an inability to reliably determine the location of parties to a communication, it’s not clear why we should be confident that interception under this broad new authority can reliably avoid acquiring many purely domestic communications. Even if it can, blanket authority to acquire the international communications of Americans — with no requirement that the foreign side of the conversation be suspected of any connection to terrorism or espionage‹seems like an incredibly broad way of addressing the issue.
Perhaps Kris and Wilson are correct that a narrower solution to the problem would have been unworkable. On the other hand, perhaps legislators would have tried a bit harder to craft a viable narrow solution if they, and the general public, had clearly understood exactly what the problem was.
Sanchez goes on to point out that if this story is accurate, and if the FISA court had basically upended the feds' spying program becuase of some definitional issues, a more reasonable and transparent approach would simply be to work together with lawmakers and civil liberties experts to actually focus in on the specific problem. Instead, it appears they may have used this loophole to massively expand spying capabilities, with no public oversight at all.
We just wrote about yet another (in a long line) of manufactured terrorist plots, in which the FBI creates its own terrorist plot to arrest anyone who can be coaxed into going along for the ride, even if they had no interest or ability to push the plot forward on their own. In that case, it was even more ridiculous, because they couldn't even find anyone willing to go along with the plot -- and the main "suspect" actually alerted the FBI to the informant who was trying to coax him into taking part in a plot (which didn't stop him from being arrested, even if the case was eventually dropped).
Of course, the FBI is not alone in its incredibly ham-fisted anti-terrorism efforts in which the focus seems to be much more about someone's religious leanings, rather than any actual interest in creating terror. The NY Police Department got plenty of attention for deciding to build their own local versions of the FBI and CIA to try to catch terrorists. That link describes the NYPD as a sort of new "elite" intelligence agency, hiring people out of other intelligence agencies and then placing agents around the globe to try to beat the FBI and CIA at their own game.
Back at home, apparently this included following on the FBI's tactic of assuming that "brown skin = terrorist." As such, they've spent the past few years spying on "Muslim neighbrhoods" throughout New York (with help from the CIA), sending undercover agents and informants into Muslim groups and organizations:
The Demographics Unit is at the heart of a police spying program, built with help from the CIA, which assembled databases on where Muslims lived, shopped, worked and prayed. Police infiltrated Muslim student groups, put informants in mosques, monitored sermons and catalogued every Muslim in New York who adopted new, Americanized surnames.
Police hoped the Demographics Unit would serve as an early warning system for terrorism. And if police ever got a tip about, say, an Afghan terrorist in the city, they'd know where he was likely to rent a room, buy groceries and watch sports.
I know this is a crazy thought, but perhaps violating the privacy of tons of people just because of the color of their skin or their religion, isn't the best (or even "a") way to stop terrorists.
Wired has a troubling story of how the Senate Armed Services Committee is pushing a bill that would likely kill off an open source NoSQL project that came out of the NSA called Accumulo. Like many other such NoSQL efforts, the NSA basically took some Google white papers about its BigTable distributed database setup, and built its own open source version, with a few improvements... and then open sourced the whole thing and put it under the Apache Foundation. It's kind of rare to see such a secretive agency like the NSA open source anything, but it does seem like the kind of thing that ought to be encouraged.
Unfortunately, the Senate Armed Services Committee sees things very differently. As part of a 600-page bill that's being floated, it actually calls out Accumulo by name, and suggests that it violates a policy that says the government shouldn't build its own software when there are other competing commercial offerings on the market. The reasoning is basically that the government shouldn't spend resources reinventing the wheel if it can spend fewer resources using existing code. You can see the basic reasoning behind that, but applying it here makes little sense. As the article notes, here we're talking about software that's already been developed and released -- not a new effort to rebuild existing software. In fact, those who follow this stuff closely note that Accumulo did "break new ground" with some of its features when it was being built. To then kill it afterwards seems not just counterproductive, but could also create a chilling effect for government open source efforts, which seem like something we should be encouraging, not killing.
What's really odd is the close interest that the Senate seems to be paying to this. The discussion is very specific, naming Accumulo and some of the competing offerings on the market. They're specifically calling out this one product. Of course, as Julian Sanchez notes, there's a bit of irony in the fact that the very same Senate appears to have absolutely no interest in finding out how often the NSA spies on Americans... but sure is concerned about what database it uses to store all of the information it's getting.
Of course... all of this raises a separate issue in my mind: can the NSA even open source Accumulo? I though that creations of the federal government were automatically public domain, rather than under copyright. And, thus, putting it under a specific license might, in fact, present limitations that the government can't actually impose on the software.... Thus, shouldn't the software code actually be completely open as a public domain project? The government should be able set up an Apache-like setup, but one without any restrictions on the code.
The American Enterprise Institute (AEI) recently held an event about cybersecurity and cybersecurity legislation. The keynote speech was from NSA boss General Keith Alexander. He of course talked about why he supports cybersecurity legislation, such as CISPA and other proposals that will make it easier for the NSA access private content from service providers -- much of which, reports claim, they're already capturing and storing. Alexander has claimed that the NSA doesn't have "the ability" to spy on American emails and such, and reiterates that claim during the Q&A in this session, insisting that the Utah data center doesn't hold data on Americans' emails (and makes a joke about just how many emails that would be to read). That's nice for him to say, but so many people with knowledge of the situation claim the opposite.
In a motion filed today, the three former intelligence analysts confirm that the NSA has, or is in the process of obtaining, the capability to seize and store most electronic communications passing through its U.S. intercept centers, such as the "secret room" at the AT&T facility in San Francisco first disclosed by retired AT&T technician Mark Klein in early 2006.
So it's interesting to pay attention to what Alexander has to say in pushing for cybersecurity legislation. You can watch the full video below, if you'd like:
Much of what he talks about online involves basic malware and hack attacks. These are definitely issues -- but are they issues that we need the military (which the NSA is a part of) to step in on? His "quote" line is that these attacks represent the "greatest transfer of wealth in history." That is a pretty broad statement, and there's almost no evidence to support it. He points to studies from Symantec and McAfee on the "costs" of dealing with security issues -- but remember, those are two of the biggest sellers of security software, and have every incentive in the world to inflate the so-called "costs." Also, seriously? The "greatest transfer of wealth in history"? Has he paid absolutely no attention to what's happened on Wall Street and the financial world over the past decade? Does anyone honestly believe that the amount of money "transferred" due to hack attacks is greater than the amount of money transferred due to dodgy financial deals and the mortgage/CDO mess? That doesn't pass the laugh test.
He does insist that worse attacks are coming, but provides no basis for that (or, again, why the NSA needs your info). In fact, according to a much more believable study, the real risks are not outside threats and hackers, but internal security screwups and disgruntled inside employees. None of that requires NSA help. At all.
But it sure makes for a convenient bogeyman to get new laws that take away privacy rights.
Alexander, recognizing the civil liberties audience he was talking to, admits that the NSA neither needs nor wants most personal info, such as emails, and repeatedly states that they need to protect civil liberties (though, in the section quoted below, you can also interpret his words to actually mean they don't care about civil liberties -- but that's almost certainly a misstatement on his part):
One of the things that we have to have then [in cybersecurity legislation], is if the critical infrastructure community is being attacked by something, we need them to tell us... at network speed. It doesn't require the government to read their mail -- or your mail -- to do that. It requires them -- the internet service provider or that company -- to tell us that that type of event is going on at this time. And it has to be at network speed if you're going to stop it.
It's like a missile, coming in to the United States.... there are two things you can do. We can take the "snail mail" approach and say "I saw a missile going overhead, looks like it's headed your way" and put a letter in the mail and say, "how'd that turn out?" Now, cyber is at the speed of light. I'm just saying that perhaps we ought to go a little faster. We probably don't want to use snail mail. Maybe we could do this in real time. And come up with a construct that you and the American people know that we're not looking at civil liberties and privacy, but we're actually trying to figure out when the nation is under attack and what we need to do about it.
Nice thing about cyber is that everything you do in cyber, you can audit. With 100% reliability. Seems to be there's a great approach there.
Now all that's interesting, because if that's true, then why is he supporting legislation that would override any privacy rules that protect such info? If he really only needs limited information sharing, then why isn't he in favor of more limited legislation that includes specific privacy protections for that kind of information? He goes back to insisting they don't care about this info later on in the talk, but never explains why he doesn't support legislation that continues to protect the privacy of such things:
The key thing in information sharing that gets, I think, misunderstood, is that when we talk about information sharing, we're not talking about taking our personal emails and giving those to the government.
So make that explicit. Rather than supporting cybersecurity legislation that wipes out all privacy protections why not highlight what kind of information sharing is blocked right now and why it's blocked? Is it because of ECPA regulations? Something else? What's the specific problem? Talking about bogeymen hackers and malicious actors makes for a good Hollywood script, but there's little evidence to support the idea that it's a real threat here -- and in response, Alexander is asking us all to basically wipe out all such privacy protections... because he insists that the NSA doesn't want that kind of info. And, oh yeah, this comes at the same time that three separate whistleblowers -- former NSA employees -- claim that the NSA is getting exactly that info already.
So, this speech is difficult to square up with that reality. If he really believes what he's saying, then why not (1) clearly identify the current regulatory hurdles to information sharing, (2) support legislation that merely amends those regulations and is limited to just those regulations and (3) support much broader privacy protections for the personal info that he insists isn't needed? It seems like a pretty straightforward question... though one I doubt we'll get an answer to. Ever. At least not before cybersecurity legislation gets passed.
