WikiLeaks Reveals Aaron Swartz May Have Been A Source: Wise Move?

from the question-of-trust dept

WikiLeaks currently finds itself in a difficult position. Funds are trickling in because of a questionable financial blockade against it, and Julian Assange is stuck in the Ecuadorian embassy in London. So it's understandable that it should want to take every opportunity to remind people that it is still around and keen to continue publishing highly-sensitive documents in a confidential fashion. But I do wonder if this series of tweets disclosing that Aaron Swartz was involved with WikiLeaks is the best way of doing that:

Due to the investigation into the Secret Service involvement with #AaronSwartz we have decided to disclose the following facts (1-3)

1. Aaron Swartz assisted WikiLeaks #aaronswartz (1/3)

2. Aaron Swartz was in communication with Julian Assange, including during 2010 and 2011

3. We have strong reasons to believe, but cannot prove, that Aaron Swartz was a WikiLeaks source. #aaronswartz

There are a number of issues here. First, WikiLeaks is revealing the name of one of its sources -- surely something it should never do under any circumstances if it wants to retain the confidence of future whistleblowers. Worse, it's not even sure Aaron Swartz was a contributor, but is making the claim anyway. That matters because it may encourage the US authorities to start investigating others in his circle as possible WikiLeaks contributors. At best, that could be awkward for them, and at worst, extremely dangerous given what has happened to the alleged WikiLeaks source Bradley Manning.

It's hard to see what WikiLeaks thought it would gain from making these statements, other than some quick publicity, perhaps. But that seems a very transient gain in the face of the long-term dangers it may have exposed others to. Moreover, those four tweets may also have compromised its credibility with potential sources, who must now be asking themselves whether WikiLeaks can really be trusted again.

Follow me @glynmoody on Twitter or identi.ca, and on Google+

Filed Under: aaron swartz, anonymity, credibility, source, wikileaks

Court Blocks Controversial California Bill That Takes Away All Anonymity For Any Sex Offenders

from the getting-beyond-the-moral-panic dept

Back in the fall, we worried about proposed legislation in California designed to deal with "sex offenders" online. As we noted, the bill would almost inevitably pass -- as it did -- because most people think that increased punishment for sex offenders makes sense. But there are serious issues with the bill if you don't know the details. First, many "sex offenders" aren't what you might think of as "sex offenders" -- people who are arrested for things like urinating in public, or for consensual sex between minors. Beyond that, this particular bill went really, really far, requiring all such "offenders" to hand over all details of every online service they used -- no matter what the purpose. As the EFF noted at the time, this could have tremendous chilling effects on speech:

Proposition 35 would force individuals to provide law enforcement with information about online accounts that are wholly unrelated to criminal activity – such as political discussion groups, book review sites, or blogs. In today's online world, users may set up accounts on websites to communicate with family members, discuss medical conditions, participate in political advocacy, or even listen to Internet radio. An individual on the registered sex offender list would be forced to report each of these accounts to law enforcement within 24 hours of setting it up – or find themselves in jail. This will have a powerful chilling effect on free speech rights of tens of thousands of Californians.

Basically, no more anonymity, if you happen to be on the list.

This seemed way over-broad, but it still passed with 81% of the public vote. The EFF and the ACLU quickly got a temporary injunction. Thankfully, now, the judge has gone slightly further with a preliminary injunction, noting that it clearly goes way too far, and suggesting that the bill is unlikely to be found Constitutional:

The challenged provisions have some nexus with the government's legitimate purpose of combating online sex offenses and human trafficking, but the government may not regulate expression in such a manner that a substantial portion of the burden on speech does not serve to advance its goals.

Stopping sex offenders is a noble and worthy goal. But willy nilly removal of anonymity across the board, with no exploration into the reasonableness of the situation, or the actual offense, goes way too far in taking away someone's rights, while doing little to nothing to actually keep anyone protected.

Filed Under: anonymity, california, sex offenders

Interview With Author Of 'Hacking The Future'; Techdirt Book Club

from the join-us dept

Today at 1pm PT (4pm ET), we'll be doing a live streaming interview with Cole Stryker, the author of Hacking the Future: Privacy, Identity, and Anonymity on the Web. We've run a couple of excerpts from the book -- one about why anonymity matters, that many of you agreed with, and another about the dark web, which many of you did not agree with. Given that, it should be a fun discussion. If all goes according to plan (never a sure thing when you deal with technology), right around 1pm, we should have a video pop up beneath this text, so check back... If you happen to be reading this after, the full video will be immediately available for viewing.

Filed Under: anonymity, book club, cole stryker, hacking the future, internet

California Ballot Measure Will Likely Ban Anonymous Speech If You Were Arrested For Urinating In Public

from the that's-not-constitutional dept

Here in California, of course, we have a number of (often excessively confusing) ballot measures every election season, and this year is no exception. I've spent a fair amount of time going through the various ballot measures myself in determining how I'd vote on them, and it quickly becomes clear that -- as with so much in government -- the devil is in the details, and the details are often hidden or purposely shoved aside. Take, for example, ballot measure 35. The "summary" version of it sounds like something that many would support:

Increases prison sentences and fines for human trafficking convictions. Requires convicted human traffickers to register as sex offenders. Requires registered sex offenders to disclose Internet activities and identities. Fiscal Impact: Costs of a few million dollars annually to state and local governments for addressing human trafficking offenses. Potential increased annual fine revenue of a similar amount, dedicated primarily for human trafficking victims.

Human trafficking is certainly a big concern. However, there are a lot of details here. That "disclose Internet activities and identities" part is already a concern. And, many of us have heard the horror stories of how states put all sorts of people on "sex offenders" lists for things that aren't sex offenses -- things like urinating in public or (perhaps slightly more controversial) two teenagers engaging in consensual sexual activity.

It turns out that the internet stuff in this bill is massively problematic. Unfortunately, some "voter guides" completely ignore the issue. A popular California voting guide from KCET barely mentions the internet part of the measure, and positions it as something of a no-brainer to support. But, if you look at the details, they're pretty scary:

Proposition 35 would force individuals to provide law enforcement with information about online accounts that are wholly unrelated to criminal activity – such as political discussion groups, book review sites, or blogs. In today’s online world, users may set up accounts on websites to communicate with family members, discuss medical conditions, participate in political advocacy, or even listen to Internet radio. An individual on the registered sex offender list would be forced to report each of these accounts to law enforcement within 24 hours of setting it up – or find themselves in jail. This will have a powerful chilling effect on free speech rights of tens of thousands of Californians.

While Proposition 35 facilitates government monitoring of certain online accounts, it doesn’t add safeguards for civil liberties or privacy. The proposition leaves unclear who will be tasked with reviewing these lists of online accounts for accuracy and completeness, and there are few limits on how the data could be used. There is substantial risk that law enforcement will subject these accounts to additional monitoring, and that officials might turn these lists of accounts over to ISPs or popular web services and solicit the assistance of these intermediaries in monitoring users’ online behavior. For example, if an individual on the registered sex offender list participates in an online political forum, will law enforcement actively monitor these discussion groups? Will other individuals on that forum face increased scrutiny because one of the forum members is on the registry? There are also risks to online accounts that are shared between household members – such as joint Netflix accounts – which will be subject to the same rules of reporting to the police, thus implicating the data of individuals who have committed no crime other than sharing an account with someone on the registry.

The LA Times posted a forceful editorial against the provision, noting that it's all about punching emotional buttons rather than a legitimate law enforcement issue:

It punches most of the usual emotional buttons, appealing to voters' sympathy for victims and disgust with perpetrators who are the closest thing the United States has to modern-day slavers. And in calling for longer sentences, it follows the same assumptions as other tough-on-crime initiatives born in fear or anger rather than thought: Punish people more severely and they will offend less. Merely by being on the ballot, the measure implies that the Legislature would not or could not deal with the issue.

That's false. Lawmakers became convinced in 2005 that state and federal laws dealing with kidnapping, extortion and other crimes were not keeping up with human trafficking, and they adopted a law that was painstakingly crafted with input from law enforcement, victims, advocates and others. That law has been fine-tuned more than a dozen times over the last seven years as experience was gained, people were prosecuted and legal holes were discovered and plugged. Proposition 35 would subvert that work and substitute a web of poorly drafted laws that expand the sex offender registry, divert resources from victims and, most important, could not be adjusted to keep up with changing circumstances without yet another ballot measure.

The ACLU has stepped up and tried to remind people that it's likely unconstitutional in that it removes the right to speak anonymously over issues completely unrelated to any crime:

The Supreme Court has long held that the First Amendment protects the right to speak anonymously. The initiative infringes on that right of registrants to speak anonymously on the Internet, because it means a person who is convicted decades ago of a relatively minor sex offense, such as indecent exposure, or a crime that has absolutely nothing to do with either children or the use of the Internet, must now inform the police of any name he or she uses in any sort of online discussion group.

Unfortunately, because this is an emotional issue, it's likely going to pass, and then there's going to be a huge mess as it's put into practice, followed almost certainly by lawsuits challenging the constitutionality of the provision. Emotionally driven issues tend to make bad law, and it seems like this is no exception.

Filed Under: anonymity, california, free speech, human trafficking, sex offenders, social media

Navigating The Deep, Dark Web

from the dig-in dept

We recently ran an excerpt from Cole Stryker's new book, Hacking the Future about the importance of anonymity. Here's the second excerpt from this book, our latest book club selection. This time it's about navigating parts of the web that not everyone knows about... We'll be hosting a chat with Stryker in the near future, to be announced soon.

I first heard whispers of the deep Web on 4chan. It was often positioned by active users as a place where even the most hardened /b/tard (a nickname for heavy users who hang out on 4chan's "random" board a lot) can find things to shock the system. The deep Web is depicted there as the submerged portion of an iceberg. The Web that we know is the tip, and the massive portion underwater is the deep Web.

"I've just come back from the deep Web," they say, "and look what I found." They share ghastly images and stories, perpetuating the legend of this vast underbelly among underbellies. In these conversations I was led to believe that the deep Web—also called the invisible Web, the darknet, undernet, and several other sinister-sounding names—was home to the sort of content that would get you thrown in jail if it were ever traced back to you. This is true, to an extent, but technically the deep Web comprises anything that isn't crawlable by major search engines like Google. This can mean dynamic URLs that have a long string of parameters that might confuse spiders (the software that "crawls" Web sites to index them for search). Any content that's behind a pay wall or other password authentication is technically included in the deep Web. This would include your e-mail or a pay-to-view newspaper Web site. Any content that lies behind a form, like a survey or poll, often can't be crawled. Some sites purposefully exclude spiders using robots.txt, a file that tells spiders to steer clear of certain Web pages for various legitimate, legal reasons. Pages that are made up of flash content obviously can't be crawled because there's no raw text on the page. So to say that the deep Web is the seedy back alley of the Internet is not entirely accurate.

However, there are parts of the deep Web, accessible only with the use of certain anonymizing software, where baddies sometimes hang out. The deep Web is rife with readily available child pornography, terrorist rhetoric, drug and sex trade—all manner of taboo and hateful communication.

One such piece of anonymizing software is called the Onion Router, or Tor, briefly mentioned earlier. Tor reroutes communications coming from your computer around the world across a distributed network of volunteer-run nodes that make up the Tor Network. Tor passes users' traffic through three servers before sending it along to its destination. The network was originally sponsored by the U.S. Office of Naval Research to help military agents abroad bypass firewalls and other "censorware" in countries like China. For this reason, some speculate that the service is routinely monitored by the U.S. government and cannot be trusted.

Technically, Tor is not an anonymizing service so much as an obfuscating one. Tor alone can't keep anyone anonymous; it's merely one item in the smart anon's tool belt. Tor works to anonymize your Internet connection, but can also be applied to specific programs. The most popular program used in tandem with Tor is the Internet browser. The Tor team has built a Firefox extension that applies several "onion-like" layers of obfuscation to data communicated through Firefox. Because Tor routes your traffic around the world, it's not very fast. The more people volunteer to contribute their machines as nodes, the faster Tor will get.

I thought I'd check it out for myself. I downloaded the Tor software, ran the executable file, and installed the software. When I ran the program, within seconds a browser window opened saying, "Congratulations. Your browser is configured to use Tor. Please refer to the Tor Web site for further information about using Tor safely. You are now free to browse the Internet anonymously." I typed in a URL I found on 4chan for an underground deep Web portal called Hidden Wiki, waited about thirty seconds (an eternity in the era of Wideband and FIOS), and a blank page popped up, reading "Looking for Hidden Wiki?" The last two words were blue, indicating a hyperlink, so I clicked it, and up popped a page that looked just like Wikipedia. A sidebar listed the categories that are available to browse: blogs, books, political advocacy, but also drugs and underage erotica. I clicked on a link called "Killer for Hire."

This can't possibly be for real, can it?

You can call me Slate. All you need to know is that I am well trained and can perform what you need done. I do not need to know your situation with the hit and prefer not to. I’m hired when you want to make sure that the hit doesn’t get traced back to you.

• Minimum age for hit is 18.
• I do not care of the gender of the hit.
• I do not kill pregnant women.
• I do not torture the target.
• If hit is a political figure, or is in law enforcement (judges, policemen) there will be an additional fee.
• For an additional fee, I can set it up as a “suicide” or an “accident”
• Hit will take place within 4 weeks.
• Hits outside of the continental US will require an additional 2 weeks of logistics and $5000 in travel fees.
• Once the hit has been made I will message you with a picture or a video and the remaining balance must be paid in full.

A second hit-man site sounds like a Hollywood Russian mafioso wrote it. "It is mutual interest to make everything anonymously," he warns, insisting, "it is not a joke." He gives careful instructions on how to pay through Bitcoins (more on this soon) and reiterates the need for total anonymity on both sides of the transaction. "I don't know you and you don't know me." If these sites are jokes, they are convincingly conceived. Moving on from the hit men, there are firearm salesmen, hackers for hire ("destroy your enemies!"), an extensive list of Bitcoin traders, illegal gambling sites, white supremacist blogs, whistle-blowing blogs, new world order conspiracy chat rooms, transnational activists, Anonymous operation forums, hacker/phreaker communities, and porn. Oh, the porn. Genital mutilation, necrophilia, zoophilia, watersports, etc. Anything you can imagine is at your fingertips. Which brings us to child pornography. I don't have the guts or inclination to click through to any of these sites, but they're there. And according to people hanging out on 4chan, the stuff available from the Hidden Wiki is only a shallow fraction of what's out there were one prone to dig deeper.

Perhaps the most notorious site available through Tor is the Silk Road, a black market where users can find 340 different illegal drugs: weed, cocaine, heroin—a digital bazaar of pills, tabs, and powders. If I wanted, I could easily order up a smorgasbord of illicit substances and have it delivered within a few days. You have to pay a Bitcoin just to browse the site—its inaccessibility keeps out most looky-loos. The site doesn't have everything, of course. You won't find any chemicals that are easily weaponized. Sellers promote their wares through a reputation system that isn't much different from the one popularized by eBay. The site only accepts Bitcoins, which, along with mandatory Tor usage, help to ensure the anonymity of buyers and sellers. The Silk Road is one of many hubs for black-market drug trade on the deep Web. It's difficult to tell if the DEA (Drug Enforcement Administration) is going to crack down on this sort of thing, or if we're peering into the future. Anonymizing applications and efforts to pierce such software seem to be progressing apace.

Freenet is another piece of software used to mask identity online. It's been downloaded over 2 million times. Freenet's creator, Ian Clarke, is concerned about the freedom to communicate. He grew up in the south of Ireland in the ‘80s in a family of Protestants, whom he says are fastidious about staying out of Irish politics. From a young age he was interested in understanding people who held different views.

I remember reading [Sinn Féin' leader] Gerry Adams's autobiography at a time when most people considered him a terrorist. I can remember that if he was interviewed on TV they had to use an actor to do a voiceover, because it was illegal to broadcast his actual voice. It wasn't that I agreed with Gerry Adams' beliefs or actions, but I did feel that it was far more productive to understand where people are coming from, to try to step into their shoes, rather than simply demonizing them, which was official government policy at that time. It left me with a strong sense of the futility of censorship, and the value of free communication.

My experience with Freenet's "Linkageddon," one of several directories, is similar to that of Tor's Hidden Wiki. Some of it is innocuous (Bob Chapman's Financial Analysis), some of it funny (Anti–Harry Potter fundamentalists), and some of it horrific (ubiquitous underage porn). Everything looks like an old Geocities page.

Clarke describes Freenet like a decentralized postal system, where people carry each other's mail. For instance, you need to get a letter to your friend Bob in Boston, and your friend Diane is going to Boston for a business trip. You give Diane your letter and have her hand off the letter to James, who happens to live in Bob's neighborhood. The system is decentralized and doesn't rely on any one person more than the others. If Bob can't deliver your letter, you might ask Cheryl, who will be passing through Boston as well. The advantages to this system are such that James doesn't have to know who's sending the letter, and there's no central postal hub that can restrict the delivery of mail through censorship or incapacity. According to research by Freedom House, Freenet is one of the most popular anonymity systems used in China. This was no accident. Clarke says that he intended for the software to be used by activists.

Filed Under: anonymity, dark web, encryption, tor

Hacking The Future: Anonymity Matters

from the read-up dept

Next Wednesdy, at 11am PT/2pm ET, we'll be hosting our talk with Chris Sprigman and Kal Raustiala about their book, The Knockoff Economy, which was our September book of the month (excerpt one and excerpt two). We also wanted to get moving on October's book of the month, Hacking the Future: Privacy, Identity, and Anonymity on the Web, by Cole Stryker. Here's the first excerpt we'll be running, from the intro of the book.

I think anonymity on the Internet has to go away. People behave a lot better when they have their real names down... I think people hide behind anonymity and they feel like they can say whatever they want behind closed doors.

In July 2011, Randi Zuckerberg, then marketing director of Facebook, uttered the words above during a panel discussion hosted by Marie Claire magazine. She couldn't have anticipated the firestorm those few words would generate among those already uncomfortable with the direction the Web had taken in the preceding year.

Two years prior, Google CEO Eric Schmidt, in an interview with CNBC's Maria Bartiromo, gave the downright schoolmarmish advice, "If you have something that you don't want anyone to know, maybe you shouldn't be doing it in the first place." Schmidt, who once led an antitrust crusade against Microsoft, has claimed that Google will avoid Microsoft's missteps because the search giant faces compelling incentives to please a customer base that will seek services elsewhere the moment Google does anything shady. But what if Google's been tracking your search results for your entire life? Google, just one of dozens of companies that mines user data, knows your favorite foods, your sexual proclivities, and your medical history, to say nothing of the personal information they host in the form of e-mails and other documents. Would it be as simple as just walking away?

Before the Internet Age, computers were perceived by the public as unfeeling, literally calculating metal boxes that just might help bring about a nuclear apocalypse. As machines go, they were just as cold as their industrial-era forebears, if not more so--at least you can watch the parts move on a steam engine. At least you knew it wasn't somehow plotting against you. It wasn't so long ago that computers were seen as a dehumanizing tool of a dystopic new technocracy, imbued with the fear and existential despair brought by the Cold War's lingering sense of impending doom.

But then something changed. Today we see computers (we don't even really call them that anymore, they're mobiles or laptops or something that sounds friendlier) as being vital, almost countercultural gadgets that bring empowered individualism, collaborative communities, and, depending on whom you ask, an almost spiritual enlightenment. They're sleek and sexy. They're our salvation from a world of physical limitations and disparities. Computers help us learn, work, and connect--Facebook now claims 850 million members, a figure that eclipses the number of people who were online in 2004. Pop stars interface with tween girls on devices with names like "Razr Maxx." How did we get here? How did these calculators, manipulated by flat-topped military brainiacs in austere labs, become something so integral to the human experience that to call them an extension of the self hardly seems like an overstatement?

Surely part of the answer is technological. We all know the first computers filled entire rooms in order to accomplish the computational tasks that you can now do (gee whiz!) in the palm of your hand. Another part of the transformation has to do with design evolution of machines. An iPad is certainly much sexier than bland, beige computers that existed even a decade ago.

But more than style, cost, and convenience, more than any other factor, the simple act of linking one computer to another brought about a new stage of human social evolution, the most rapid and far-reaching in human history with the possible exception of the printing press. And it happened because a bunch of geeks in California, Massachusetts, and elsewhere in the country picked up where the military-industrial complex left off after the Cold War.

The Internet could have never been born of state decree. It's too dangerous. It's too difficult to monitor and control. It's far too unwieldy. No, something so decentralized, open, and free could only have been conceived in an environment embodying those characteristics. The military had designed a decentralized computer network equipped with routing and packet switching because they wanted the system to survive if one of its nodes was located in a city that was nuked. This open platform enabled geeks to tinker in their basements and surreptitiously fiddle with pay phones while they made fascinating new discoveries about how communications systems worked, and how they could overcome the restrictions around those systems.

Throughout the '80s we saw something truly magical, the formation of the first ad hoc virtual communities--Bulletin Board Systems. It wasn't cheap, but with the right tools and know-how, anyone could set up a BBS and start up a little nation-state that played by his rules, and if the members of the BBS didn't like it, they could go somewhere else, or start their own. It was an opportunity for people to become "as gods," in the words of Web pioneer Stewart Brand, in control of their own identities, and thus their destinies, like never before. You could be gay on the Internet and nobody could do a thing about it. You could pretend you were a cat. You could be a prince online, whether rich or poor in reality. Now we're getting to the crux of it.

Computer technology has changed many things, but the most profound has been the ability to empower individuals to redefine themselves in a social environment, to hack into their personhood, their identity, and truly become who they want to be. It doesn't matter if you're ugly or physically disabled--no one needs to know. And that freedom is contingent on the ability of Web users to take control of their identities--to be as anonymous or pseudonymous as they want to be.

At least, that was how it was supposed to work.

As the Web has developed since the '80s, it's become more lucrative for people who want to sell you things. And it follows that it's become more lucrative to become the kind of politician who pushes for regulation of the Internet so that people who want to sell you things can do so more efficiently. Meanwhile, the rise of social networks has been accompanied by an unsettling accumulation of private information, given over to corporations willingly by those who wish to seamlessly engage with the Web.

At the same time, a global network of pranksters, activists, and bullies, drawing from two decades of privacy and free-speech activism, have taken on the anti-persona of "Anonymous," donning masks and causing havoc ranging from picking on classmates to bringing down the Web sites of multinational corporations. These (mostly) smart, well-connected people from a seemingly infinite range of backgrounds and an equally diverse set of motivations see anonymity as a source of power, perhaps the most integral human liberty that can be provided in a free society. They're loosely organized, and they often clash within the group. But their amateurish disorganization mirrors the early Internet in that there's no primary control center, no head to decapitate. Similarly, the folks behind WikiLeaks have taken up the fight against control of the Web from a different angle. They're less chaotic, and thus more approachable to the media. They at least operate under the pretense of working within the law, but the threat they pose to the establishment is equally grave. Where their fathers hacked machines, these freedom-loving network natives are hacking the media, politics, and, most important, the self, in dynamic and unpredictable ways.

It made sense that the Internet would become a battleground between the haves and have- nots, with information as the currency involved, whether personal or political. What we've seen in 2010 and 2011 is that the Internet isn't quite as locked-down as power brokers thought, and people weren't going to give up control of the open Internet without a fight.

That the Internet evolved the way it did almost seems like an accident. It spilled throughout the globe. In many ways it upends traditional power structures, encourages unlikely alliances, and spreads knowledge and hope for a better world. Governments and corporations may be able to sway the gavel, the sword, the coin, but the individual controls the wires, wrangling technology to conduct asymmetrical warfare, continuously evolving new ways to wrest control from the historically powerful.

The Web will continue to see warfare in the coming decade. Its primary battleground will be the identity space. Your ability to define who you are as a human, to be as open or as private with your personal information as you want to be, to speak out against injustices anonymously, or to role-play as someone you wish you were--these are the freedoms we will fight to keep. Will you decide who you are or will you be defined by the identity brokers?

On the face of it, we recognize cyber bullying, faceless slander, and data theft to be universally recognized evils, and we should therefore do what we can to mitigate them. The simple, obvious solution is to force everyone to wear a name tag in cyberspace, so that everyone is responsible for their actions online, just like in the real world. Evildoers use anonymity as both a shield and a weapon. If we rob them of both, we'll have less evil.

My position: It's just not that simple. Throughout Hacking the Future I trace the rich heritage of anonymous speech in a free society and examine its most popular current manifestations. I explore the bits and bytes behind the argument. I use the technology and come face-to- face with unspeakable evils in dark places I'd prefer never to return to. I consult the men who shaped the Internet and the soldiers toiling in the trenches of network security who intimately recognize the terrifying potential of the Wild Wild Web daily. I talk to code breakers, whistle- blowers, researchers, hacktivists, and mothers.

This book is essentially a 137-page rebuttal to Ms. Zuckerberg's comments. Her attitude is shared by many within the tech industry, and even more outside that universe. I wanted to figure out if it's worth living with anonymity on the Internet because I believe, without a doubt, that the Internet is the most important tool we have for promoting liberty. The identity issue may be the most crucial decision we face in the coming decade.

The Web is being pulled in two directions. In the worst fears of free-speech advocates, the Internet becomes tightly regulated and real-name identities are enforced, such that everything you say can be traced back to you. The reverse dystopia is a lawless frontier, where cyber terrorists, pedophiles, and information thieves run free. The decisions that lawmakers and CEOs make today regarding the privacy of Internet users will determine the way the Web looks in the future. As the "real world" and cyberspace become increasingly intertwined, society has yet to determine if it wants the Web to be an electronic extension of one's off-line life or something entirely different.

Filed Under: anonymity, culture, internet, privacy

A New Issue For Bitcoin: Crypto Key Disclosure

from the not-so-secret dept

The debate is still raging whether Bitcoin is a brilliant idea that will revolutionize business and society, a high-tech money laundering scheme, or just a fad that will soon pass into history. But in a fascinating post, Jon Matonis points to a problem that doesn't really seem to have been considered before:

Key disclosure laws may become the most important government tool in asset seizures and the war on money laundering. When charged with a criminal offense, that refers to the ability of the government to demand that you surrender your private encryption keys that decrypt your data. If your data is currency such as access control to various amounts of bitcoin on the block chain, then you have surrendered your financial transaction history and potentially the value itself.

That's no mere theoretical issue in countries like Australia, South Africa and the UK that already have such key disclosure laws.

Matonis reviews the limited US case law here, and concludes:

To say the cryptocurrency bitcoin is disruptive would be an understatement. Bitcoin not only disrupts payments and monetary sovereignty, it also disrupts the legal enforcement of anti-money laundering laws, asset seizure, and capital controls. It is very likely that a key disclosure case will make it to the U.S. Supreme Court where it is far from certain that the Fifth Amendment privilege, as it relates to a refusal to decrypt bitcoin assets, will be universally upheld.

Perhaps that's something to bear in mind if you're currently using Bitcoin in the belief that they'll never be able to force you to reveal your assets and transaction history.

Follow me @glynmoody on Twitter or identi.ca, and on Google+

Filed Under: anonymity, bitcoin, crypto key disclosure, privacy, security

EU Officials Propose Internet Cops On Patrol, No Anonymity & No Obscure Languages (Because Terrorism!)

from the even-worse-than-we-thought dept

Back in February we wrote about the ominously-named "Clean IT" project in Europe, designed to combat the use of the Internet by terrorists. At that time, we suspected that this would produce some seriously bad ideas, but a leaked document obtained by EDRI shows that these are actually much worse than feared (pdf), amounting to a system of continuous surveillance, extrajudicial removal of content and some new proposals that can only be described as deranged.

Here's EDRI's summary of the central issue:

The leaked document contradicts a letter sent from CleanIT Coordinator But Klaasen to Dutch NGO Bits of Freedom in April of this year, which explained that the project would first identify problems before making policy proposals. The promise to defend the rule of law has been abandoned. There appears never to have been a plan to identify a specific problem to be solved – instead the initiative has become little more than a protection racket (use filtering or be held liable for terrorist offences) for the online security industry.

Instead of tackling concrete problems, the vague threat of "terrorism" is constantly invoked -- without ever defining what that means -- to justify a range of extreme measures. At the heart of the plans lies the "voluntarism" we discussed a few weeks ago:

Governments should stimulate self-regulation by Internet companies

And where there are laws, it must be OK for law enforcement agencies (LEAs) to ignore them and have content taken down on demand:

It must be legal for LEAs to make Internet companies aware of terrorist content on their infrastructure ('flagging') that should be removed, without following the more labour intensive and formal procedures for 'notice and take action'

Due process, who needs it? The plans also require some interesting new laws, like this one criminalizing merely posting certain hyperlinks:

Knowingly providing hyperlinks on websites to terrorist content must be defined by law as illegal just like the terrorist content itself

Here's another proposal -- no more anonymity online:

Internet companies must allow only real, common names. These must be entered when registering.

So what happens if you have an uncommon name? And then there's this:

Social media companies must allow only real pictures of users

Presumably you're not allowed to smile, either. Talking of social media, the Clean IT plans include the introduction of friendly "virtual police officers", constantly spying on, er, watching over Europeans online:

Virtual police officers must be used to show law enforcement is present, is watchful, in order to prevent terrorist use of the Internet and make regular users feel more secure.

The idea is that "virtual police officers" will be keeping an eye on you -- for your own safety, you understand. Other ways in which users will be protected from themselves is through the use of filters:

All kinds of Internet companies, LEAs and NGOs, but not governments, should promote the use of end-user controlled filters among their clients, the public and supporters

Note that "not governments" part -- people mustn't get the idea that this is censorship, oh no. Also required will be automated detection systems, because we know how well they work:

Automated detection systems must be used by LEAs, NGOs and Internet companies.

Among the even more interesting proposals in the leaked document seems to be the idea that the authorities can order encryption to be turned off, presumably to allow eavesdropping:

In some cases notice and take action procedures must lead to security certificates of sites to be downgraded.

But surely the most bizarre proposal for dealing with "abuse" -- an attempt to dress up as lamb the tired old mutton of "terrorism" -- is the following:

The use of platforms in languages abuse specialists or abuse systems do not master should be unacceptable and preferably technically impossible.

Incredible though it might sound, that seems to suggest that less common foreign languages would be banned from the European Internet entirely in case anybody discusses naughty stuff without the authorities being able to spy on them (haven't they heard of Google Translate?) You could hardly hope for a better symbol of the paranoid and xenophobic thinking that lies behind this crazy scheme.

Follow me @glynmoody on Twitter or identi.ca, and on Google+

Filed Under: anonymity, anti-terrorism, eu, internet police, languages, privacy

Shelby County Tries To Reveal The Authors Of Nearly 10,000 Anonymous Internet Comments

from the free-speech-means-something-different-apparently dept

We've had plenty of stories about attempts to reveal anonymous commenters. Time and time again, we've pointed out that there needs to be a very high bar for legally requiring the identification of such commenters, because the right to anonymous speech is recognized by the courts as being protected by the First Amendment. Yet, many seem to ignore this -- and quite frequently we even see government officials themselves seeking to uncover anonymous commenters. However, as Paul Levy has pointed out, Shelby County, Tennessee has taken an attempt to uncover the identities of anonymous commenters to new levels: seeking the identities on somewhere around 10,000 anonymous comments posted to the website of Memphis' local newspaper, the Commercial Appeal.

The link explains the reasoning behind this, but the short summary is that Shelby County (home to Memphis) is trying to push back on a state law. The reasons Shelby is pushing back may be noble (it appears to feel that the reasons for the law itself are based on racism), but even so, that's no excuse for stripping away anonymity on thousands of comments. Levy is helping in trying to block these subpoenas:

The Commercial Appeal, standing on its own First Amendment rights as well as the rights of customers who have registered to post comments on its web site, has served Rule 45 objections to the subpoena. The objections, which I signed along with Lucian Pera, long-time counsel to the Commercial Appeal, argue that this theory – assuming that it is the basis for the subpoena – is not a sufficient reason for depriving members of the public of the First Amendment right to debate the propriety of government policy on an anonymous basis. In addition, we argue that because the subpoenas have been issued by government bodies, they are precluded by federal statutes that limit government access to such information to cases involving a probability of criminal wrongdoing. Indeed, the very same firm that is representing Shelby County was forced to withdraw a subpoena on behalf of the City of Memphis, seeking to identify a blogger who criticized the city's police chief, for the same statutory reasons.

Furthermore, he points out that the attempt to reveal such a massive number of commenters, indiscriminately, is somewhat breathtaking. The very scale of the attempt clearly suggests that the goal here has little to do with actually uncovering illegal activities, and is almost entirely about creating a chilling effect on public speech. Even if that speech itself is reprehensible (such as racist commentary), that doesn't mean that we should support such a blanket subpoena wiping way First Amendment rights.

Even apart from the question whether the legal theory behind the subpoena can meet the test of a compelling state interest, needed to overcome the right to speak anonymously, is the sheer indiscriminateness of the subpoena, seeking to identify everybody who spoke about the issue underlying the legislation regardless of whether they favored the consolidation or opposed it, and whether they expressed racist views or not. In past cases involving Doe subpoenas, it has often seemed to me that the plaintiff had the germ of a good case, and perhaps a reason to identify one or two critics, but then obscured the merit of its case by throwing everything but the kitchen sink into the subpoena. Here, the very breadth of the subpoena suggests that County's motive is to chill public discussion of an important policy question, by sending the message that if you speak out, you will be subpoenaed.

In the dozen years that I have been litigating cases involving Internet anonymity, I cannot recall any case involving close to so many anonymous speakers. In Pilchesky v. Gatelli, the chair of the Scranton Pennsylvania City Council sought to identify about ninety different Scranton citizens who has posted hurtful comments about her on a community message board established by one of her critics, and in Donato v. Moldow, officials of the Borough of Emerson, New Jersey sought to identify the authors of more than one hundred critical comments. In both of these cases, the trial courts upheld the right to speak anonymously and quashed the subpoenas (with a small number of exceptions in the Pennsylvania case – and those identities were preserved on appeal). A large number of posters were also involved in my first case involving a subpoena to identify anonymous speakers, when Northwest Airlines sought to identify flight attendants who had advocated a "sickout" during collective bargaining negotiations.

Shelby County subpoena outstrips these cases in indiscriminateness by a factor of ten or even a hundred – more than 9300 comments remain on the stories, and the removed comments likely take the number of comments at stake in this case beyond ten thousand. Many of the comments were posted by repeat customers (we can tell because, as on most newspaper web sites, only registered users can post comments), but the estimate so far is that more than 2000 separate people are facing possible denial of the right to speak anonymously. Even most file-sharing cases pale by comparison: the recording or movie companies typically sue and seek to identify only hundreds of anonymous uploaders at a time.

Hopefully the county pulls back the subpoena.

Filed Under: anonymity, free speech, shelby county
Companies: commercial appeal

YouTube Wants You To Comment Under Your Real Name

from the accountable-community dept

I've written before about the benefits of having an open commenting system on websites, complete with anonymity, and I still believe in that stance. I've also made the point that the comments and communities a site develops can often be as much the stars of the show as the original content. So, it goes without saying that the more you enable your community to provide awesome and relevant commentary, while not locking the system down, the better off you're going to be. I think Techdirt does this well, by still allowing for anonyous comments while providing benefits for having a profile with a comment history (participation in contests, credibility through history, etc.).

YouTube (famous for its often-awful comments) has never been completely open, but the majority of commenters use standalone accounts with pseudonyms. Now, according to a recent CNN article, YouTube is actively encouraging users to link their accounts with their real identities (via Google+, of course), not just by prompting them to do so but also by asking them to explain why if they decline.

"Try to comment on a video today and a window will pop up with the title "Start using your full name on YouTube," which will sign you in with your Google+ account. A YouTube spokesperson told BetaBeat that this option has been offered since June 29 and that users with a Google+ account will see the same thing if they try to upload a video.

If you don't want to use your Google+ account, you can refuse -- but then you're taken to a second prompt, which asks "Are you sure?" Then, like some kind of Internet degenerate, you must explain why you don't want to use your full name."

Now, this may be a tad irritating to anyone who insists on commenting anonymously, but I think if the strategy works to get more people to comment while being accountable then the benefits will outweigh the annoyance. Because if there has been any single great all-encompassing truth about the last decade, it's this: if you're looking for a reason to hate humanity, spend 20 minutes browsing YouTube comments.

Having said that, it's important that YouTube still allow the option to comment anonymously. Without that option, you may lose valuable comments from people with legitimate fear of reprisal if their name is associated with their words, whether that reprisal comes from friends, family, their employers, or the government. But being proactive in encouraging users to comment under their accounts is a good thing, which may very well breed a better commenting community.

Filed Under: anonymity, comments, community, youtube