Kickass Torrents Gets The Megaupload Treatment: Site Seized, Owner Arrested And Charged With Criminal Infringement

from the because-of-course dept

So just as the US government itself is accused of being engaged in massive copyright infringement itself, the Justice Department proudly announces that it has charged the owner of Kickass Torrents with criminal copyright infringement claims. The site has also been seized and the owner, Artem Vaulin, has been arrested in Poland. As with the original Kim Dotcom/Megaupload indictment, the full criminal complaint against Vaulin is worth reading.

As with the case against Dotcom/Megaupload, the DOJ seems to ignore the fact that there is no such thing as secondary liability in criminal infringement. That's a big concern. Even though Kickass Torrents does not host the actual infringing files at all, the complaint argues that Vaulin is still legally responsible for others doing so. But that's not actually how criminal copyright infringement works. The complaint barely even shows how Vaulin could be liable for the infringement conducted via Kickass Torrents.

But, of course, that doesn't matter because the guy at Homeland Security Investigations (formerly: ICE: Immigrations & Customs Enforcement) just spoke to the MPAA and the MPAA said that Kickass Torrents had no permission to link to their content. Yes, link.

As part of the investigation, I have communicated with representatives of the Motion Picture Association of America (MPAA) regarding this investigation. The representatives provided me with information the MPAA had developed about KAT, among other websites. The representatives stated that the MPAA closely monitors KAT and that a significant portion of the movies available on KAT are protected by copyright. The representatives also specified that the MPAA has not granted permission to KAT to index, link, frame, transmit, retransmit, provide access to, or otherwise aid or assist those who distribute and reproduce infringing copies of copyrighted motion picture or television content of MPAA members.

Here's the thing: most of those things listed above are not rights granted by the copyright act. The copyright act is pretty specifically limited to a few rights, including reproduction and distribution. But, again, note the games played in the complaint: "index, link, frame, transmit, retransmit, provide access to" don't directly infringe on the stated copyright exclusive rights (yes, there are some cases where some of the above may infringe on some of the exclusive rights, but it's not particularly cut and dry). So instead, the government tosses in this "otherwise aid or assist those who distribute and reproduce infringing copies of copyrighted motion picture or television content."

So, you see, once again, the government is creating a form of secondary liability for copyright infringement that does not exist in the law. That's a problem. Because that's not how criminal copyright law works. At all.

Furthermore, the complaint goes on about how KAT, as it calls Kickass Torrents, rejected DMCA takedown notices for a variety of reasons, but leaves out the fact that KAT is not an American company and is not under the jurisdiction of US laws. So I'm not entirely clear why US copyright laws apply here. The best they can do is note that they found a few servers that were apparently in Chicago.

The complaint spends lots of time on the fact that KAT makes a fair bit of money from advertising revenue. But, again, I'm not entirely clear how that's relevant to the claim of criminal copyright infringement. The implicit argument is clearly "people go to KAT to get infringing content, the site makes advertising from all that traffic, thus the revenue is ill-gotten gains." But... again that relies on the idea that KAT itself is engaged in criminal behavior. Creating a popular tool for finding content -- some of which may be infringing -- and then making money from advertising, are separate things. It seems wrong to make this weird if->then conditional assumption that just because the site made lots of money it was infringing.

No one is suggesting that Kickass Torrents was not regularly used by individuals to infringe on copyrights. It was. A lot. And you can argue how horrible that is and how it was killing Hollywood and all that -- but the specifics here do matter. The same arguments were made about the VCR for years. After all, the MPAA insisted that it was used exclusively to infringe on content for years until they finally realized that it was a good idea to release content for the home video market. And, again, the US government isn't allowed to make up criminal liability concepts that aren't actually in the law. They, and their supporters, of course will now argue that it's not about secondary liability, but about "aiding and abetting." But that argument doesn't fly either. The standards for aiding and abetting are much more involved -- and would require that the actual infringement be criminal. But that won't fly, because the individuals downloading via Kickass Torrents weren't violating criminal copyright law themselves.

In other words, the DOJ is trying to argue that helping a bunch of people engaged in civil copyright infringement magically turns into criminal aiding and abetting. But that's not how the law works.

Meanwhile, the DOJ's press release on this is filled with all the usual insane bluster:

"Copyright infringement exacts a large toll, a very human one, on the artists and businesses whose livelihood hinges on their creative inventions," said U.S. Attorney Fardon. "Vaulin allegedly used the Internet to cause enormous harm to those artists. Our Cybercrimes unit at the U.S. Attorney’s Office in Chicago will continue to work with our law enforcement partners around the globe to identify, investigate and prosecute those who attempt to illegally profit from the innovation of others."

Funny. Is he also going to charge the US Navy for its massive copyright infringement? Or is that not the kind of copyright infringement harm Fardon goes after?

"Vaulin is charged with running today’s most visited illegal file-sharing website, responsible for unlawfully distributing well over $1 billion of copyrighted materials," said Assistant Attorney General Caldwell. "In an effort to evade law enforcement, Vaulin allegedly relied on servers located in countries around the world and moved his domains due to repeated seizures and civil lawsuits. His arrest in Poland, however, demonstrates again that cybercriminals can run, but they cannot hide from justice."

The $1 billion of copyrighted materials is a nice touch, but again represents merely the estimated cover price, not any actual losses to the industry. Not that the DOJ wants to admit that. But the next guy is even worse, no longer just claiming that over $1 billion was distributed, but directly stating that Vaulin stole $1 billion.

"Artem Vaulin was allegedly running a worldwide digital piracy website that stole more than $1 billion in profits from the U.S. entertainment industry," said Executive Associate Director Edge. "Protecting legitimate commerce is one of HSI’s highest priorities. With the cooperation of our law enforcement partners, we will continue to aggressively bring to justice those who enrich themselves by stealing the creative work of U.S. artists."

Aren't law enforcement people supposed to actually know the law? There was no stealing. There may have been copyright infringement using the tool that Vaulin built, but that's not stealing.

"Investigating cyber-enabled schemes is a top priority for CI," said Chief Weber. "Websites such as the one seized today brazenly facilitate all kinds of illegal commerce. Criminal Investigation is committed to thoroughly investigating financial crimes, regardless of the medium. We will continue to work with our law enforcement partners to unravel this and other complex financial transactions and money laundering schemes where individuals attempt to conceal the true source of their income and use the Internet to mask their true identity."

Illegal commerce? It was basically a search engine for free content. What illegal commerce happened there?

Yes, yes, lots of infringement happened via the site. No one denies that. But having law enforcement folks stand up and make clueless statements like this suggest they don't even understand what Kickass Torrents did, and they just want to puff themselves up and look good for Hollywood.

Meanwhile: does anyone really believe that this move will cause anyone who used KAT to suddenly go back to purchasing movies?

Filed Under: aiding and abetting, artem vaulin, copyright, criminal copyright infringement, dhs, doj, hsi, ice, secondary liability
Companies: kickass torrents, mpaa

DHS Wants Travelers Entering The US To Include Their Social Media Handles... Just Because

from the maybe-they-want-to-be-friends dept

Late last week, a proposal from the Department of Homeland Security was published in the Federal Register concerning forms tourists need to fill out upon entering the US. Specifically, DHS proposed adding the following to Form I-94W, which is the Nonimmigrant Visa Waiver Arrival/Departure Record:

“Please enter information associated with your online presence—Provider/Platform—Social media identifier.”

Why? Well, it's pretty much exactly as you guessed:

It will be an optional data field to request social media identifiers to be used for vetting purposes, as well as applicant contact information. Collecting social media data will enhance the existing investigative process and provide DHS greater clarity and visibility to possible nefarious activity and connections by providing an additional tool set which analysts and investigators may use to better analyze and investigate the case.

In other words, if you're following ISIS accounts on Twitter, DHS might not let you into the US. And sure, it's voluntary, but it looks like some in Congress are already saying that this sort of thing ought to be mandatory. Of course, for the vast majority of people, their social media profiles are going to be pretty boring for your average Customs and Border Patrol agent, but do we really think it's a good use of their time to be trolling through their Facebook and Twitter feeds or Instagram and Pinterest images?

Overall, this seems like a typical kneejerk response to various concerns about letting people with ill-intent into the country. Eventually, someone travelling here on a tourist visa will do something horrendous, and people will look at who was friends with that person on Twitter or Facebook and freak out. But the idea that the government should be asking travelers for their social media info feels fairly intrusive. What people say on social media or who they're connected with seems likely to be a pretty poor indicator of whether or not they're coming to the US to blow stuff up.

Filed Under: cbp, customs and border patrol, dhs, social media, tourist visa

DHS/ICE Knew Its World Series 'Panty Raid' Was A Bad Idea; Pressured To Do So Anyway

from the to-secure-the-nation,-starting-with-the-trademarks dept

The Kansas City Royals' long-delayed return to competitive baseballing coincided with one of the most ridiculous raids ever conducted by the Department of Homeland Security. Birdies, a Kansas City lingerie shop, was "visited" by DHS agents -- working in conjunction with ICE -- who seized a number of panties emblazoned with a handcrafted take on the Royals' logo, along with the phrase "Take the Crown."

The agents performing the raid didn't seem all too enthused about their participation in this panty raid, according to the shop's owner, Peregrine Honig.

She says you could tell “they [DHS agents] felt like they were kicking a puppy.”

Honig also pointed out that many local law enforcement officers had purchased lingerie, including the supposedly-trademark infringing panties, without expressing concerns about IP violations or counterfeited goods.

The printing shop that made the panties for Birdies was also visited by DHS agents, who threatened the owner with six years in prison for "breaking copyright law" unless he consented to a warrantless search.

All of this culminated in plenty of unfavorable press coverage highlighting Homeland Security's panty raid and how much "safer" we all were thanks to its intercession on behalf of the Kansas City Royals and Major League Baseball.

Aaron Gordon of Vice Sports has acquired DHS communications related to the infamous panty raid via a FOIA request. The internal emails contain an awesome mixture of self-congratulation, defensiveness, and the agency's willingness to go above and beyond to please its "eager" partner in IP enforcement.

On October 16, five days before the raid, an anonymous ICE officer from the Intellectual Property Rights Coordination Center (IPRC)—in the documents released, names of officers were redacted; an appeal has been filed to release the names of the officers involved—wrote an email with the subject "Op Team Player - world series update," referring to Operation Team Player, ICE's partnership with U.S. professional sports leagues to intercept counterfeit goods, including tickets and merchandise.

The unnamed officer wrote, "They [the Kansas City office] are trying to get their numbers up and will accept any leads for controlled delivery in Kansas or Missouri, even if they do not meet the criteria because the AUSA Prosecutor is eager."

For the want of increased "numbers," the DHS lowered its standards to raid a lingerie shop. That's basically all there is to it. Without the prompting of an "eager" AUSA, this may never have happened.

Within hours of the raid, the story was already spreading across the internet. A blanket statement was composed for handling inquiries from the press: the usual "Go Team IP Enforcement" jingoism that accompanies ICE's sporting event-related raids performed in close partnership with the MLB, NBA, NFL etc. But someone in the email chain knew the usual stuff wasn't going to be nearly as effective in this case.

The headlines at the bottom of the email pretty much say it all. We're going to be all over the news tomorrow for the wrong reasons. We'll obviously try to spin this as an opportunity to discuss IPR, but the panty raid jokes will make it hard.

Apparently, ICE/DHS felt this particular narrative might be beyond its control. So it tried to drag Major League Baseball down with it.

On the same thread, at 9:57 PM, someone wrote, "We need MLB to step forward and throw some support for what we do. Let us get with our MLB contact and we'll be proactive as we can re: media." Someone with the title "Executive Associate Director of Homeland Security Investigations-ICE" replied, "Great idea. Let's move on it."

As Gordon notes, perhaps the hilarious part of the email chain is the agency's severe underestimation of the internet's thirst for stories containing (a) abuse of government power, or (b) women's intimate garments -- especially any combination of (a) and (b) that's capable of composing its own headlines.

[S]omeone else on the same thread exhibited a fundamental misunderstanding of the internet's interest in panty raids by writing, "So far it appears to have just localized press. Hopefully, it won't make it out of the local news bubble."

Well, hope in one hand and hold seized panties in the other, as they say. Still, one agent appeared to believe that the government's panty raid was nothing more than a judicious use of Homeland Security assets and taxpayer dollars.

Excellent work, which speaks for itself!

Sure does. That's why press coverage was unanimously negative. ICE, DHS and an "eager" AUSA joined forces with MLB to generate additional acronyms like "WTF" and "BS." Americans were protected from unauthorized sportsball underwear -- something than can only serve to increase their respect for intellectual property rights... and the sprawling, often-thuggish bureaucracies that enforce them.

Filed Under: counterfeit, dhs, ice, kansas city, panty raid, world series
Companies: major league baseball

Homeland Security Has Not Sent Us A Subpoena

from the just-an-update dept

A couple weeks ago, we wrote about a phone call (and follow up emails) we received from Homeland Security indicating an interest in sending us a subpoena, asking for any identifying information we had on a commenter. That commenter had posted a (somewhat ridiculous) comment, in response to another story, about a guy who had nearly a quarter of a million dollars taken by him by Customs and Border Patrol (CBP) under civil asset forfeiture rules. The commenter, somewhat weirdly, suggested that the guy who had this money stolen might "know people" who could murder the agents who took the money. It was clearly not a threat. It was random idle speculation.

But, for whatever reason, the sister agency of CBP, called Homeland Security Investigations (HSI -- which was formerly Immigration and Customs Enforcement, or ICE), decided that it wanted to subpoena the information on the commenter. Through our lawyer, we noted that we had serious First Amendment concerns about the chilling effects this might have if even weird comments like that lead to federal law enforcement knocking on people's doors. We explained that we were happy to look over the details, but in the absence of more information suggesting a real and legitimate threat, we were inclined to resist complying with the subpoena to protect our users. We also noted that we were publishing the info on Techdirt at the time, given a similar situation with Reason's website came with an almost certainly unconstitutional gag order, and we wanted to explain what was happening prior to any similar order.

Some people have asked for an update on the situation and it's this: nothing has happened. We haven't received any subpoena at all. In fact, we've received no further communications at all from Homeland Security. It is possible that something is still coming, but we hope that the agents at HSI and anyone else involved with this have realized that this is not a worthwhile activity. We'll keep you updated, should anything change.

Filed Under: cbp, civil asset forfeiture, comments, dhs, first amendment, homeland security, subpoena

Homeland Security Wants To Subpoena Us Over A Clearly Hyperbolic Techdirt Comment

from the guys,-calm-down dept

Earlier this week, one of our writers, Tim Cushing, had a story about yet another abuse of the civil asset forfeiture procedure. You can read that whole story for the details, but the short version is that US Customs & Border Patrol, along with Hancock County (Indiana) Sheriff's Dept. officers, decided to seize $240,000 in cash from a guy named Najeh Muhana. Muhana sought to get that cash back, but after a series of ridiculous communications, his lawyer was told that Customs and Border Patrol in Ohio was keeping the money, and that Muhana had "waived his rights to the currency." This was not true, and certainly appeared to be pretty sketchy. Because of all of this, Muhana filed a lawsuit against US Customs & Border Patrol asking for his money back.

Not surprisingly, this story of what many would argue is just blatant theft by law enforcement (the people who are supposed to be protecting us from theft) upset a number of folks who expressed their frustrations in the comments -- some using colorful language. That kind of language might not necessarily be considered appropriate in polite company, but isn't entirely out of place in internet forums and discussions where rhetorical hyperbole is not uncommon.

So I have to admit that I was rather surprised yesterday afternoon when we received a phone call from an agent with Homeland Security Investigations (the organization formerly known as ICE for Immigration and Customs Enforcement), asking where they could send a subpoena to identify a commenter on our site. Our lawyer, Paul Levy of Public Citizen Litigation Group, requested more information and we were told that DHS is interested in obtaining user information on the following comment by "Digger."

The only "bonus" these criminals are likely to see could be a bullet to their apparently empty skulls.

The person wronged probably knows people who know people in low places who'd take on the challenge pro-bono, after a proper "cooling-off" period.

Now, that's pretty crude and a bit ridiculous. But it's also pretty obviously not even anything remotely like an actual threat. First off, he's not suggesting that he's looking to do this at all. He's suggesting that "the person wronged" -- by which he likely means Mr. Muhana -- would somehow get some friends to do this. This is pretty ridiculous and almost certainly wrong. Second, he's actually responding to another comment, that reasonably bemoans the likelihood that those involved in all of this will receive no punishment at all.

Now, it's entirely possible that there are more details here involving a legitimate investigation, but it's difficult to believe that's the case given the information we have to date. Also, we have not yet received the subpoena, just the phone calls and emails suggesting that it's on its way. Normally, we'd wait for the details before publishing, but given a very similar situation involving commenters on the site Reason last year, which included a highly questionable and almost certainly unconstitutional gag order preventing Reason from speaking about it, we figured it would be worth posting about it before we've received any such thing.

We have told Homeland Security that we're willing to receive the subpoena and review it, but that based on what we know, we have serious First Amendment concerns about the request itself. Multiple Supreme Court cases, including Rankin v. McPherson and Watts v. United States have made it clear that people have a First Amendment right to say that they hope the President gets shot, let alone a law enforcement agent. It may be rude and uncomfortable, but if it is not an indication of a "true threat," then it is protected. And, as such, the idea of disclosing any information about someone who was clearly engaged in rhetorical hyperbole in an internet forum, likely leading to federal agents showing up at his or her door, is quite troubling to us.

Really, the most ridiculous part of this is why this is what's being investigated, rather than why the government was basically able to just walk away with $240,000 from this guy and ignore his attempts to get his money back.

We will keep you informed... as much as we are able to.

Filed Under: asset forfeiture, comments, dhs, free speech, gag orders, homeland security, homeland security investigations, hsi, ice, indiana, najeh muhana, ohio

DHS Claims Open Source Software Is Like Giving The Mafia A Copy Of FBI Code; Hastily Walks Back Statement

from the psst...-your-ignorance-is-showing dept

Late last week, the DHS's Chief Information Officer Luke McCormack (or someone from his office) posted comments to GitHub arguing against the proposed policy of making 20% of its code (whatever that means) open source in the interest of better sharing between agencies. The rationale is that shared code could save tax dollars by preventing paying developers to perform redundant work. The DHS felt strongly about this and said as much using an Excel-based parade of horrors.

Many private companies (especially security companies) do not publish their source code is because it allows attackers to (a) construct highly targeted attacks against the software, or (b) build-in malware directly into the source code, compile, then replace key software components as 'doppelgangers' of the original. How will this be prevented? Government-specific examples: citizenship anti-fraud rules that are coded into software, identification of special codes used to flag law enforcement actions, APT threat indicator scripts, Mafia having a copy of all FBI system code, terrorist with access to air traffic control software, etc. How will this be prevented?

Contrary to the CIO's statements, open source software can actually be safer than closed source options. More eyes on the source means more people finding flaws and holes and working towards fixes, rather than simply compiling internal discoveries and forwarding them to the vendor and allowing the company to determine which holes/flaws should be repaired and in which order.

The DHS has now walked back this unfortunate comment, claiming it was just one of those mysterious things that somehow materialized out of the ether.

Those comments were "incorrectly posted" and do not represent DHS' position, agency spokesman Justin Greenberg told Nextgov in an email. McCormack's new comments "serve as the department’s official stance on the policy," the spokesman said. In his new comment, McCormack said the earlier comments reflected "a variety of individual positions across DHS components."

This explains next to nothing and leaves readers with the impression that the DHS has been publicly embarrassed by the "source code sky is falling [pending proposal approval]" emailed in by its CIO.

The DHS has a history of walking back things after they've received public criticism. This is good, but the walkbacks seem to be accompanied by obfuscatory statements that give everyone involved a pass on their misguided actions. Back in 2014, DHS component ICE started soliciting bids for a national license plate database (built from the hundreds of automatic license plate readers in use around the nation). Backlash ensued and DHS Secretary Jeh Johnson quickly issued a statement claiming the posting was done without the approval of "ICE leadership." In other words, the issuance was just a governmental glitch and the hasty retreat being beaten entirely unrelated to the public outcry.

Here, the same thing seems to be happening. The DHS CIO posts comments full of alarmism, is called out for it and a spokesperson appears on scene to say that comments released by a DHS official are not the official comments of the agency he represents. To borrow the blame-shifting parlance of law enforcement, a misguided comment "discharged" and no one should have to own up to actually pulling the trigger. Yes, mistakes were made. But apparently no government official should need to acknowledge they were just flat-out wrong.

Filed Under: dhs, government, open source

Former DHS Secretary Says We Can Make Airports Safer From Terrorists By Rearranging Security Checkpoints

from the another-security-theater-script-rewrite-in-the-works dept

Another terrorist attack somewhere in the world* has provoked another round of punditry from former government officials on how to protect America from future attacks. Over the coming weeks, there will be no shortage of stupid ideas, useless ideas and pointless discussions about "heightened security" at any place people gather.

*"World" = Western Europe only

None of it will matter. Security has never really been scaled back anywhere since the 9/11 attacks -- certainly not to the levels seen prior to September 2001. There's only so much security anyone can actually provide but endless off-Broadway productions of security theater to be explored.

Michael Chertoff -- head of the Chertoff Group and former Homeland Security secretary -- spoke to CBS This Morning about what might need to be done to make airports more secure. Chertoff is right about one thing: TSA checkpoints create a tempting target of massed humans -- all waiting for their chance to be probed, scanned and groped by government employees.

“Well I have to say this is something I’ve spoken to people about for some time. The actual portion of the airport before the checkpoint is not really controlled by the federal government, it’s controlled by the local authorities. And it has increasingly become vulnerable, because as people wait to go through security they actually congregate there.”

I'm not sure the local boys will appreciate this dig at their security skills. But Chertoff's "solution" is just a literal expansion of federal government territory.

“And so now there’s an effort I think on the part of TSA to start to move the airports into pushing the security envelope back. We’ve seen some of that in terms of not allowing you to park in front of the terminal, but I think we’re going to have to step that up.”

So… move the target. Instead of being deep inside the airport, it will be closer to the entrance. As Gawker's Alex Pareene notes, at some point you can't push the envelope back any further. And there's no expansion point that will magically protect fliers from terrorist attacks.

Ah. Of course. We’ll “push the security envelope back.” The old checkpoints created crowds, sure, but once we move the security checkpoints back, just a bit bit further (to just before you enter the airport, I guess), it will be much safer for everyone, at least once everyone gets past the new checkpoints. Maybe eventually we can push the security envelope back to before you get in your car to go to the airport—your garage door, maybe?

Push people closer to the entrance. Make them more vulnerable to car bombs/larger groups of attackers. Push the envelope all the way out to the connecting roads. Same problem but with the added bonus of intrusive vehicle searches for everyone heading to the airport, whether they're planning to fly or not. There's no point where traveler safety suddenly spikes. Every nudge of the envelope opens as many attack vectors as it shuts down.

That's the ridiculousness of the TSA. It has done almost nothing to make flying safer. The only thing anyone can say for sure is that the TSA has made flying more annoying.

Maybe they'll move the checkpoints. Maybe they won't. Airplanes aren't the target. People are. And people are everywhere. To paraphrase Abraham Lincoln, you can't save all of the people all of the time, but you can make most of them miserable most of the time. That's how the DHS works. Actions must always be followed by reactions specifically tailored to address the parameters of the last attack or perceived threat. Somehow, we'll be safer by staying one step behind and ceding control to the government.

Filed Under: brussels, checkpoints, dhs, michael chertoff, security, security theater, tsa

Napolitano Says She's Always Wanted To Talk About The Secret Surveillance She Hasn't Talked About Since Last August

from the it's-all-just-a-big,-opaque,-pitch-black,-secretive-misunderstanding! dept

A Techdirt reader has sent us a copy of former DHS head/current University of California President Janet Napolitano's official response to the outcry over the secret surveillance of UC staffers -- surveillance she personally approved.

Napolitiano's letter to UC-Berkeley employees immediately ties the secretive surveillance implementation to the UCLA Medical Center cyberattack, just in case anyone (and it's a lot of anyones) feels the effort was unwarranted.

A group of faculty members at the Berkeley campus has articulated concerns regarding some of the security measures we adopted in the wake of the UCLA cyberattack last year. The concerns focus on two primary issues: whether systemwide cyber threat detection is necessary and whether it complies with the University’s Electronic Communications Policy (ECP); and why University administrators failed to publicly share information about our response to the cyberattack.

If your privacy is being compromised, the real villains here are the people behind the cyberattack. As for the secrecy surrounding it, Napolitano seems to indicate she'd like to discuss it, but immediately abandons that line of inquiry to blame disgruntled staffers and the media for misrepresenting her snooping initiative.

The Berkeley faculty members have shared their concerns with colleagues at other campuses and with various media outlets. Unfortunately, many have been left with the impression that a secret initiative to snoop on faculty activities is underway. Nothing could be further from the truth.

Please explain.

I attach a letter from Executive Vice President and Chief Operating Officer Nava explaining the rationale for these security measures.

Great, except that Nava's letter arrived five months after the program was implemented and two months after a university official said the program would be shut down -- a statement which itself preceded (by a month) the news that the program has actually been allowed to continue uninterrupted.

Napolitano claims there was no secrecy.

As you know, leadership at all levels, including The Regents, Academic Senate leadership, and campus leadership, has been kept apprised of these matters, including through the establishment and convening of the Cyber Risk Governance Committee (CRGC). The CRGC, comprises each campus’s Cyber Risk Responsible Executive (CRE), as well as a representative of the University’s faculty Senate, the General Counsel, and other individuals from this office with responsibility for systemwide cybersecurity initiatives.

Yes, look at all the people who were informed! And were apparently informed they could not pass this information on to anyone else!

From our earlier post on the subject -- directly from some of those on Napolitano's "approved" list.

UCOP would like these facts to remain secret. However, the tenured faculty on the JCCIT are in agreement that continued silence on our part would make us complicit in what we view as a serious violation of shared governance and a serious threat to the academic freedoms that the Berkeley campus has long cherished.

[...]

For many months UCOP required that our IT staff keep these facts secret from faculty and others on the Berkeley campus.

This assertion directly contradicts Napolitano's depiction of the events.

I have from the beginning directed my staff to make every effort to actively engage with all stakeholders and to minimize to the extent possible the amount of information that is not shared widely.

This seems highly unlikely, considering no one began publicly talking about this secret surveillance until just recently. If the information had been widely disseminated (as Napolitano's claims she directed), the backlash would have begun months ago.

And, of course, Napolitano is all about that privacy.

Personal privacy and academic freedom are paramount in everything we do. But we cannot make good on our commitment to protect individual privacy without ensuring a sound cybersecurity infrastructure. While we have absolutely no interest in the content of any individual’s emails or browsing history, we must accept that active network monitoring is a critical element of a sound cybersecurity infrastructure and the interconnectedness of the University and all of its locations requires that such monitoring be coordinated centrally.

School officials -- at least those allowed to see email content/web browsing history -- may claim they have "no interest" in seeing it, but that doesn't change the fact that any of them can access it without fear of repercussion. Not only that, but a third party has access to this same data -- a third party Napolitano won't identify.

She closes her official "this is all fully justified because cyber" letter with the same assertion so many officials make when secret goings-on are dragged out into the sunlight: "I've always wanted to have this discussion I'm now being forced to have!"

I invite further robust discussion and debate on this topic at upcoming meetings of the CRGC and COC.

That's just disingenuous. Don't extend an invitation to a conversation you can no longer avoid.

As the TD reader who sent this over explains, they're not exactly thrilled the former DHS head is using a privacy breach to further undermine UC staffers' privacy.

This sort of thing, by the way, is exactly the reason that everyone had the "say what?" reaction when Napolitano was appointed. This is why people were concerned.

P.S. I'm one of the people whose information was compromised in the UCLA Med Center hack, and don't appreciate their screw-up then being used as an excuse to screw us over now.

Filed Under: cyber attacks, cybersecurity, dhs, janet napolitano, surveillance, transparency
Companies: university of california

Former DHS Boss Puts University Of California Employees Under Secret Surveillance

from the you-didn't-see-anything-so-you'd-better-not-say-anything dept

Former DHS boss Janet Napolitano -- who once stated she "doesn't use email" (for many reasons, but mainly to dodge accountability) -- is now showing her underlings at the University of California why they, too, might not want to "use email": someone might be reading them over their shoulders.

UC professor Christopher Newfield has the inside details of the recently-exposed monitoring system secretly deployed by the University of California (and approved by school president Napolitano) to keep tabs on the communications, web surfing and file routing of its employees. The SF Chronicle has an article on the secretly-installed spyware behind its paysieve [try this link], but Newfield has the internal communications.

The installation of the third-party monitoring software was so secretive that even the university's campus information technology committee was forbidden from discussing it with other staff. The committee has now decided to go public.

UCOP would like these facts to remain secret. However, the tenured faculty on the JCCIT are in agreement that continued silence on our part would make us complicit in what we view as a serious violation of shared governance and a serious threat to the academic freedoms that the Berkeley campus has long cherished.

Some salient facts:

- The UCOP had this hardware installed last summer.

- They did so over the objections of our campus IT and security experts.

- For many months UCOP required that our IT staff keep these facts secret from faculty and others on the Berkeley campus.

- The intrusive hardware is not under the control of local IT staff--it sends data on network activity to UCOP and to the vendor. Of what these data consists we do not know.

- The intrusive device is capable of capturing and analyzing all network traffic to and from the Berkeley campus, and has enough local storage to save over 30 days of *all* this data ("full packet capture"). This can be presumed to include your email, all the websites you visit, all the data you receive from off campus or data you send off campus.

The official excuse for the installation of intrusive spyware is "advanced persistent threats" possibly related to a cyberattack on the UCLA Medical Center last summer. How monitoring staff emails plays into the thwarting of "threats" hasn't been explained. Now that the secret's out, the university is claiming it's all good because policies prevent the university from using any intercepted information/communications for "nonsecurity purposes."

The university may have a policy forbidding this activity, but that's not really the same thing as guaranteeing abuse of this surveillance will never happen. Its belated not-an-apology offers no contrition for keeping this a secret from a majority of its staff. And the statement does not name the third party in charge of the collection and monitoring.

While it certainly isn't unusual for employers to monitor employees' use of company computers and devices, it's normally clearly stated in policy manuals, rather than installed surreptitiously and cloaked in deep secrecy.

As Newfield points out, no one was apprised of the monitoring until after it was underway. Some heard a few weeks after the monitoring was put in place (August of last year) when the university updated its security policies following the medical center breach. Many more heard nothing until the first week of December. Following the wider exposure, staffers were assured by the school's vice president that the monitoring would cease and the software would be removed.

The VP said one thing and the school did another.

On Jan. 12, 2016, The Berkeley Joint Committee on Campus Information Technology (JCCIT) met with Larry Conrad and others. The committee was informed that contrary to the Dec. 21, 2015 statements, UCOP had decided to continue the outside monitoring and not disclose any aspects of it to students or faculty.

At this point, the decision was made to go public. A letter was drafted and sent to school administration. It was also sent to the New York Times. This prompted the generation of bullshit from the Executive VP's office.

On Jan. 19, 2016, UCOP Exec. VP and COO Rachael Nava sent a letter to those who signed the Jan. 15, 2016 letter. The original version was marked "CONFIDENTIAL: DO NOT DISTRIBUTE" and invoked "Attorney-Client privilege". After several recipients responded to her via email questioning who is the client and why her letter must be kept secret, a revised version of the letter was sent the next day removing that language, stating: "All: Please accept my apologies with regard to the confusion on the attorney client privilege language on the letter. It was a clerical error and was not intentional. Please find a revised version of the letter with the language removed."

The full letter contains some truly incredible statements.

With respect to privacy, the letter and structure of the University’s Electronic Communications Policy (ECP) reflect the principle that privacy perishes in the absence of security. While the ECP establishes an expectation of privacy in an individual’s electronic communications transmitted using University systems, it tempers this expectation with the recognition that privacy requires a reasonable level of security to protect sensitive data from unauthorized access.

Privacy does not "perish" in the absence of security. This conflation of the two is ridiculous. If a malicious party accesses private communications, that's a security issue. If an employer accesses these communications, that a privacy issue. Claiming to value privacy while secretly installing monitoring software (and then lying about removing said software) only serves to show the university cares for neither. By adding a third party to the monitoring process, the university has diminished the privacy protections of its staff and added an attack vector for "advanced persistent threats." It has effectively harmed both privacy and security and, yet, still hopes to claim it was necessary to sacrifice one for the other.

The other statement, tucked away as a footnote, absurdly and obnoxiously claims the real threat to privacy isn't the school, but people making public records requests.

Public Records Act requesters may seek far more intrusive access to the content of faculty or staff records than what the ECP permits for network security monitoring. The limits on the University’s own access to electronic communications under the ECP do not apply to Public Records Act requests.

Meanwhile, the school's tech committee has pointed out its IT staff is more than capable of handling the privacy and security of the network and, quite obviously, would show more respect for their colleagues' privacy while handling both ends of the privacy/security equation.

It's perfectly acceptable for entities to monitor employees' use of communications equipment. But you can't do it this way. You can't install the software secretly, swear certain employees to secrecy, not tell anyone else until the secret is out in the open, promise to roll it back and then secretly decide to do the opposite, etc. And when challenged, you can't play fast and loose with "security" and "privacy" as if they were both the same word spelled two different ways.

[Update: a TD reader has given us a copy of Janet Napolitano's response to the outcry over the school's secret surveillance efforts. A new post on that letter is on the way. If you'd like a head start, it's embedded below.]

Filed Under: deep packet inspection, dhs, janet napolitano, surveillance
Companies: university of california