Not Being Able To Spy On Everyone Online Is A Feature, Not A Bug

from the tell-the-FBI dept

With the recent news coming out that the feds plan to introduce dangerous legislation early next year to mandate backdoors for wiretapping into every form of internet communications, plenty of people have expressed their horror at such a plan. It's not just the basic questions of due process and privacy, but the massive burdens lumped upon all sorts of companies, combined with the equally worrisome security holes opened up by such demands.

Julian Sanchez has a wonderful article over at the American Prospect discussing just how problematic this plan would be:

But the current proposal is far more radical, in part because the Internet is not much like a traditional phone network. To see why, consider Skype, a popular program that allows users to conduct secure text chats, phone conversations, video conferences, and file transfers. Skype is designed as a distributed peer-to-peer network, meaning there's no central hub or switching station through which calls are routed; only the login server used to register members as they sign on to the network is centralized. Calls are encrypted end-to-end, meaning that only the end users who are parties to a call hold the secret keys to secure the conversation against online snoops. There's no device Skype can install at their headquarters that would let them provide police with access to the unencrypted communications; to comply with such a mandate, they'd have to wholly redesign the network along a more centralized model, rendering it less flexible, adaptable, and reliable as well as less secure.

Skype is just one of the thousands of firms, large and small, that would be burdened with the obligation to design their systems for breach. We've already seen how this can cause security vulnerabilities on traditional phone networks: In 2005, it was discovered that unknown hackers had exploited wiretap software built into Vodaphone Greece's computer system for law-enforcement use to eavesdrop on the cellular phone conversations of high Cabinet officials and even the prime minister. Designing for surveillance means, more or less by definition, designing a less secure, more vulnerable infrastructure. It's for just this reason that similar proposals were wisely rejected during the Crypto Wars of the 1990s, a decision that helped give rise to a thriving online economy that's wholly dependent on strong encryption.

It's not just hackers who could exploit such vulnerabilities, of course. A network architecture designed for the convenience of American law enforcement also necessarily makes eavesdropping easy for the many regimes whose idea of a "national-security threat" includes political dissent or blasphemous speech. And there's always the threat of interception by insiders: An engineer at Google was recently fired for using his privileged access to snoop into the private accounts of several teenage users. One way to alleviate such concerns is for firms like Google to enable end-to-end encryption, so users can feel secure that even the company's own employees won't have the keys needed to read their communications. The government's proposal would deny them the ability to make that promise.

Sanchez also has a wonderful line towards the end. In discussing why law enforcement would obviously love this kind of access (while also highlighting its widespread past abuses of wiretapping ability, he notes:

But while governments may consider it a bug when network architecture renders such sweeping surveillance infeasible, citizens should probably regard it as a feature.

An important feature, too, and one that we shouldn't easily part with just because a government with a history of abusing surveillance rights doesn't want to do any legwork anymore.

Filed Under: internet, spying, surveillance, us government

Hadopi's Secret Internet Spying Spec Leaked

from the now-doesn't-that-make-you-feel-good dept

As a part of France's three strikes law, the organization in charge of implementing the program, Hadopi (which, we should remind you, was caught infringing itself in using a font it did not license for its logo), has been tasked with figuring out a way to actually block people from the internet, or to stop them from using certain file sharing programs. While there were public consultations on how to do this, the actual technical spec was supposed to have been kept secret. Not surprisingly, that didn't last very long. Glyn Moody points us to the news that the tool's spec has leaked. Basically, it's your everyday snooping software, that will monitor all internet traffic, including searching through files on your computer, and checking the router configuration. It will also act as a creepy form of Big Brother, with an alert system which, if it notices you using a file sharing program, says things like: "You are about to download a file using a P2P protocol - do you want to continue?" One hopes that it would include a button that says "Yes, Dammit, I'm Downloading Linux" or something of the sort, but that seems unlikely. The link above also notes that this appears to violate EU law, which prohibits a "general obligation to monitor."

Filed Under: hadopi, spying

Second Lawsuit Over School Webcams Involves Student Who Was Photographed 469 Times Over 2 Months

from the what-happened-to-42-times? dept

Remember the school district in suburban Philadelphia involved in a lawsuit over secretly taking webcam images of students? The school initially denied things, and later said that it had only used the feature 42 times to help find lost or stolen laptops. However, a law firm brought on by the school to investigate its use of the LanRev system found 58,000 images were taken. That's led some other students to realize that they might have a beef with the Lower Merion School district as well. A second student has now filed a lawsuit against the school after discovering that the school took 469 secret photographs from his webcam over the course of two months.

What happened was that the student lost his laptop on December 18th. The laptop was found by a teacher and returned to the student on the 21st... but also on the 21st, the school's IT folks turned on LanRev's "TheftTrak" service. Even though the laptop had been returned to the student, the LanRev system was never turned off. It took 469 secret images and captured 543 secret screenshots. It wasn't turned off until that first lawsuit was filed, and someone in the IT department realized there might be an issue there...

What's really scary? If a school administrator hadn't revealed the whole system to the first student by showing him a photo of him at home, this would still be going on and none of the students would know about it. The only reason this lawsuit is being filed is because of the information that came out during the investigation into the first incident.

Filed Under: school, spying, webcams

Australian Gov't Censors Plans About Gov't Internet Censorship

from the to-avoid-premature-unnecessary-debate dept

As the Australian government pushes forward with plans to have ISPs spy on users as part of its effort to control and censor the internet, some have made a freedom of information request to see the details of the plan... and the government provided the documents with 90% of the content blacked out. Yes, the government is censoring its plans about censorship. Even better is the "reasoning" for this. Government officials defended the move by saying it:

"may lead to premature unnecessary debate and could potentially prejudice and impede government decision making".

Yes, how dare the people make their views known in a way that lets the government know they don't approve. That would be a representative government, and apparently Australia doesn't believe in such things.

Filed Under: australia, censorship, isps, public debate, spying

Indian Government Demands Right To Spy On Skype, Gmail, Blackberry Messages

from the spying-more-important-than-productivity dept

Last year we noted that Indian intelligence officials were quite concerned about Skype, and the fact that they couldn't easily tap into communications on Skype. Two years ago, we noted a similar story concerning RIM Blackberry emails. Now Slashdot points us to the news that India's government is once again demanding that Skype and RIM make sure their services are in formats that can be read by law enforcement. A separate article says similar demands are being made on Google with respect to Gmail.

Of course, last time this happened (with RIM, at least), RIM pointed out that there's simply no way for it to decrypt email sent by users, since it's based on an encryption key set up by the end user. In response, the Indian government claimed that it had cracked the encryption used by Blackberries and was able to monitor messages sent via those devices. Of course, the fact that it's now pressuring RIM to format messages in easily spied-upon ways, certainly suggests the news of the cracking of Blackberry's encryption was somewhat exaggerated.

Filed Under: blackberry, encrypted, gmail, india, messages, skype, spying
Companies: google, rim, skype

Schools & Governments Blocking Google Because It Won't Let Them Spy On Users

from the which-is-it? dept

So various governments around the world remain furious with Google for its accidental Street View wifi data collection. However, at the same time, governments are also getting annoyed and using filters to block government employees from using Google products because Google is now increasingly running more and more of its apps (including search and Gmail) via SSL, making it harder for those gov't agencies to spy on what users are doing. So... which is it? Is Google bad for spying on data? Or is Google bad for not letting governments spy on data?

Filed Under: governments, security, spying, ssl
Companies: google

Australian Gov't Says ISPs Should Spy On Users... At The Same Time It's Trying To Attack Google For Doing Less?

from the um,-hypocrisy-much? dept

We've been writing about the Australian government -- mainly Stephen Conroy -- the politician who is actively trying to censor the internet, who is absolutely livid at Google, mainly because the company has accurately pointed out what a bad idea the censorship program would be. He's been making ridiculous and uninformed fear mongering statements about Google for a few weeks now. The latest, which is a blatant falsehood, is that Google's WiFi snarfing collected personal banking details. But, of course, as anyone who actually knows how these things work can tell you, banking sites use encryption. Google can only read unencrypted data, and all of the evidence suggests that Google discarded any encrypted info (not that it could do anything with it anyway).

Of course, while Conroy is grandstanding about how Google might have possibly, maybe collected a tiny snippet of unsecure info that passed through an open WiFi network while it was driving by -- saying that it was "the largest privacy breach in history across Western democracies," -- his government, in his area of regulation, is working on data retention plans that would require ISPs to spy on your internet usage. They don't just want ISPs to store your IP addresses. They want your browsing history and every email stored -- just in case the government wants to go back and check it some time.

That seems like a significantly bigger privacy breach than anything Google did.

Filed Under: australia, data retention, isps, spying, stephen conroy

School Laptop Spying Program Has A 'Hacker-Friendly' Security Vulneratibility

from the but,-of-course-it-does dept

It always happens. A technology used for spying on people always opens up security vulnerabilities. Sony's "rootkit" DRM had huge security vulnerabilities that let people do bad things to your computer. And now comes the news that the LANrev system used by the Lower Merion School District to secretly photograph students at home also just happened to have a big security vulnerability that, in theory, made it possible for others to spy on children without them knowing it as well:

The LANrev program contains a vulnerability that would allow someone using the same network as one of the students to install malware on the laptop that could remotely control the computer. An intruder would be able to steal data from the computer or control the laptop webcam to snap surreptitious pictures....

The vulnerability in the LANrev system lies in the symmetric-key encryption it uses for authentication between the client and the server, and isn’t related to the optional Theft Track feature. Therefore, even computers that are not using the theft feature are potentially vulnerable.

The authentication key is stored in the client-side and server software and is fairly easy to decipher, says Frank Heidt, president and CEO of Leviathan. It took Leviathan just a few hours to determine that it’s a stanza from a German poem. The key is the same for every computer using LANrev.

The LANrev client software on a computer is configured to contact a server every minute or so to check in and see if the server has any commands for it. Knowing what the key is would let an attacker who has installed a sniffer on the network intercept that ping and masquerade as the server in communication back to the laptop. It requires the attacker to be on the same network as the target machine -- for example, on a wireless network at the school or anywhere else that offers free Wi-Fi the student might use.

To be fair, there's no evidence that anyone used this hack outside of the researchers who have discovered it, but it still raises more questions about the wisdom of using such software, especially on laptops used by kids.

Filed Under: lower merion, security, spying, students, vulnerability

Amazon Spying On Your Ebook Highlighting

from the who-owns-what-now? dept

There have already been plenty of questions over who "owns" the ebooks you've bought, with stories of remotely deactivated books and remotely deactivated features -- neither of which happens when you have a real physical book. But there are also other concerns opened up by newly activated features. Apparently one new feature -- sent in by a few concerned readers -- is that Amazon will now remotely upload and store the user notes and highlights you take on your Kindle, which it then compiles into "popular highlights."

I have no doubt that the feature provides some interesting data, but it's not clear that users realize their highlighting and notes are being stored and used that way. Amazon basically says there's no big privacy deal here, because the data is always aggregated. But it sounds like many users don't realize this is happening at all. Amazon says people can find out they added this feature by reading "forum posts and help pages" -- but it's not clear how many people actually do read those things. While I'm sure many people are fine with this, others might not be. And it once again highlights a key concern in that the "features" of your "book" can change over time. Your highlighting may have been yours in the past, but suddenly it becomes Amazon's with little notice.

Filed Under: ebooks, kindle, ownership, spying
Companies: amazon