Displaced NJ Voters Told To Email Ballot Requests To A Hotmail Account

from the you've-absolutely-got-to-be-kidding-me dept

The election day news is coming in rather fast today, but we're already seeing reports of voting issues. There's some viral videos floating around showing voting machines acting up. This, of course, can be added to the long history of voting machine nonsense we've written about in the past. But adding to the the confusion is that a great section of the East Coast is still recovering from Hurricane Sandy.

You may have seen the news over the past few days that displaced New Jersey voters are being allowed to (sorta) vote via email. Or, rather, they would be allowed to vote via email if the state's election officials could manage to act like they know what they're doing. Instead, reports indicate massive amounts of people have been unable to request ballots at the email addresses originally provided. This is causing frustration and confusion across the state, but the real absurdity shows up in Essex County.

Aware of the problems with the official e-mail system, Essex County Clerk Christopher Durkin suggested an alternative option: "Displaced voters can email a request for a ballot at cj_durkin@hotmail.com," according to a post on the Facebook page of the town of West Orange, NJ. Interestingly, security researcher Ashkan Soltani notes that Durkin's Hotmail address has his mother's maiden name as a "password recovery" question. This means that anyone who can figure out Durkin's mother's maiden name could seize control of his Hotmail account and intercept voters' official ballot requests.

I'll be clear in saying that I understand that the situation in New Jersey is a difficult one and I'm sure election officials there are simply trying to do their best under the circumstances. Unfortunately, Durkin's best appears to suck. You simply cannot put something of such importance (voting) in the hands of someone who cannot either provide a working and secure email address for ballot access or, at the very least, take the most trivial security steps on another email address. We all want every citizen to be able to have their voice heard, but not at the cost of massive security risks.

Filed Under: e-voting, email, new jersey, security

Why Regulations Aimed At Technology Almost Always Suck: Or Why Reading Someone's Gmail Isn't Reading 'Stored Communications'

from the don't-let-them-near-technology dept

There have been a couple of stories covering the fact that the South Carolina Supreme Court has ruled that reading someone's Gmail does not violate the Stored Communications Act, a part of ECPA -- a law we've written about a number of times for being completely out-of-date. Orin Kerr has a good breakdown of the details, if you want to read them. What struck me most, however, is how this case is a near perfect example of the kind of mess we get into when politicians try to regulate technology. Technology changes much, much, much faster than the law, and because of that, you get very silly results. The key issue here is that the Stored Communications Act is now found in 18 U.S.C. 2701 -- and it defines the offense as occurring when someone "obtains, alters or prevents" access to communication "while it is in electronic storage." Now, for the purpose of the law, "electronic storage" is defined over in 18 U.S.C. 2510, with the relevant definition noting:

“electronic storage” means--
(A) any temporary, intermediate storage of a wire or electronic communication incidental to the electronic transmission thereof; and
(B) any storage of such communication by an electronic communication service for purposes of backup protection of such communication;

Got that? It must have seemed reasonable at the time it was written, but it makes little sense these days, and is apparently so misaligned with reality today that this one single case interprets that definition in three different ways, and exactly none of those ways agree with a 9th Circuit ruling in Theofel v. Farey-Jones. There's disagreement over the meaning of "backup" in part (B) in particular. Is that backup for the user? Or for the service provider? And then, how do you figure out what is or what is not backup? If a person reads his or her Gmail account, then the message was copied to his or her local machine inside the browser. Thus, it seems reasonable to argue that the copy that remains on the server is a backup copy. But two of the judges in this case argued that because the recipient had not "downloaded" any other copies of the message to store, then the ones on the server were not "backups." This makes little sense because copies were downloaded, but many non-technical people don't understand how browsers really work.

Other judges focus on whether or not your webmail account is really "backup" for the ISP. Either way, the end conclusions: webmail is not considered "electronic storage" under the law for the purpose of the Stored Communications Act. While accessing someone's email can (and likely does) still violate other laws, the very law that most people would probably think most directly applies, almost certainly does not.

The reality is that, when it was passed, back in 1986, it probably seemed to make sense that "stored communications" would only be done for backup. While there were networked client/server type setups at the time, it's doubtful that the folks who wrote the law could have fathomed something like webmail or other online forms of communication. If we're talking about "stored communications" today, it seems ridiculous to have it not cover web-based mail systems or social networks. But the law doesn't seem to support that view -- because the law is incredibly out-of-date. But, of course, the problem with fixing the law is that lawmakers will, again, have trouble figuring out where we'll be just a few years out, and the law may either fail to cover what it thinks it covers or (perhaps worse) cover stuff that should be perfectly legal.

And this, of course, is what we fear when it comes to politicians meddling in technology. Even when they have the best of intentions, technology changes rapidly -- and old and obsolete definitions get left in the law and can create problems or situations that make very little sense. If Congress were able to clean those up quickly, perhaps there wouldn't be a problem, but Congress isn't known for fixing real problems quickly. We've been hearing talk of fixing ECPA for years, and it seems unlikely to happen for a while.

Filed Under: email, regulations, stored communications, technology

Chevron Subpoenas Google, Yahoo & Microsoft To Get Info On Email Accounts Going Back Years

from the intimidation-or-legitimate-evidence-gathering? dept

Chevron is embroiled in a big lawsuit with some folks in Ecuador that has been going on for 19 years, and resulted in an $18.2 billion judgment against the company for environmental damage in the country. Chevron is accusing the lawyer for the Ecuadorians of racketeering. A New Yorker article from earlier this year goes into significant detail about the case, including Chevron arguing that the whole thing is "a shakedown," and questioning whether or not the lawyer went too far in the case.

We actually wrote about this case a few years ago, when Chevron sought footage that a documentary filmmaker had taken of people involved in the case, including the lawyer, Steven Donziger. While it seemed like the filmmaker should have the right to protect the work like journalists protect their sources, a court ordered it turned over to Chevron. That footage turned out to provide info that Chevron believes shows evidence of racketeering in trying to influence the court decision. Here's the New Yorker describing some of what was in the footage:

As Mastro played a series of outtakes for Judge Kaplan, Donziger’s outspokenness was on full display. He riffed, indignantly, about the inadequacies of the Ecuadoran legal system. “They’re all corrupt,” he says of Ecuadoran judges in one clip. “It’s their birthright to be corrupt.”

... In one scene, a scientific expert for the plaintiffs tells him that one measurement of groundwater contamination was not as strong as he had thought. “This is Ecuador, O.K.?” Donziger says. “At the end of the day, if there’s a thousand people around the courthouse you’re going to get what you want.” As for the scientific data, he adds, it’s “just a bunch of smoke and mirrors and bullshit.”

[...] In another scene that Mastro showed to the court, Donziger chats with associates over dinner at a restaurant. Someone at the table, referring to the popular antipathy toward Chevron in Ecuador, suggests that if the judge in Lago Agrio ruled against the plaintiffs he might be killed.

“He might not be,” Donziger replies, cradling a glass of red wine. “But he thinks he will. Which is just as good.”

All of this, plus some other evidence led Chevron to go after Donziger for racketeering. And, as part of that, it has sent a subpoena to Google, Microsoft and Yahoo seeking information on more than 70 email accounts, claiming that this info may help them show that Donziger was "falsifying evidence from the outset of the trial in Ecuador." CNET notes that Chevron believes that among other things, the lawyers for the Ecuadorians may have been involved in "blackmailing a judge, ghostwriting expert reports, and even helping to draft the court's final opinion."

It's important to note that Chevron is not (yet) seeking the contents of the email, but a variety of information about the accounts -- such as IP address info, physical address, phone numbers and billing info (if available). The idea seems to be that Chevron believes some of the addresses have been faked, and this will help to show that. However, some of the requests clearly seem to be overly broad -- including going after law professor and blogger Kevin Heller, who was not happy about this. Heller was able to have the ACLU call Chevron on his behalf about this -- getting them to drop the request for his info. Chevron claims that this helped them prove that Heller's account belonged to a real person, which is all they're seeking, but Heller is justifiably upset about all of this, sensing significant chilling effects and worrying about possible intimidation.

I will likely never know why Chevron subpoenaed me. But I do know that it is unacceptable for a party to litigation to try to obtain private information from a blogger-journalist who has criticized its tactics. This is not about my journalistic freedom; it is about the journalistic freedom of all bloggers. And it is not about Chevron; it is about any party that thinks it is acceptable to subpoena a blogger’s private information. I would be no less critical of an attempt by Greenpeace to subpoena Glenn Reynolds. Tactics like this need to be exposed and resisted, no matter who uses them or whom they target; passive acquiescence is simply an invitation to further abuses.

Heller also goes after Google, his email provider, for not more actively fighting back on his behalf:

I also think that Google needs to do far more to protect the privacy of its users.  Twitter has been very active in resisting attempts to obtain its users’ private information.  Google has also done so in the past, but it did nothing to help me, even after I informed it via email that I was a law professor and a blogger-journalist.  But again, this isn’t about me.  It’s about all the other bloggers who might find themselves facing a similar subpoena.  I’m lucky: I have friends like Glenn Greenwald to ask for help. I’m sure that the ACLU would assist anyone in my position — but not everyone knows that the ACLU is out there, much less that no case is seemingly too small or too unimportant for them to be concerned.  More importantly, the ACLU should not have to get involved in every case like this one (and again, I am but one of 44 people named in the subpoena); Google itself — and all other service providers in similar situations — need to be the first line of defense.

Google has asked the judge for more time to respond to the subpoenas, which Chevron has already agreed to. The magistrate judge is also going to hold a hearing in a few weeks to "evaluate" the subpoenas. Microsoft told Declan McCullagh at CNET that it had provided notice to the Microsoft accounts in question. Yahoo didn't respond to McCullagh's questions about the subpoenas, so it's unclear what they've done.

There may be legitimate reasons for Chevron's request, but given Heller's experience, it certainly appears that the fishing expedition is overly broad, and could have significant chilling effects in intimidating people who were legitimately helping out with the case. That should be a big concern, and the judge should be exceptionally careful in making the companies reveal info on these email accounts. We've talked in the past about things like the Dendrite rules for determining when possibly identifying info on anonymous people should be allowed, as it sets a high bar that protects a person's right to anonymity. Hopefully the court recognizes that Chevron's requests seem to go too far.

Filed Under: chilling effects, ecuador, email, privacy, steven donziger, subpoenas
Companies: chevron

Iranians Protest Leads To The Return Of Gmail

from the but-still-no-youtube dept

As the fervor over the hateful Innocence Of Muslims movie is beginning to die down, you may have heard that in response to that film the Iranian government blocked access to Gmail. There has been much postulation over why Gmail suddenly became a target, including what seems to be a ridiculous claim from the Iranian Telecommunications Ministry that they were simply trying to put a heavy block on YouTube (it's been blocked since long before this movie showed up). But, as most of us probably expected, Gmail is back on.

Regardless of whether or not the block on Gmail was intentional, the obstruction to one of the world’s most popular email services resulted in many complaints from Iran officials. Legislator Hossein Garousi reportedly threatened to summon Iran’s telecommunications minister Reza Taqipour for parliamentary questioning if the service was not unblocked.

Iran continues to block any site or network that expresses “anti-government views,” including sites like Twitter, Facebook and YouTube, which helped rally citizens and circularize the massive protests following the questionable re-election of President Mahmoud Ahmadinejad.

Now, the blocking of such sites probably doesn't shock any of us anymore. It's unfortunate, but they're doing it. Hell, Iran has previously announced plans to build their very own internet. The good news is that Iranian citizens aren't simply rolling over at their government's heavy-handed censorship of the internet. They know how to use technology to get around the filters too.

Even though YouTube was previously blocked in Iran before the film was released and Gmail access was barred, Reuters reports on the ability of Iranian citizens to “circumvent Internet restrictions” using virtual private network (VPN) software, which makes it appear as if the computer accessing the content is located in another country.

So best of luck to you, Iranian government, because you're going to need it if you think that suppressing thought and the freedom to access an unfettered internet is going to work out for you in the long term. At least you can rest easy knowing that your citizens can't play online roleplaying games. We've got that covered from our end.

Filed Under: email, gmail, internet, iran, protests
Companies: google

DHS Boss, In Charge Of Cybersecurity, Doesn't Use Email Or Any Online Services

from the that-would-be-a-problem dept

We've talked in the past about the problematic efforts to push for new cybersecurity regulations, especially when little to nothing has been done to show the actual problem. There has been quite a turf war over who would "own" cybersecurity within the federal government, with some wanting to give it to the Defense Department, where the NSA would control it (along with all your info), and others wanting to give it to the Department of Homeland Security. While neither option is ideal, DHS is clearly the lesser of two evils should it come to pass. It makes much more sense for this issue to be in the hands of a civilian organization rather than a military one -- especially a military one with a horrible track record when it comes to privacy. That said, it's tough to be enthusiastic about DHS either, given the various problems and abuses we've seen in that Department as well. Making matters even worse, it appears that the DHS boss, Janet Napolitano, who would effectively be in charge of cybersecurity, doesn't know much (if anything) about the internet, and seems rather proud of that fact, referring to herself as a Luddite:

Homeland Security Secretary Janet Napolitano, who is a key player in national cybersecurity efforts, said on Friday she doesn't use e-mail.

"Don't laugh, but I just don't use e-mail at all," she said during a discussion at a Cybersecurity Summit hosted by National Journal and Government Executive. She didn't explain what communications tools she does use.

President Obama, who appointed Napolitano, broke precedent by carrying his own BlackBerry device. But in response to a question about her personal cybersecurity practices, Napolitano said she avoids many online services. "I don't have any of my own accounts. Some would call me a Luddite," she said.

I don't think anyone should be laughing, but perhaps they should be very, very worried. Or, perhaps they should be asking why she's in that job when she doesn't seem to have the necessary experience. If it does come to pass that DHS gets control over new cybersecurity efforts, this seems like a good reason to find someone else who actually has some grasp on what it is that they're regulating.

Filed Under: cybersecurity, dhs, email, homeland security, janet napolitano, luddite, online services

Email: The Original Cloud

from the things-change dept

Email is one of those parts of the internet that have been around for quite some time, and is considered a (if not, the) core piece of how many people communicate. But, if you actually look at the history of email, it's quite amazing how much it's changed over time -- bouncing from a server based setup in the early days to a client/server version and these days back up onto the internet as a "cloud computing" service (the buzzword version of server based). Even if we're just looking at the past 15 years or so, from when web-based email services like Rocketmail and Hotmail first hit the scene, it's quite amazing how much they've changed. But also fascinating is how web-based email pre-dated "cloud services" by more than a decade, but in many ways are one of the key "cloud" services out there.
Ah, the bad old days... Hell, just the change from having to load a new page for each click to today's dynamic/AJAXy interfaces changed the way web email worked. But one of the bigger changes in my mind was the massive expansion in storage. Historically, many people were pretty careful to regularly delete all of their emails to avoid hitting the very small storage limits associated with web email accounts. In fact, a decade ago, I remember conversations about how "expensive" storage was, leading the online accounts to have limits of around 25 megs. The world of online email changed on April Fool's Day in 2004 -- with a gigabyte of storage (this was so much larger than anything anyone else was offering that some thought it might be an April Fool's joke). When it was launched, Google said that people shouldn't ever have to worry about deleting emails again -- and, in fact, Gmail originally buried the delete button such that it was difficult to find.

Of course, as with many innovations, user demand quickly grew to match what was available, and having so much storage started to change the way people viewed email -- not as something where you just kept a few things, but one where you could store your entire email history... and more. The leaders in webmail at the time, Microsoft (who had bought Hotmail) and Yahoo (who had bought Rocketmail), responded to Gmail by expanding their storage as well -- and that's only increased time and time again since then. Both Microsoft and Yahoo eventually went to (virtually) unlimited offerings, while Gmail has boosted its free email storage up to ~10 gigs.

Suddenly, with significantly more storage, new opportunities opened up. Email could become more of a combined task list/timeline for your life. There was no real reason to ever get rid of anything -- and that included being able to store attachments and important files, as more and more people discovered. Rather than just being about email, web-based email really did become the very first truly useful "cloud" service, letting people go way beyond the restrictions of older client/server email systems.

Historically, when computing resources become abundant, it becomes natural for people to "waste" them, and, as such, discover completely new and unexpected uses, and that's absolutely been true of email with such massive storage and the availability of access from anywhere. While "cloud computing" is a more recent term, webmail programs really became a key part of a cloud strategy long before that term came about, and part of that was because of the amount of storage available. Combine "virtually" unlimited storage with a communications interface and you can start to build in more integrated features -- including things like document viewing, storage and creation. Email starts to fulfill its potential as more than just a communication tool to a central life manager.

With lots of companies now pushing cloud services, it still seems like web-based email, the original cloud service, really has the leg up on being the true interface for "the cloud" upon which many other useful cloud services will be built.

Filed Under: cloud computing, email

Biggest Critic Of NBC's Awful Olympic Coverage Has Twitter Account Suspended For Tweeting NBC Exec's Email

from the questionable... dept

One of the loudest critics of NBC Universal's awful Olympics coverage was Guy Adams, who certainly wasn't pulling any punches with his Olympics-related tweets. Either way he was a bit surprised to find his account suspended. When he sought to find out why, he discovered it was because he had tweeted the email address of Gary Zenkel, NBC's exec in charge of the Olympics coverage. Twitter claims that this was the revealing of "private information," in violation of Twitter's terms of service.

Adams, quite rightly, found this to be odd, noting that Zenkel's corporate email address is not private at all. As Deadspin shows in the link above, Adams let Twitter's PR folks know it:

I'm of course happy to abide by Twitter's rules, now and forever. But I don't see how I broke them in this case: I didn't publish a private email address. Just a corporate one, which is widely available to anyone with access to Google, and is identical to one that all of the tens of thousands of NBC Universal employees share.

It's no more "private" than the address I'm emailing you from right now.

Either way, quite worrying that NBC, whose parent company are an Olympic sponsor, are apparently trying (and, in this case, succeeding) in shutting down the Twitter accounts of journliasts who are critical of their Olympic coverage.

Adams also wonders if the suspension happened because of complaints from NBC -- a Twitter partner in this Olympics coverage, remember -- who is upset about Adams' constant berating on Twitter as well as in the publication he writes for, The Independent. In fact, NBC has put out a statement confirming that it filed a complaint about Adams' Twitter account, though Twitter did not need to then suspend his account.

And, of course, as tends to happen in these sorts of situations, Gary Zenkel's email address is now much more widely available because tons of press reports are including it.

Filed Under: account suspended, criticism, email, gary zenkel, guy adams, private info, streisand effect, twitter
Companies: nbc universal, twitter

DailyDirt: Technology In Education

from the urls-we-dig-up dept

The digital revolution of the education system has yet to really take off. Many students communicate with their teachers via email and have figured out how to use word processors (instead of typewriters), but the widespread use of technology in classrooms hasn't exactly caught on. Cool projects like the Khan Academy are starting to ramp up, but introducing cheap laptops or ebooks into public schools hasn't met with wild success. (Though, if you've heard of any inspiring programs, let us know in the comments.)

• Peru spent $225 million on an education initiative that involved One Laptop per Child and 850,000 basic laptops for schools throughout the country. Unfortunately, the results so far have not shown much improvement in math or reading scores. [url]
• India's $35 tablet, the Aakash, is being revised and will probably cost closer to $50. The next version will be called 'Aakash 2' (not the 'new Aakash') and offer a capacitative touch screen. [url]
• Wilco Electronics is bidding on a contract to make Aakash tablets and to create a pilot program for these devices in underserved Philadelphia schools. But if Peru is any indication of what will happen.... [url]
• To discover more interesting education-related content, check out what's currently floating around the StumbleUpon universe. [url]  

By the way, StumbleUpon can recommend some good Techdirt articles, too.

Filed Under: education, email, india, peru, tablets
Companies: khan academy, one laptop per child, wilco electronics

Celebrating 20 Years Of Patent-Free Email Attachments

from the true-spirit-of-innovation dept

Tech innovation happens in layers. The internet was built to make computers more useful, the web was built to make the internet more useful, social media (for example) was built to make the web more useful, other online services are built to make social media more useful, and so on. This kind of incremental improvement is always faster and more efficient when the last round of innovations is open and accessible to a new generation of developers—contrary to the claims of patent-system supporters who insist that protection is necessary to promote progress.

Such claims look the most ridiculous when you consider the fundamental technologies of the digital world. The high user counts of the latest web startups are nothing compared to the underlying communication protocols that make them and every other online service possible. A big part of the reason these technologies have become so widespread, and created a reliable foundation on which others can build, is that they were free to use. Last year, after the 20th anniversary of Tim Berners-Lee's invention of the world wide web, we wondered what the online world would look like today if he had locked the technology up behind a patent. A similar question is raised this month as we mark another 20th anniversary: that of the Multipurpose Internet Mail Extension protocol, better known as MIME, the technology that powers every single email attachment.

TechWeekEurope spoke to Nathaniel Borenstein, MIME's creator, about why he built the technology and what he thinks of its massive adoption. Like Berners-Lee, and indeed most "old-guard" internet engineers, Borenstein's attitude is one of openness and genuine, useful problem solving:

Mostly, [MIME] was a natural continuation of things I was pursuing. I wanted to live in a world where certain functionality existed.

When people asked me, "why do you work so hard on this?" I used to say that someday I'm going to have grandchildren, and I wanted to get their pictures by e-mail. A lot of people laughed, because it was inconceivable back then. No one even thought of digital cameras, so people pictured taking a print and scanning it in, and then transmitting it over their 1200 baud modem, and even that was expensive equipment.

Borenstein notes that the real challenge of developing MIME wasn't the engineering aspect, but the difficulty of getting everyone to agree to a single standard. By coming up with a clever solution and making it free and open-source, he succeeded, and now the entire world of email relies on MIME. Some might see his situation and think he got a raw deal, and that if he had patented MIME he could be pulling fat checks—but he knows it doesn't work that way:

The most common question I get about MIME is, "have you ever imagined what it would be like if you got a penny every time MIME was used?" And the answer is oh yeah, I imagined that (laughs). I did some checking up, and there's an estimate that MIME is used a trillion times every day. So if I got a penny every time, my annual income would be roughly equal to the GDP of Germany. But of course, that's just a silly fantasy. If there was any money involved, it would never have succeeded. Somebody would have been motivated to develop a similar thing for free.

This is the attitude of a true innovator. Borenstein developed MIME because he saw a problem that he wanted to solve—and he knew his solution wouldn't be of much use to anyone if he demanded an ongoing monopoly on it. Contrast that with trolls who obtain patents on abstract ideas and demand a cut from companies that are actually implementing them, and you see why the very nature of technology patents is opposed to their stated goal of promoting innovation. Today's true innovators recognize this, but the broken system forces them to pursue patents anyway, lest someone else try to patent their idea out from under them and use it to hold them back.

As we mark the anniversaries of fundamental online technologies like MIME, which have benefited the world and driven innovation by remaining free and open, maybe it's time to look at today's patent system, and update it to reflect the way technological progress really happens.

Filed Under: attachments, email, mime, nathaniel borenstein, patents

A Cracked Look At The Impact Of Spam

from the you've-got-some-insight-on-your-comedy dept

As you may know, I'm a pretty big fan of Cracked.com. They also share a lot of values with Techdirt. Recently, they published an angry tirade against spammers that's also an interesting look at how years of steadily-increasing crap have shaped user habits and expectations online. Examples include things like browser toolbars, which are almost universally hated and yet still bundled with lots of software and foisted upon users during the install process, often through a confusing combination of checkboxes and accept/decline buttons:

Can you imagine how we would jump down the throat of any real-world business that tried that shit? Imagine ordering your lunch at McDonald's, but when they got to the "fries" question, they phrased it as, "Don't you not want to not have fries with that?" Then, no matter how you answered that ridiculous triple negative, they told you, "By pulling forward to the next window, you are agreeing to buy fries" and shoved them into your car anyway, claiming, "No, you said you wanted them, so now you have to pay for them. No take-backs!" Also, the fries are poison.

It also takes on the fact that most web users ignore virtually all advertising, since so much of it is untrustworthy to a degree that old media rarely reached:

On TV, even if the ad is laced with misleading information (no, Axe Body Spray probably won't lead to instant female-on-male street rape), at least we know that the product is real. Toyota isn't selling you a cardboard car. If you order one of those stupid robe/blanket things, they're going to deliver that retarded, sex-repellant monstrosity to your house. The few ads that do reek of scam are the late night commercials (Enzyte, bullshit diet scams, one-year online colleges), and at least you know when they're coming. You can separate them from the legitimate products. On the net, you just have to assume that everything you see is out to screw you, the only exceptions being brands that you already know.

It's an entertaining read, and one that underlines one of the biggest ways online advertising is different from traditional advertising. When space was limited, the battle was for exposure; when space is unlimited, the battle is for trust and relevance in an increasingly uncertain and noisy world.

Filed Under: cracked, email, spam