President Obama To Encourage Cybersecurity Information Sharing, Highlighting Why We Don't Need CISPA

from the don't-destroy-privacy-in-the-name-of-cybersecurity dept

There's a big "White House Cybersecurity Summit" down the road at Stanford today, where the President will release the details of a new executive order promoting "a framework for sharing information about cyber threats" which the administration hopes will lead organizations to better protect their data from malicious hacks.

The new executive order encourages businesses to form "information sharing and analysis organizations," or ISAOs, which would gather data about hacking attacks and share it with companies and the government.

And, of course, a bunch of companies are going to announce that they're doing just that:

A number of companies will announce Friday that they are incorporating the administration's cybersecurity framework, which was created after a 2013 executive order, into their companies. The framework helps businesses decide how to use cybersecurity investments, ways to implement cybersecurity for new companies and measure their programs against others. Intel, Apple and Bank of America use framework and will announce that they will require all vendors to use it. Both QVC and Walgreens will say they will employ the framework in their risk management practices, while Kaiser Permanente will commit to using it as well.

Of course, if you've been following the big fights over the past few years on cybersecurity legislation, you'll know that such "information sharing" has been a key component in most of the proposed bills, none of which have become law. Most of the bills have focused on one key thing: giving companies liability protection, so that they can't be sued over the information they share. From the beginning, however, we've asked a pretty simple question that no one has answered: what is currently preventing companies from sharing such threat information?

The answer, as reinforced by this move today by the White House, is absolutely nothing. Companies can (and in some cases already do) share "threat" information, and having them do so in a more organized fashion to prevent malicious attacks is, in fact, a good idea. What's not needed is a law that basically gives blanket immunity for companies to share almost any information to any government agency. That's been the problem with CISPA, CISA and similar bills: they're not about truly making information sharing about threats easier, since that can be done already. They're about giving blanket cover for companies to share even more information with government agencies such as the NSA.

With this new executive order and companies adopting the suggested framework, many of the "benefits" backers of cybersecurity legislation talk about will happen without the need for any new legislation. True threat information can be shared and companies can get wiser about protecting their information. But it doesn't give them blanket immunity if they start handing over other information to the government for other purposes, such as surveillance. That's important.

Yes, working together to prevent the growing number of online attacks is important. But that should never be used as a backdoor process to enable greater surveillance. Doing it this way, rather than by passing a questionable law, seems like a much more reasonable first step.

Filed Under: cisa, cispa, cybersecurity, cybersecurity summit, cyberthreat information, dhs, executive order, information sharing, obama administration, president obama, white house

Homeland Security Totally Misunderstands Trademark Law; Seizes Perfectly Legal Sporting Goods Anyway

from the because-fuck-you,-we've-got-guns dept

Homeland Security's Immigration & Customs Enforcement group (ICE) has a history of seizing stuff without understanding even the most basic concepts around intellectual property. After all, these are the same meatheads who seized some blogs for alleged copyright infringement, and then had to return some of them over a year later, after they realized it was a mistake. ICE also has a history of using big sporting events to kiss up to the multi-billion dollar sports organizations by shutting down small businesses, protecting Americans from unlicensed underwear. And, of course, what bigger sporting event is there than the Super Bowl. Every year they make a bunch of seizures related to the Superbowl, and this year was no different.

ICE agents gleefully were patrolling Phoenix looking for clothes to seize. But there was just one, rather large, problem with how they went about it. It appears that the people in charge of all this, didn't know the first thing about the "law" they were supposedly enforcing. Seizing counterfeits is about stopping trademark infringement. But not everything using a trademark is infringing. Trademark, after all, is a form of a consumer protection law, designed to protect people from buying one thing, believing it's another. If there's no likelihood of confusion, then ICE isn't supposed to be seizing it (and, yes, there is also dilution of trademark, but ICE isn't supposed to be seizing products that dilute someone's trademark -- just those that are "counterfeit"). But that's not, apparently, how ICE sees things:

The profane debasing of a mascot — and really anything that denigrates a team — is guaranteed to be contraband, said Daniel Modricker, a spokesman for US Immigration and Customs Enforcement. That “Yankees Suck” T-shirt you put on for special occasions? If it uses anything that looks like a team or league logo, it probably constitutes trademark infringement.

Almost all of that is wrong. Using someone else's trademark to comment on them is a perfectly legal use -- and not at all counterfeit. Pretending otherwise gets into some pretty sketchy First Amendment areas, as using a trademarked word, phrase or image to criticize someone is considered protected. But, not to ICE. As Rebecca Tushnet explains:

"Profane debasing"--and when did mascots become sacred?--is not confusing. I don't think ICE has authority to seize diluting merchandise, and anyway very few of these will be using the profaned mascots "as a mark," meaning the dilution exceptions for parody and criticism apply. This is a blatant misunderstanding of the law, being perpetuated by a federal official with only the small reassurance that federal agents won't come down and rip a previously purchased shirt off your back.

Of course, the small time vendor with a table on the street isn't likely to challenge the federal government for stealing his perfectly legal shirts that "debase" a mascot. So ICE's Daniel Modricker gets to spew his ignorant and wrong statements and get away with it. Because ICE is ICE, and this is generally how it goes about its business. It has the guns and it gets to decide the law, no matter what the Constitution has to say about it.

Filed Under: counterfeit, daniel modricker, dhs, first amendment, free speech, homeland security, ice, mascots, seizures, super bowl, trademark

Redactions To Report On TSA's Internal Security Failures Prompts Angry Response From Inspector General

from the do-what-thou-wilt,-or-mostly-don't;-that-is-the-whole-of-the-policy dept

The DHS's Inspector General has finally released a report [pdf link] on the agency's control of TSA information systems at JFK International Airport. It's been delayed several times, mainly because of (now former) TSA head John Pistole's refusal to communicate with the Inspector General's office.

This report -- which has a release date of January 16, 2015 -- was actually completed on July 22, 2014. It was turned over to the TSA's CIO for a review, which should have been concluded within 30 days. The DHS Chief of Staff asked for additional time after failing to meet this deadline. The Inspector General granted another 30 days, making the new deadline September 17.

This revised due date came and went without a response from the TSA. On October 20th, the TSA finally produced its approved version of the IG's report, but not without several redactions of supposed SSI (Sensitive Security Information). The IG formally challenged the redactions in a November memo to John Pistole. Pistole never responded. Another memo was issued in December, which was also ignored by the TSA chief.

Finally, five months after its sensitive information review, the report was returned to the IG's office. All of the challenged redactions remained.

The IG's letter, which opens up the report, expresses his displeasure at the TSA's stalling tactics and secrecy.

I am disappointed in both the substance of the decision as well as its lack of timeliness. In 2006, Congress, concerned about delays in appeals of this nature, directed the Department to revise DHS Management Directive 11056.1 to require TSA to require timely SSI reviews. Given the clear requirement for timely SSI reviews in response to requests from the public, we hoped that TSA would approach an SSI appeal from the Inspector General with similar diligence, especially because TSA was aware of our deadlines.

Now, to meet our reporting requirement, we are compelled to publish a redacted report with SSI markings and will again ask the head of TSA to overrule the SSI program office's decision.

I believe that this report should be released in its entirety in the public domain. I challenged TSA's determination because this type of information has been disclosed in other reports without objection from TSA, and because the language marked SSI reveals generic, non-specific vulnerabilities that are common to virtually all systems and would not be detrimental to transportation security. My auditors, who are experts in computer security, have assured me that the redacted information would not compromise transportation security. Our ability to issue reports that are transparent, without unduly restricting information, is key to accomplishing our mission.

So, here we have a clear case of the TSA thwarting its own oversight in order to withhold information from the public. These are the sorts of things the TSA doesn't want you to see.




The TSA believes that exposing this information (such as the locations of its unsecured areas) will create a security risk, but it doesn't explain how that would be any different from the state the areas were in when the OIG inspected them. Unless JFK's TSA staff haven't taken any steps, the issues pointed out in the report like exposing the location of these areas (and, I don't know, CLOSING AND LOCKING DOORS), shouldn't matter.

As for redacting the number of vulnerabilities found in the TSA's servers, the only plausible explanation is that every number in those blacked-out charts is higher than agency feels comfortable disclosing. Whether the number is 2 or 9 really doesn't matter. (In one total column, it's obviously a two-digit number.) It only takes one hole to compromise a system.

While the TSA managed to withhold some information, much of what's left untouched isn't exactly flattering. The TSA's "security theater" apparently extends to its internal operations. We know the TSA generally "catches" terrorists by allowing airborne passengers do all the heavy lifting. This same "work ethic" applies to securing its own systems. From the looks of what the IG found, TSA agents at JFK apparently believe internal security is someone else's job and even the most basic of controls haven't been implemented.

At JFK, TSA did not have visitor logs in any of its communication rooms to document the entry and exit of visitors to these rooms that contain sensitive IT equipment.

[...]

Fire protection, detection, and suppression controls were not present in many TSA communication rooms. Specifically, 14 of the 21 rooms inspected that contained sensitive equipment did not have fire extinguishers…

Compounding the issue of fire detection and mitigation, only 7 of 21 the rooms inspected contained smoke detectors. Smoke detectors alert the appropriate personnel of a potential fire and possible hazard.

[...]

Several TSA communication closets located in the JFK terminals contained storage items and cleaning supplies. For example, we found TSA equipment on top of an unlocked TSA telecommunication cabinet surrounded by a ladder, boxes, trash, and cleaning supplies. The ladder, boxes, and cleaning supplies are all harmful to IT equipment. Additionally, there was no sign in sheet, and non-TSA personnel used the room for equipment storage.

TSA did not have an operable uninterruptible power supply (UPS) in three communication cabinets…

A sensitive equipment cabinet located in a public area was unlocked and left open to run an extension cord to a nearby electrical outlet for power.

The door to the secure Explosive Detection Systems room, where TSA reviews x-ray images of luggage to determine if suspicious checked luggage requires additional inspection, was propped open to vent a portable air conditioning unit, violating physical security controls.

The IG makes several recommendations, most of which can be boiled down to four words: FOLLOW EXISTING DHS POLICIES.

Since this report contains inspections of every other DHS agency with operations at the JFK airport, similar faults were found for both CBP (Customs and Border Protection) and ICE (Immigrations and Customs Enforcement). However, one agency managed to pass inspection: the Secret Service.

USSS fully complied with DHS operational, technical, and management operational policies for its telecommunication room at JFK. We audited IT security controls of the USSS telecommunication room located at the JFK on-site building number 75. This location had a DHS OneNet connection and a network switch device. The telecommunications room was clean and well maintained. Visitor’s logs were also maintained. Humidity and temperature sensor readings were within DHS policy guidelines. Since, the JFK location did not have an on-site server, vulnerability scans were not applicable.

Say what you will about its inability to secure the White House, but the Secret Service -- which oversees travel of dignitaries and government officials on over 800 flights per year -- has its JFK operations locked down tight.

What we have detailed here is another security agency making an effort to thwart its oversight. The TSA managed to delay a critical report by 6 months and withhold supposedly "sensitive" information over the repeated protests of the Inspector General. In doing so, it has shown Americans who really holds the power in Washington -- and it isn't these agencies' internal and external oversight.

Filed Under: dhs, inspector general, redactions, tsa

The DHS Wants To Pitch In With The Cyberwar But Can't Even Be Bothered To Secure Its Own Backyard

from the safe-as-homelands dept

The US government has basically declared war over the Sony hacking, offering full-throated support for the beleaguered embarrassed company. Why this one -- rather than the countless hacks of corporate networks (including those where credit card data and personal information were compromised) -- remains a mystery.

The end result has been a call for more government intrusion and a reanimation of CISPA's lumbering corpse. "Share with us," says the government. "Gird yourself for the cyber Pearl Harbor," say its supporters. "Let us handle it," say those whose desire for expanded government power exceeds their crippling myopia.

Yeah, let's do that. Let's allow the government to set the rules on cybersecurity. Let's give agencies like the DHS -- which can't even be bothered to secure its own assets -- more leeway to investigate and react to cyberthreats. (h/t to NextGov)

DHS lacks a strategy that: (1) defines the problem, (2) identifies the roles and responsibilities, (3) analyzes the resources needed, and (4) identifies a methodology for assessing this cyber risk. A strategy is a starting point in addressing this risk. The absence of a strategy that clearly defines the roles and responsibilities of key components within DHS has contributed to a lack of action within the Department. For example, no one within DHS is assessing or addressing cyber risk to building and access control systems particularly at the nearly 9,000 federal facilities protected by the Federal Protective Service (FPS) as of October 2014.

That's the Government Accountability Office's assessment of the DHS's qualifications as a potential cybersecurity agency. [pdf link] This is the agency tasked with securing federal assets and ensuring the safety of not only government employees, but Americans in general. And it can't do it. In fact, it can't even begin to do it.

Despite being specifically directed by 2002's Federal Information Security Management Act (FIMSA) to periodically assess risks, report on them and DO SOMETHING ABOUT IT, the agency has managed to blunder into 2015 with no specific plan to tackle cyberthreats to the federal buildings under its protection.

And, while the President and those pushing the revived CISPA seem rather keen on "sharing info," it's a one-way street, apparently. The DHS can't even be bothered to share with other government agencies.

The Interagency Security Committee (ISC), which is housed within DHS and is responsible for developing physical security standards for nonmilitary federal facilities, has not incorporated cyber threats to building and access control systems in its Design-Basis Threat report that identifies numerous undesirable events.

Whatever the DHS/ISC has managed to glean from situations like 2009's hacking of a Dallas hospital's HVAC system or 2006's hacking of Los Angeles traffic signals hasn't been passed on to other government agencies because the ISC believes "active shooters" and "workplace violence" are bigger threats. Maybe so, in terms of actual physical violence, but that's no excuse for ignoring something the government as a whole considers to be its next battlefield.

So, why is the DHS so bad at this? It would seem to be two things: the DHS is too big to move at the speed the threat mandates and it's always someone else's job. Because it has failed to take charge of the situation (despite a federal mandate and a 2013 presidential policy directive [p. 8-9]), no one seems to know what to do, how to do it or even who should do it.

[B]ecause DHS has not developed a strategy, several components within DHS have made different assertions about their roles and responsibilities. For example, FPS’s Deputy Director for Policy and Programs said that FPS’s authority includes cybersecurity. However, FPS is not assessing cyber risk because, according to this official, it does not have the expertise. Furthermore, although ICS-CERT has developed a tool to assess cyber risk, it also is not assessing cyber risk to building and access control systems at federal facilities. Moreover, NPPD’s Federal Network Resilience is to, among other things, identify common cybersecurity requirements across the federal government, but it also is not working on issues regarding the cyber risk of building and access control systems in the federal government.

An official from the Office of the Under Secretary of NPPD acknowledged that NPPD has not yet determined roles and responsibilities, including what entity should conduct cyber risk assessments of FPS-protected facilities or what assessment tool should be used. This official said that the Department has not developed a strategy, in part, because cyber threats involving building and access control systems are an emerging issue.

Somehow, despite being well-financed and incredibly large, the DHS can't find the time to properly assess the facilities it's supposed to be "securing."

Moreover, GSA [General Services Administration -- reports to the DHS] has not conducted security control assessments for all of its systems that are in about 1,500 FPS- protected facilities. In November 2014, GSA information technology officials said that from 2009 to 2014, the agency conducted 110 security assessments of the building control systems that are in about 500 of its 1,500 facilities. GSA has not yet assessed the security of control systems with network or Internet connections in about 200 buildings. GSA officials stated that they plan to assess these systems during fiscal year 2015.

The GSA isn't just being outpaced by hackers. It's being outpaced by the government's own slow stagger into the connected future. 800 systems are expected to switch from "standalone" to networked in the near future. The GSA plans to re-assess these systems' security after the changeover, but it's still working its way through the last half-decade's backlog. With its parent agency unable to provide guidance and its other agencies unwilling to share information, the GSA becomes the third prong in this triumvirate of failure.

And what it does actually get around to assessing isn't much help, either. Being crossed off the GSA's to-do list means being no more safe than you were before the agency finally strolled through the door.

Further, our review of 20 of 110 of GSA’s security assessment reports (between 2010 and 2014) show that they were not comprehensive and not fully consistent with NIST guidelines. For example, in 5 of the 20 reports we reviewed, GSA assessed the building control device to determine if a user’s identity and password were required for login but did not assess the device to determine if password complexity rules were enforced. This could potentially lead to weak or insecure passwords being used to secure building control devices.

GSA also conducted its assessments of building control systems in a laboratory setting which allowed it to test components and to identify weaknesses in their default configuration. However, GSA does not conduct further assessments after installation when configuration settings may no longer reflect their default values. As a result, GSA has limited assurance that the configurations assessed reflect the configurations implemented in the facility, thereby increasing the risk that vulnerabilities in building control systems may not be detected.

This is the government that wants the nation's companies to "partner up" against cyberthreats and cyberterrorism: the same government that can't even ensure its own infrastructure is protected. And no one cares because compromising control systems doesn't make for very sexy copy or hawkish soundbites about being "tough on cybercrime."

If you need a solid argument against the government's desire to play the part of (cyber)security guard to the nation's companies, look no further than the GAO's list of "Related GAO Products" (p. 34) that follows this report.

Maritime Critical Infrastructure Protection: DHS Needs to Better Address Port Cybersecurity. GAO-14-459. Washington, D.C.: June 5, 2014.

Information Security: Agencies Need to Improve Cyber Incident Response Practices. GAO-14-354. Washington, D.C.: April 30, 2014.

Federal Information Security: Mixed Progress in Implementing Program Components; Improved Metrics Needed to Measure Effectiveness. GAO-13-776. Washington, D.C.: September 26, 2013.

Cybersecurity: National Strategy, Roles, and Responsibilities Need to BeBetter Defined and More Effectively Implemented. GAO-13-187. Washington, D.C.: February 14, 2013.

Cybersecurity: Threats Impacting the Nation. GAO-12-666T. April 24, 2012.

Cybersecurity: Continued Attention Needed to Protect Our Nation’s Critical Infrastructure. GAO-11-865T. Washington, D.C.: July 26, 2011.

Information Security: TVA Needs to Address Weaknesses in Control Systems and Networks. GAO-08-526. Washington, D.C.: May 21, 2008.

Critical Infrastructure Protection: Multiple Efforts to Secure Control Systems Are Under Way, but Challenges Remain. GAO-07-1036. Washington, D.C.: September 10, 2007.

The government doesn't have the skills necessary to ply its wares in the cybersecurity business. If it can't lock down its own assets -- despite seemingly limitless funding and manpower -- it has nothing to offer the private sector but intrusiveness and harmful regulation.

Now, if you're a fan of bad news, you're going to love the worse news. The fight over who should head up the government's War on All Things Cyber doesn't put the DHS at the front of the list -- but it's not because the agency clearly can't handle the job. It's because agencies that are even more intrusive than the DHS want a piece of the action, namely the FBI and the NSA. If either of these two end up in that position, expect to find domestic surveillance rules relaxed. The latter agency defines cybersecurity as "peeking in at everyone," which is at odds with those on the receiving end (US companies) who believe being secure means removing backdoors or otherwise locking everyone out, not just the "bad guys." That isn't going to sit well with the FBI and NSA -- one of which believes no one should be able to "lock out" law enforcement and one that intercepts hardware and inserts backdoors when not deploying malware for the same purpose. So, the DHS may be the lesser of three evils, if only because its incompetence exceeds its reach.

Filed Under: cispa, cybersecurity, dhs

DHS Watchdog Says Border Patrol's Drones Are Expensive, Useless

from the 'just-like-your-mom,'-the-report-DIDN'T-add dept

The CBP's drone squadron has been a tightly-held secret. Documents have been pried loose by FOIA lawsuits, but it's pretty clear the DHS and the CBP would rather not discuss its flying surveillance technology. Not that the CBP drones are strictly for patrolling our nation's borders. They've been spotted far inland, being used by law enforcement agencies taking advantage of the CBP's drone lending library.

Finally, more details on the CBP's drones have made their way into the public domain, thanks to an Office of the Inspector General report. [pdf link] The information contained in this document points to two seeming contradictions, albeit the sort of contradictions often found in government agencies that run long on Congressional support but short on effective oversight.

They're expensive:

We estimate that, in fiscal year 2013, it cost at least $62.5 million to operate the program, or about $12,255 per hour.

And they're worthless:

Given the cost of the Unmanned Aircraft System program and its unproven effectiveness, CBP should reconsider its plan to expand the program. The $443 million that CBP plans to spend on program expansion could be put to better use by investing in alternatives, such as manned aircraft and ground surveillance assets.

This table makes it completely clear how little this technology has contributed to safer borders.


The drone program began with the assumption that long-range eyes in the sky would be cheaper than running agents all over the place. Supposedly, the drones would be able to cover areas that wouldn't be feasible using humans and ground vehicles. The CBP has 7,000 miles of land borders and 2,000 miles of coastal waters to cover, but its long-range drones, for the most part, kept an eye on only two very small areas.

[A]ccording to CBP, in FY 2013 UAS operations along the 1,993-mile southwest border focused on about 100 miles of Arizona border and operations in Texas concentrated on about 70 miles of that state’s border.

The OIG found that the CBP's enthusiasm for drones far exceeded the agency's grasp. It envisioned nearly round-the-clock surveillance over large areas. It delivered minimal coverage for nearly $13,000/hour.

[T]he unmanned aircraft logged a combined total of 5,102 flight hours, or about 80 percent less than what OAM anticipated.

The OAM (CBP's Office of Air and Marine) blames budget constraints. It wants $443 million to acquire more drones and keep the ones it has airborne more often. But the OAM seemingly has no idea what its actual costs are, much less what it might need to reach its 16-hour-a-day goal. It underreported drone operating costs to the OIG by nearly $10,000/hour. And yet, it wants to be trusted with more money and more toys.

The Office of Air and Marine’s calculation of $2,468 per flight hour does not include operating costs, such as the costs of pilots, equipment, and overhead. By not including all operating costs, CBP also cannot accurately assess the program’s cost effectiveness or make informed decisions about program expansion.

Even with 5,100 hours of flight time being logged, the eyes in the sky contributed to only 2,300 apprehensions. The CBP's ground forces made over 10 times as many apprehensions. An apprehension for every half-hour of flight time is a pretty good ratio (said here without any meaningful stats to compare it to), but that works out to about $6,000 per detainment -- hardly an indicator of efficiency.

The CBP argues that apprehensions aren't a good measure of the drones' value. It prefers to use "detections." All well and good, but even though that number is higher (18,239), the agency was unable to demonstrate to the OIG that there was a meaningful connection between what the drones "saw" and effective border enforcement. The OIG notes the CBP's objection, but still sticks with the lower apprehension measurement.

The CBP also claims drug seizures to be a better measuring stick of effectiveness than apprehensions, but even this self-selected metric is underwhelming.


The report also calls out the CBP for vastly misrepresenting the amount of area covered by its drones.

According to CBP, our statements that unmanned aircraft are not operating along the entire southwest border are inaccurate. CBP said OAM has authorization to fly, and has flown, the unmanned aircraft along every stretch of the southwest border, from California to the Texas gulf coast.

OAM provided additional flight hour information that showed 44.6 hours flown over California and 3.8 hours flown over New Mexico. The California hours involved an unmanned aircraft flying over that state to conduct missions over water off the state’s southern coast. We do not know what the 3.8 hours over New Mexico flight hours involved. OAM did not provide information that showed surveillance missions in either of these states.

We believe it is misleading for CBP to report that its unmanned aircraft operate over every stretch of the southwest border when these flights appear to be simply on the way to another mission.

It's not that drones are completely useless. It's that these particular ones are. Ars Technica quotes drone law expert Brendan Schulman:

"Smaller drones, used in closer proximity to border areas, may turn out to be far more efficient and effective at this type of mission," he wrote in an e-mail. "The Predator is a very large airframe that is over a decade old. One of the recommendations of the report is to conduct a study on whether investments in alternatives, such as manned aircraft and ground technologies, might work better. Newer, low-cost drones that have been developed over the past year or two might be another alternative worth investigating."

The best thing the CBP can do at this point is drop its defensiveness about its underutilized (but overhyped) drone program. There is no doubt the agency will continue to use drones, but it needs cheaper and more agile technology. And while it's updating its fleet, it should also update its Privacy Impact Assessment. We know the FBI has yet to make its public, and the CBP's current PIA makes no mention of its drone lending program -- nor does it require similar assessments from those it lends its fleet (and operators) to.

Drones will continue to be a part of border surveillance, but just because they're inescapable doesn't mean the CBP is justified in its insistence on throwing more money at a program that clearly needs a major overhaul.

Filed Under: border patrol, dhs, drones

After A Temporary Show Of Enthusiasm, Government Lapses Back Into Not Caring About The Militarization Of The Nation's Police

from the faint-signs-of-life dept

It's an idea that almost makes sense, provided you don't examine it too closely. America's neverending series of intervention actions and pseudo-wars has created a wealth of military surplus -- some outdated, some merely more than what was needed. Rather than simply scrap the merchandise or offload it at cut-rate prices to other countries' militaries (and face the not-unheard-of possibility that those same weapons/vehicles might be used against us), the US government decided to distribute it to those fighting the war (on drugs, mostly) at home: law enforcement agencies.

What could possibly go wrong?

Well, it quickly became a way to turn police departments into low-rent military operations. Law enforcement officials sold fear and bought assault rifles, tear gas, grenade launchers and armored vehicles. They painted vivid pictures of well-armed drug cabals and terrorists, both domestic and otherwise, steadily encroaching on the everyday lives of the public, outmanning and outgunning the servers and protectors.

It worked. The Department of Homeland Security was so flattered by the parroting of its terrorist/domestic extremist talking points that it handed out generous grants and ignored incongruities, like a town of 23,000 requesting an armored BearCat because its annual Pumpkinfest might be a terrorist target.

Then the Ferguson protests began after Michael Brown's shooting in August, and the media was suddenly awash in images of camouflage-clad cops riding armored vehicles while pointing weapons at protesters, looking for all the world like martial law had been declared and the military had arrived to quell dissent and maintain control.

This prompted a discussion that actually reached the halls of Congress. For a brief moment, it looked like there might be a unified movement to overhaul the mostly-uncontrolled military equipment re-gifting program. But now that the indictment has been denied and the city of Ferguson is looted and burning, those concerns appear to have been forgotten.

Lawmakers vowed changes to the Pentagon programs that deliver military-grade equipment to local police after images of cops climbing out of armored vehicles with military-grade weapons filtered out of Ferguson, Missouri, in August.

But months later, the chaotic 1033 program — which sends surplus military gear built for combat to local police forces with little oversight — hasn’t changed at all.

The 113th Congress will end without substantive changes to the program. The White House hasn’t announced the results of its policy review. The flow of billions in technology designed for the battlefield to local police forces will go on unabated.

While some legislators got caught up in the moment, others have been fighting this battle for much longer. Rep. Hank Johnson has been pushing for an overhaul since late last year, when he had the dubious "privilege" of walking behind some repurposed military equipment during a small town Christmas parade. This not being an issue du jour for Johnson has helped his credibility, but has had little real impact. Even those whose legislation pursuits aren't a product of the prevailing winds still find the prevailing winds to be a frustration.

“We were ready to introduce that legislation just before we left for the August break, but my staff and I decided to wait until we returned into session before we actually filed it. So during that time, of course, Ferguson happened,” Johnson told BuzzFeed News. “When Ferguson happened it was a visual display of what my legislation was attempting to stop, and that was the free-flow of military-grade weaponry onto the streets of America. … Then we were able to get some bipartisan interest in this bill.”

From that point, there was a brief period of intense bipartisan momentum to investigate and change the program — before that momentum hit a wall.

Others -- including President Obama -- promised to look into the program. Obama ordered the first top-level review of the Pentagon's 1033 program in over 20 years, but weeks later, there's been nothing reported.

Police organizations have ramped up their support of the program, throwing fear into politicians who know that coming across as anti-police doesn't gain them much support from the demographic that actually votes in large numbers. A mid-term election has also added to the problem, with new membership changing priorities and old supporters finding themselves looking for day jobs.

The government returns to stasis. Police militarization continues to remain on the public's radar, something clearly not reflected by their representatives. And when the representatives do show some awareness of the warlike agencies prowling the nation's cities under the guise of law enforcement, what will they see? They'll see images of Officer Wilson standing over the body of the unarmed man he shot replaced by images of used car lots on fire and looters grabbing essentials like hair care products and Funyuns from local businesses. In short, they'll see all the justification they'll ever need to see.

2,200 National Guard troops are on their way to Ferguson and any appearance of military weapons and vehicles now appears completely justified, even if police officers have handled riots for years without these Pentagon-supplied luxuries. By the time life returns to normal, the difference between "armed occupying force" and "peace officers" will have shrunk even further.

Filed Under: 1033, congress, dhs, homeland security, militarization, police, police brutality, police militarization

Employee Fired After Posting Pictures Of DHS Vehicles Parked In Hotel Parking Lot

from the no-expectation-of-privacy...-or-security dept

What happens in public isn't afforded an expectation of privacy -- unless you're the Department of Homeland Security. The DHS is all about shutting down people taking photos in, around or of public structures. According to the many piles of useless paperwork compiled by the many useless Fusion Centers, the most effective terrorist weapon is any device that captures still images or video.

The nation is loaded with phone-wielding terrorists. But thanks to the swift corrective action applied by a former Secret Service agent and the multi-billion dollar agency, guests at the Drury Park Plaza Hotel in Chesterfield, Missouri, are safe from the terrorist activity of 28-year-old US Navy veteran (and now, former hotel Houseman) Mark Paffrath.

Mark says that on Thursday after work he snapped 2 photographs and a short video of several dozen Homeland Security vehicles in the parking garage. He then uploaded them to his Facebook page. In his post he writes "why are all the cop cars here...I wonder if it has anything to do with Ferguson", he also included the hashtags #Ferguson #NoJusticeNoPeace.

Hooray for the First Amendment! … oh, wait.

On Friday, shortly after arriving to work at the Drury Plaza Hotel, Mark stated that he was called to the office of Jeff Baker, the General Manager. Upon arriving Mr. Baker advised Mark that he needed to remove the photos and video from Facebook. Mark immediately complied and removed the post. Mark then continued and finished his shift.

A private company decides to insert itself into a situation where no one -- not even the DHS -- needed to step in. Having achieved its goal of suppression, one would think the story ends here. But it doesn't.

Saturday, Mark stated after being at work no more than 30 minutes, he was again called to the General Manager's office. Waiting for him was Jim Bohnert, Director of Security for Drury Hotels Company, LLC. Mark told ASN that Mr. Bohnert advised him that his Facebook posts almost cost the company a $150,000 contract with the Department of Homeland Security and because of this he was being terminated.

Jim Bohnert -- formerly of the Secret Service and the St. Louis Police Department -- had more to say on the matter. He called the former military member a "terrorist" and told him he had "dishonorably served his country" by posting pictures of vehicles parked in a garage where any guest or employee of the hotel could have seen them. In fact, any member of the public could have seen them simply by entering the garage, which is not secured. Argus Streaming News writers were able to see "over 100" DHS vehicles in the garage while driving through it on their way to speak to the hotel's manager.

Bohnert also threatened Paffrath with arrest if the photos were reposted (presumably by someone with more power than Director of Security for Drury Hotels, Bohnert's current position).

Now, it's quite obvious the DHS was unhappy that someone gave away their super-secret hideout, one that is a) a structure accessible by the public and b) littered with dozens of vehicles clearly marked as belonging to the DHS. If secrecy is what the DHS agents were looking for, maybe they should have arranged for a fleet of less clearly-marked vehicles. You can't -- at least not logically -- roll up in a DHS convoy and then demand that no one acknowledge this fact or speak about it to the outside world.

Apparently, hotel management thought this was a containable circumstance. A message written to hotel employees by a supervisor notes several things, the first of which is the open acknowledgement that employees are going to want to talk about a hotel full of DHS agents.

Mark told ASN that there is a large whiteboard which the hotel management writes notices to employees and on Friday, after he was told to remove the Facebook post the Front End Manager wrote a message that reads "The Department of Homeland Security Group: Confidential in nature, which means brag to your family about it after they check out".

Why the DHS's stay would be "confidential in nature" is beyond me. Despite having the word "security" in its title, it's not an agency that's always "entitled" to secrecy -- and certainly not when it announces its presence with over 100 official DHS vehicles. The DHS does perform undercover investigations (see also: The Great Kansas City Panty Raid of '14), but a massive presence isn't likely associated with an undercover investigation.

The hotel may have had the right to fire the employee for violating guest confidentiality by posting photos of the parking garage, but even that argument is tough to make. Private companies are not government entities and business policies aren't federal law, but in defense of license plate readers, law enforcement agencies have long held that vehicles are not personally identifiable -- i.e., a license plate identifies the vehicle, not the driver. So, a parking lot full of vehicles -- especially government-issued vehicles -- identifies nothing other than the agency present. In any event, nothing noted here seems to have anything to do with company policies (Bohnert mentioned no violated policies in his dismissal of Paffrath) and everything to do with soothing the frayed nerves of the DHS.

Likewise, privacy is not security, but a parking lot crammed with easily-identifiable government vehicles isn't anyone's notion of "secure." Paffrath's posting didn't destroy the DHS's nonexistent security but it did apparently irritate the hotel's head of security, who then called for the ceremonial sacrifice of an employee on the altar of Homeland Security.

Filed Under: dhs, employment, ferguson, homeland security, hotel, mark paffrath, social media
Companies: drury park plaza hotel

Report Says Customs And Border Protection Shoved 12,000 Unanswered FOIA Requests Into Boxes And Forgot About Them

from the your-tax-dollars-hardly-working dept

The Government Accountability Office has taken a look at the DHS and its handling of FOIA requests, and it doesn't like what it sees. There are plenty of numbers in the report but the most incredible number is this: 23,000 FOIA requests mishandled by a single agency under the DHS's control. [pdf link]

Nonetheless, CBP experienced a large increase in the number of its backlogged requests from fiscal year 2011 through fiscal year 2013—from 4,356 requests to 37,848 requests. According to CBP officials, two problems, in particular, contributed to the higher numbers. First, approximately 11,000 FOIA cases that were improperly closed in 2012 had to be reopened and reprocessed. Second, after its reorganization, a new manager found a stack of boxes containing 12,000 paper requests from 2012 that had never been entered into their processing system. The officials stated that CBP subsequently cleared all of these requests.

Unfortunately, the report doesn't contain any further details on how these events occurred. The preceding paragraph notes that the CBP has taken steps (hiring/training additional staff, extending agreement with USCIS to handle FOIA processing) to tackle its backlog of requests, but there's nothing explaining how 11,000 requests were "improperly closed" or how 12,000 requests managed to bypass the FOIA system completely, only to reappear in a stack of boxes located elsewhere.

Part of the problem seems to be the DHS itself. The agency is supposed to be fixing its lousy FOIA response system, which includes every agency under its oversight. But the DHS is too big to do the job properly. When it was formed in 2003, the DHS assumed control of 22 agencies and offices as well as absorbed 209,000 federal employees. By 2014, this had grown to 28 agencies and offices.

The GAO pointed out serious flaws in the agency's FOIA processes since 2008, along with handing down several recommendations. Most of that has been ignored or implemented badly. (Pretty much par for the course for an agency another GAO report bluntly stated "had no project management skills.") For the most part, the "solution" has been to throw warm bodies at the request backlog. In a better system, this might have worked. But the DHS's underling agencies seem to all have different ideas as to what tracking and response system works best, resulting in a snarled "network" of responders that creates more problems than it solves.

Responsibility for processing FOIA requests is decentralized among DHS’s Privacy Office and component agencies...In addition, each of the selected components has its own program and procedures for processing, tracking, and reporting FOIA activities... Further, while the selected components report their FOIA processing costs to the Privacy Office, which then aggregates this data, these reported costs are incomplete, thus hindering accountability for the total costs incurred by the department and the components in managing and processing FOIA requests. Also, duplication exists in the processing of certain requests for immigrant files that are handled by two of the selected components.

This table highlights part of the problem:


Only half of the six agencies are using the same system. ICE is using FileMaker Pro in addition to using FOIAXpress, partially nullifying the interconnectedness of the system it shares with two other agencies. The Coast Guard is using nothing more than off-the-shelf Excel to handle its FOIA requests.

Because of the disparate methods and lack of interagency connectivity, the GAO notes that it is unable to provide a completely accurate picture of the DHS's FOIA processes, both in terms of backlogs and costs incurred.

Due to the non-reporting of particular cost categories and concerns about the accuracy of certain reported cost data, including data with obvious errors and inconsistent accounts of how data were collected, we concluded that, overall, the cost data provided were not sufficiently reliable, based on federal management cost accounting standards, to determine DHS’s total FOIA costs, but that our analysis allowed us to conclude that overall costs were underreported...

In examining reported data on the volumes of FOIA requests made to DHS, we found two data reliability issues of concern. First, we found that a FOIA request may be recorded and counted more than once… Similarly, a request sent to more than one component may be entered separately by each component that responds. Nonetheless, while this double counting may result in an inaccurate number of total requests received by DHS, it did not affect our findings, since we have no findings related to the overall volume of requests handled by DHS.

When it's all said and done, the DHS accounts for nearly half of the government's 95,000-request backlog. Part of it is due to its size, which encompasses some agencies (CBP, ICE) many Americans are seeking more and more information from. But the rest of it is on the DHS itself, which has been informed of its deficiencies since 2008, but has made very little forward progress.

Filed Under: cbp, customs and border patrol, dhs, foia

Homeland Security Ignores Own Guidelines To Make It Prohibitively Expensive For Media Companies To Obtain FOIA Docs

from the say-what-now? dept

I currently have a FOIA request in to the Department of Homeland Security, and the fee waiver request was initially denied because DHS told me that I was considered a "commercial requester" since I was using Muckrock's platform to make the request. We're currently appealing this designation (and DHS seems to be ignoring our appeal, as it's been months...), but in another such situation, DHS has once again, declared Muckrock a "commercial requester" in order to demand fees -- on the basis of the fact that people might actually read the documents, and that somehow advances Muckrock's "commercial" interests.

Now, some background is important here. The whole point of waiving fees for "commercial" requesters is to avoid companies doing things like building up private databases by use of FOIA requests and then selling them. It's not for the purpose of blocking commercial media properties from doing journalism with the documents. In fact, Homeland Security's own FOIA guidelines make it clear that for-profit media operations using FOIA for reporting purposes are not commercial requesters:

A request for records supporting the news-dissemination function of the requester shall not be considered to be for a commercial use.

Seems simple enough, but apparently the DHS wants to ignore its own guidelines when it comes to Muckrock. Here's what DHS told Muckrock:

Regarding the "commercial requester" classification, the Agency has also properly determined that the requested records would be used for commercial purposes. Although you assert that any responsive documents would be made available to the public for free on MuckRock's website, the Agency must balance the commercial interest against the public interest. Making documents available on MuckRock's website, even at no charge, drives traffic to the website and furthers its commercial purposes. Your request does not provide any information that would allow the Agency to determine that the public interest outweighs this commercial interest.

But, that kind of argument makes no sense, and would effectively mean that basically all news media organizations who post the relevant source documents from FOIA requests are no longer considered "news media" requesters, but rather "commercial requesters." Because, of course, part of the media function of posting any such document is to "drive traffic." As Muckrock points out in response to this news, there are over 300 media organizations who contribute such documents to DocumentCloud (and we're among them). Many of those organizations are for-profit and clearly media operations. The attempt to claim that Muckrock is a "commercial requester" is clearly ignoring both the clear intent of the commercial requester status and DHS's own guidelines in how to deal with media requests from for-profit media properties.

It's almost as if Homeland Security is looking for bogus excuses to make it prohibitively expensive for media sites, reporting in the public interest, to actually get the documents they request.

Filed Under: commercial requester, dhs, foia, guidelines, homeland security, journalism, media
Companies: muckrock

Court Tells US Gov't That 'State Secrets' Isn't A Magic Wand They Can Wave To Make Embarrassing Cases Go Away

from the good-news dept

Earlier this year, we wrote about the case of Gulet Mohamed, a US citizen who was put on the no fly list and ran into some issues in the Middle East because of that (and by "issues" we mean he was beaten by Kuwaiti officials for wanting to fly home to Virginia). The DOJ was making some nutty arguments, including claiming that the whole case should be thrown out because "state secrets." This is the usual claim in these kinds of cases. Back in August we noted that the judge, Anthony Trenga, was skeptical of this argument, asking for the DOJ to provide a lot more info to back up its claims (in that post we also noted that the DOJ wanted to pretend that the leaked guidelines for how the no fly list works hadn't been leaked).

Now the judge has ruled officially and rejected the DOJ's argument, saying that they can't just claim "state secrets" and walk away. In the ruling, Judge Trenga makes it clear that while there may be some sensitive information in some documents, the case can move forward without that information being revealed:

Certain of the submitted documents appear to contain confidential, security sensitive information that may fall appropriately within a law enforcement privilege. However, the information presented to date by the defendants in support of the state secrets privilege as to these documents is insufficient to allow the Court to conclude that "there is a reasonable danger" that disclosure of these documents to at least the plaintiffs counsel, under the protections of an adequate protective order, would disclose information that would "expose military matters which, in the interest of national security, should not be divulged."

More importantly, Judge Trenga notes that the DOJ has to get over this idea that the "state secrets" privilege is some kind of "sovereign immunity" claim that the DOJ can just wave around and have entire cases dismissed:

... the state secrets privilege is a judicially created rule of evidence, not a doctrine of sovereign immunity or non-justiciability, whose applicability and consequences, where applicable, are best considered within a specific context during the actual adjudication of any claims to which it may apply.

That's a bit of a complex sentence, but it's basically saying that state secrets may apply to specific bits of evidence, but shouldn't be used to just toss out an entire case. Kudos for Judge Trenga for not just rolling over when the DOJ said "state secrets." It would be nice if more judges did the same.

Filed Under: dhs, doj, evidence, gulet mohamed, no fly list, state secrets