DHS Boss Calls For More Fear, Less Encryption

from the Frightened-States-of-America dept

The Trump administration is rebranding the country: Make America Fear Again. In response to a national crime wave that doesn't exist, the head of the DOJ is rolling back police reform and replacing it with extra "toughness." Under the new regime, law enforcement officers will have the full (and, apparently, unconditional) backing of the White House.

The DHS is joining the DOJ in flexing its new muscle. DHS Secretary John Kelly has already stated he's looking to turn requests for visitors' social media/email account information into demands, which would include the mandatory relinquishment of account passwords.

Both agency heads have expressed a desire to do battle with US citizens by revitalizing the fed's war on marijuana, despite legalization referendums being passed by popular vote in several states.

Kelly... course-corrected on a previous statement he made regarding the dangers of marijuana.

Calling it “a potentially dangerous gateway drug that frequently leads to the use of harder drugs,” Kelly vowed that DHS personnel would continue to investigate and arrest those involved in illegal trade of the drug.

That comes after Kelly on Sunday told “Meet The Press” host Chuck Todd that marijuana was “not a factor” in the war on drugs, arguing that solving the nation’s drug problem does not involve “arresting a lot of users.”

These comments came during Kelly's first major public speech since taking office. His "course-corrected" statement echoes DOJ head Jeff Sessions' take on marijuana, a drug only found dangerous by agencies whose budgets rely on marijuana being viewed as a threatening "gateway drug."

Both are also looking to toss more immigrants out of the country, theorizing that stricter immigration control will somehow curb drug cartel violence -- almost all of which is contained completely in other countries. Kelly mentioned Salvadoran drug cartel MS13 in passing, claiming it was responsible for acts of violence and stateside human trafficking.

Attorney General Jeff Sessions was even less kind in his appraisal, delivering comments that made it sound as though the only thing standing between the US and societal collapse was American law enforcement:

When we talk about MS-13 and the cartels, what do we mean? We mean criminal organizations that turn cities and suburbs into warzones, that rape and kill innocent citizens and who profit by smuggling poison and other human beings across our borders. Depravity and violence are their calling cards, including brutal machete attacks and beheadings.

It is here, on this sliver of land, where we first take our stand against this filth.

The DHS head is also capitalizing on Trump's dark -- and deeply-inaccurate -- view of national security. His speech portrayed the country as being under ceaseless attack from innumerable evil forces.

“We are under attack from people who hate us, hate our freedoms, hate our laws, hate our values, hate the way we simply live our lives. And we are under attack every single day,” he warned. “The threats are relentless.”

Kelly covered a wide swath of issues — from transnational criminal organizations to cyberattacks to homegrown violent extremism, often using graphic descriptions of human suffering to illustrate the dangers.

The speech harkened back to President Trump’s inaugural address to Congress, in which he described “American carnage” outside of the Beltway.

No agency benefits more from the perception of an insecure homeland than the Department of Homeland Security. But the trickle-down effect of fear-based policy-making helps other agencies as well.

In his speech, Kelly tacitly aligned himself with the only Obama holdover Trump seems to like: FBI director James Comey.

He warned that proliferating encrypted communications technology would soon make it “impossible” to track terrorist threats.

Kelly had more to say on that subject in relation to Trump's still-unseen cybersecurity executive order. Supposedly, an updated version of the draft released in February is due any day now, and no matter what's in it, Kelly fully supports it.

“I’m standing by with bated breath,” Kelly said when Frank Cilluffo, director of the university’s Center for Cyber and Homeland Security, asked if there was any news on the order. “I can’t wait.”

Presumably not referencing the FBI's counterterrorism sting operations with the phrase "homegrown terrorism," Kelly again pointed to encryption as being part of the problem.

“What’s feeding homegrown terrorism is the Internet. They publish revolting how-to manuals,” Kelly said. “Thanks to proliferating encryption devices, these individuals are becoming harder and harder to detect. Our nation’s youth are prey to these predators.”

Between John Kelly, AG Jeff Sessions, and CIA head Mike Pompeo, the administration seems interested in sacrificing citizens' freedoms and protections on the altar of national security. All three are hoping loaded, hyperbolic language will convince more Americans to give up these protections willingly. Those who don't will probably be viewed as enemies of the nation -- and that includes any legislators who appear reluctant to give these agencies everything they want. Kelly again:

“If lawmakers do not like the laws they’ve passed and we are charged to enforce — then they should have the courage and skill to change the laws. Otherwise they should shut up and support the men and women on the front lines,” Kelly said, to a burst of applause in the auditorium.

This is wonderful stuff if you're a fan of authoritarianism. Shut up and show your support. It's a message that's been sent several times by the new president. Now, it's being echoed by his top officials.

Filed Under: crime, dhs, encryption, fear, going dark, john kelly

South Korea To Tackle Video Game Cheating By Criminalizing Breaking A Game's ToS

from the municipal-cheat-code dept

I have some admiration for South Korea's ability to look squarely at the national hostage situation that is its northerly neighbor and spend so much time enjoying video games. That this dedication to my favorite hobby occasionally pulls the country's government into putting forward dumb laws is an unfortunate by-product, however. It seems the South Korean government is still at it, as it attempts to join Japan in criminalizing cheating in video games.

And it has managed to construct this law to criminalize cheating in what simply has to be the dumbest way possible.

According to PvPLive, a recent amendment passed by the South Korean parliament bans the “manufacturing and distributing programs that are not allowed by the game company and its Terms of Service.” In theory, this makes it easier for the creators of competitive games to crack down on things like hacking programs, aimbots, and other game mods that give players an unfair advantage in online play.

Great theory, but this method for stopping cheaters should be setting off alarm bells all over the place. Criminalizing the violation of a ToS is a really, really bad idea. Our own CFAA legislation should serve as a wondeful primer on how broadly criminalizing violating terms of service can result in gross overreach by prosecutors who will use the law as a tool to jail people nobody thinks should be imprisoned. There's a reason why these attempts to use ToS to thwart cheating, or modding, are widely considered creative end-arounds to the actual law: because they're basically bullshit. Codifying into law the criminalization of the violation of a software ToS that nobody reads is casting quite a wide net to combat an otherwise small problem.

It's also well worth noting that most of the benign modding community regularly violates game ToS as they do their work.

But while this could deter would-be hackers from creating programs explicitly for cheating, the somewhat ambiguous act of outlawing any program that violates the Terms of Service has some League of Legendsand Overwatch players worried that non-malicious mods could be caught in the crossfire.

Look, eSports is becoming a significant enough industry that I understand the effort to combat cheating within it. And the online portion of the gaming experience is so center stage at this point that it would have been surprising if governments weren't starting to look at how to protect the industry from a saturation of cheaters who break the game for other gamers. But broadly worded legislative nukes aren't the way to combat a cheating insurgency.

Filed Under: cheating, crime, modding, south korea, terms of service, video games

Appeals Court Affirms NSA Surveillance Can Be Used To Investigate Domestic Criminal Suspects

from the spooks-in-the-federal-cop-shop dept

The Seventh Circuit Court of Appeals confirms what's already known about the NSA's domestic surveillance: it's not just for terrorism.

The NSA collections -- done in the FBI's name -- are supposed to only gather info related to international terrorism. But that requirement has been phased out. The NSA "tips" a certain amount of data to the FBI for its own use and it has been shown in the past to do the same for the DEA, which it then instructs to obscure the origin of its info.

An opinion [PDF] just released by the Appeals Court, says basically the same thing: although the NSA's surveillance is supposed to be used to sniff out terrorists, there's nothing in the law that prevents it from using its collections to go after criminals.

Gregory Turner was convicted of conspiring with Prince Asiel Ben Israel (both US persons) to provide aid to Zimbabwean "Specially Designated Nationals" -- in this case a group working to block the institution of more democratic processes and procedures in that country.

Turner moved to suppress the evidence, claiming that the government's use of a FISA order to obtain information on his activities violated the NSAs foreign intelligence directives. But the court finds the directive does not limit FISA warrants to terrorism only. The government only needs to "reasonably believe" a target is an "agent of a foreign power."

The government informed Turner it had gathered evidence using FISA-authorized surveillance. Then it refused to turn over information to him with regards to its activities. From the redacted, terribly-reproduced decision:

On February 27, 2014, Turner filed a motion for disclosure of FISA materials and motion to suppress evidence obtained or derived from FISA. The government responded to these motions with a classified brief and a sealed appendix submitted ex parte to the district court and redacted, unclassified version served to Turner. Additionally, the government filed a "Declaration and Claim of Privilege" by the Attorney General that declared, "it would harm the national security of the United States to disclose or hold an adversarial hearing with regards to the FISA materials…"

Both motions by Turner were denied. These denials have been upheld by the Appeals Court. Turner claimed the government failed to meet its probable cause requirements for the FISA warrant and also violated his First Amendment rights with its surveillance.

Much of the court's reasoning is redacted but it does have this to say about Turner's assertions.

Turner contends that "FISA appears to require the communications subject to surveillance of a United States person must related directly to activities involving international terrorism as defined in FISA." Turner misstates the law. FISA is not limited to activities involving international terrorism. FISA authorizes surveillance and searches based on probable cause that the target is an "agent of foreign power," which relates to "any person" engaged in certain activities… on behalf of a foreign power, including "clandestine intelligence gathering activities" and "enter[ing] the United States under a false or fraudulent identity… or while in the United States… assum[ing] a false or fraudulent identity." These activities are listed in addition to "international terrorism."

Not only that, but the laws governing FISA-ordered activities were loosened in 2008 to encompass all sorts of criminal activity not related to foreign powers or international terrorism.

FISA, as amended in 2008, "eliminated any justification for the FISA court to balance the relative weight the government places on criminal prosecution as compared to other counterintelligence responses." [...] [T]he amended FISA statute "does not oblige the government to demonstrate to the FISA court that its primary purpose in conducting electronic surveillance is not criminal prosecution."

As for Turner's First Amendment claims, the court finds the activities he engaged in were not covered under the First Amendment, no matter how "right" Turner may have believed undermining the installation of a democratic government was. As the court sees it, the government established Turner was an "agent of a foreign power," something that strips away protections normally afforded to political activity. Or maybe just political activity the US government doesn't approve of.

Either way, it's very clear FISA court orders can be used to engage in domestic surveillance purely to investigate criminal activity, something the NSA hasn't exactly been forthcoming about. As long as a foreign power is somehow involved, the NSA and the FBI are interchangeable surveillance pieces, even though one of them is assumed to be mostly uninvolved in domestic surveillance of US persons.

Filed Under: 7th circuit, crime, domestic, fisa, gregory turner, nsa, surveillance, terrorism

EFF White Paper Hopes To Educate Cops On The Difference Between An IP Address And A Person

from the but-are-they-willing-to-learn? dept

Judges have pointed out to copyright trolls on multiple occasions that an IP address is not a person. Trolls still labor under this convenient misconception because they have little else in the way of "proof" of someone's alleged infringement.

Unfortunately, law enforcement agencies also seem to feel an IP address is a person -- or at least a good indicator of where this person might be found. This assumption leads to blunders like ICE raiding a Tor exit node because it thought an IP address was some sort of unique identifier. After having IP addresses explained to it by the EFF, ICE returned the seized hard drives and promised to make the same mistake in the future.

In another case, the Seattle PD raided a Tor exit node in search of a person downloading child porn. It didn't find the target it was looking for, but went ahead and demanded passwords so it could search files and logs at the unfortunate citizen's home before realizing it had the wrong person.

The EFF is kind of sick of having to explain the difference between an IP address and a person to government entities. It has put together a white paper [PDF] that should be required reading anywhere government employees feel compelled to act on "evidence" as useless as IP addresses.

Law enforcement’s over-reliance on the technology is a product of police and courts not understanding the limitations of both IP addresses and the tools used to link the IP address with a person or a physical location. And the police too often compound that problem by relying on metaphors in warrant applications that liken IP addresses to physical addresses or license plates, signaling far more confidence in the information than it merits.

[...]

These ill-informed raids jeopardize public safety and violate individuals’ privacy rights. They also waste police time and resources chasing people who are innocent of the crimes being investigated.

By acting on this bogus assumption, law enforcement agencies are wasting time and money. Plus, they're putting themselves in situations where innocent people could be killed over technical errors, seeing as warrant service these days usually involves militarized squads that value shock and awe tactics over minimizing collateral damage.

The white paper points out what should be obvious to anyone who considers themselves capable of solving "computer crimes:" an IP address is not only not a person, it's not even a physical location.

First, the technology was never designed to uniquely identify an exact physical location, only an electronic destination on the Internet.

[...]

At a local level, similar IP addresses may be assigned based on geography, albeit only indirectly. ISPs make decisions to allocate blocks of IP addresses to particular locations for a variety of reasons, with the goal of creating a network that efficiently delivers Internet traffic. The result may be that locations near each other feature similar IP addresses, but that is more often the product of where the provider has physical links and routers to a network than geography. For example, if an ISP has a fiber-optic link between two distant cities, the IP addresses assigned to those cities may be similar because it creates a more efficient network. A third city near one of those towns geographically may not share the same connection and it would thus likely have completely different IP addresses assigned to it.

In addition, IP addresses only identify the block of devices assigned to it, not the people utilizing them. Even in cases where there's only one resident at a physical address linked to an IP address, there's still a chance law enforcement may be going after the wrong person. As the paper explains, the pool of IPV4 addresses has been used up. In areas where users haven't been pushed to IPV6 addresses, IP addresses may be shared by more than one user (at more than one physical address) or reassigned to other users by service providers based on need and usage. As the paper states, IP addresses, unlike physical addresses, are not static.

The paper also points out that the use of bad analogies by law enforcement and courts has only made the misconceptions worse. Law enforcement agencies sometimes claim that IP addresses are every bit as unique as license plates. The metaphor fails because IP addresses can be shared or redistributed at private companies' discretion unlike license plates, which are government-issued and must remain tied to a registrant.

In short, the best analogy for an IP address is an anonymous informant's tip -- something that's basically hearsay until otherwise confirmed.

In a line of Supreme Court cases dealing with reliability and corroboration problems that arise whenever third parties provide tips to law enforcement, the court has made clear that police must do more to confirm the tips provided by anonymous informants before seeking a warrant or other process…

The question is: will law enforcement care enough about potential collateral damage to educate themselves on the problems of treating IP addresses as people… or will they decide that a combination of forgiveness (good faith exception, etc.) and easily-obtained immunity is preferable to gathering corroborating evidence and acting more cautiously?

Filed Under: crime, ip address, law enforcement, privacy

India Criminalizes Merely Visiting A Copyright Infringing 'Blocked' Site

from the what-a-mess dept

The Indian film industry has long had a complicated relationship with piracy. After all, India's Bollywood regularly produces the most films of any other country in the world (it's often neck and neck with Nigeria). That seems to be a sign that the market is pretty healthy. After all, filmmakers keep telling us that piracy is going to destroy their reasons for making films... and yet here's a market that's making tons and tons of films (many of which are excellent). And, as we've noted in the past, the film studios in India are making lots of money, in part because they're competing effectively against piracy. And, then you even have some Indian filmmakers who recognize that piracy helps spread the message of their films to a wider audience.

And yet... because it's (oooooh! scary!) "piracy," there will always be some who freak out and come up with bad ideas. Apparently, one of those bad ideas is now the law. After already putting in place dumb site blocking laws that force ISPs, under court order, to block access to sites deemed hubs of infringement, the Indian government now says that getting around one of those blocks (hi there, VPN user!) is a criminal act that could get you three years in jail.

"What are you in for?" "Me? I used a VPN to access Archive.org."

Think I'm joking? The Internet Archive was included in the ban list. As was GitHub and Vimeo.

So why is the Indian government doing this kind of thing, despite everything noted in the first paragraph about the thriving and successful Indian creative industries? Perhaps it's because of absolutely bullshit articles like this one at "The News Minute" claiming that Indian films gross $2 billion, but piracy makes 35% more. I found that article because well-known copyright maximalist, Canadian lawyer Barry Sookman, happily tweeted the link. But you have to be pretty bad at understanding copyright law if you think it's a good article. After all, it struck me as odd for the headline to note that "piracy" makes more money than the Indian film industry. And that's because it's not true. Yes, the article starts out by claiming it does:

India's film industry, said to be the largest globally with some 1,000 movies produced each year, earns around $2 billion from legitimate sources such as screening at theatres, home videos and TV rights. But with $2.7 billion, piracy earns 35 per cent more, and a way out has proved elusive.

Where is this $2.7 billion coming from and where is it going? And if it were really true that piracy "earned" so much more money, uh, then shouldn't the Indian studios embrace piracy and start making that money for itself? But, of course, the answer is that that's not what's actually happening. It's just how the terrible reporter at The News Minute confusingly explains things, and copyright lawyers like Sookman happily retweet because it fits into his narrative. But you have to dig deeper into the article to find out that the $2.7 million "earned" by pirates is actually just the made up number of the value of movies downloaded.

"The infringing copies appear online within few hours of a film release," Singh told IANS, and added: "The Indian film industry loses around Rs 18,000 crore ($2.7 billion) and over 60,000 jobs every year because of piracy."

You see, here they're now calling the $2.7 billion "losses." Because that's a made up number that the industry wants you to believe it would have made if piracy did not exist. But that's not money "earned" by piracy. And pretending it is is incredibly dishonest. After lots of hand-wringing and whining about evil pirates, finally, at the end of the article, you have someone who speaks sense, filmmaker Anurag Basu, who recognizes the way you beat piracy is by competing with it:

"Piracy is working because people can buy a (pirated) DVD for Rs 100 and a whole family can watch it. We have to offer that kind of entertainment at that price. It has to be as easy to get an original DVD as it is to get a pirated one," he said.

But, instead of doing that, the government is buying into ridiculous claims about pirates "earning" more money, and thus they're now trying to criminalize merely accessing a website that they've banned for having infringing material. Websites like the Internet Archive and Vimeo.

Filed Under: blocks, bollywood, copyright, crime, india, piracy, punishment, site blocking

NY Daily News Admits It Got It All Wrong When Declaring Crime Increases Would Follow Stop-And-Frisk Decision

from the nice-to-see dept

When federal judge Shira Scheindlin ordered a number of stop-and-frisk reforms three years ago, Mayor Michael Bloomberg and NYPD Chief Ray Kelly both predicted a drop in unconstitutional stops would result in a dramatic rise in criminal activity.

Bloomberg:

We, unlike many countries, want to keep all of our citizens safe, and keep the crime rate down and make sure that they get home and go to court and protect themselves -- unlike other countries in the world.

[...]

I wouldn't want to be responsible for a lot of people dying.

Kelly:

[N]o question about it —violent crime will go up…

The New York Daily News often provided a platform for NYPD officials who were quick to blame any increase in crime on the decline in stops.

“We’re struggling with homicides and shootings,” NYPD Chief of Department James O’Neill said Monday. “As we expect when warm weather comes, we see an increase in certain crimes.”

O’Neill laid out the grim numbers during a press conference at 1 Police Plaza, revealing a 19.5% spike in homicides during the first five months of the year. There were 135 murders through Sunday compared to 113 at the same time last year.

But…

Despite the increase in shootings and homicides, overall crime was down 6.6% through Sunday compared with the same period last year.

More NYPD opinions:

[S]ome officers believe the jump in killings can be linked to the NYPD’s new restrictions on stop-and-frisk.

“It’s because they changed the stop-and-frisk criteria,” one high-ranking police source told The News. “Before I would have said, ‘This guy right here by the way he’s adjusting his pants and moving around I would stop him.’ Now that’s not enough to stop a person so these guys get away with a gun.”

Tempered with reality:

While murders and shootings have increased, overall crime in the city is down by 10%, statistics show.

It's one thing to report on the NYPD's dissatisfaction with the new, court-ordered status quo. It's quite another to make it the publication's official stance. This is exactly what the New York Daily News did after Judge Scheindlin's order was handed down.

By imposing a monitor on the NYPD, she has rushed headlong into commandeering how the department polices the city with, she admitted, no concern about endangering life and limb.

Make no mistake — Scheindlin has put New York directly in harm’s way with a ruling that threatens to push the city back toward the ravages of lawlessness and bloodshed.

Most publications would simply let their bad judgment call recede into the past without comment, even after their assertions have been proven wrong. The NY Daily News should be commended for not only admitting its mistake, but publishing an entire editorial detailing just how wrong it was.

As many readers will know, the Daily News Editorial Board supported the NYPD’s strategy as essential to public safety. We also expressed fear that forcing the department to pull back could seriously harm public safety.

[...]

In other pieces, we predicted a rising body count from an increase in murders.

We are delighted to say that we were wrong.

The NYPD began scaling back stops under Kelly before Scheindlin’s decision and accelerated the trend under Commissioner Bill Bratton. As a result, the number of stops reported by cops fell 97% from a high of 685,700 in 2011 to 22,900 in 2015.

Not only did crime fail to rise, New York hit record lows.

The murder count stood at 536 in 2010 and at 352 last year — and seems sure to drop further this year. There were 1,471 shooting incidents in 2010 (1,773 victims). By 2015, shootings had dropped to 1,130 (1, 339 victims).

The NY Daily News should be praised for this editorial... but not too effusively. There's still quite a bit of hedging in its blown call admission. The Scheindlin decision somehow remains "flawed," despite its largest supposed flaw ("crime will rise!") being nonexistent. The editorial also hands the NYPD almost all of the credit for the continued decrease in crime, even though it was the NYPD itself that claimed that a transformed stop-and-frisk program would result in a new wave of criminal terror sweeping New York.

Regardless, there can be little doubt that the NYPD’s increasing reliance on so-called precision policing — knowing whom to target, when and where — has played a key role.

Maybe. Maybe not. The NY Daily News has no way of determining this. It admits that "explaining crime trends is extraordinarily difficult" while in the same breath (so to speak) hands credit to the NYPD for the continued drop in crime rates.

But it is something rarely seen: a publication that often seems to act as an unofficial mouthpiece for the NYPD admitting it didn't know what it was talking about when it parroted Mayor Bloomberg's and Chief Ray Kelly's hyperbole following the Scheindlin decision.

Filed Under: crime, nyc, stop and frisk
Companies: ny daily news

Man Who Doxxed Dozens Of People, Engaged In Nineteen 'Swattings', Nets Only One Year In Prison

from the cyber-sentencing-still-mostly-incoherent dept

The treatment of all things "cyber" by the government is incredibly inconsistent. Give someone a password so they can deface a website for 40 minutes and it's two years in jail. Doxx, SWAT, and cyberstalk multiple people and the best the court can do is two years minus time served. The end result is one year in prison for Mir Islam, who doxxed multiple celebrities and politicians, as well as called in fake threats that resulted in the swatting of at least nineteen people, including security researcher Brian Krebs, who uncovered Islam's doxxing tactics.

Krebs' investigation of Islam and his abuse of free credit report services to obtain personal information on a variety of public figures led to the following:

Peeved that I’d outed his methods for doxing public officials, Islam helped orchestrate my swatting the very next day. Within the span of 45 minutes, KrebsOnSecurity.com came under a sustained denial-of-service attack which briefly knocked my site offline.

At the same time, my hosting provider received a phony letter from the FBI stating my site was hosting illegal content and needed to be taken offline. And, then there was the swatting which occurred minutes after that phony communique was sent.

[...]

Nearly a dozen heavily-armed officers responded to the call, forcing me out of my home at gunpoint and putting me in handcuffs before the officer in charge realized it was all a hoax.

The response to the hoax call on Krebs' residence was, by comparison, minimal. Islam also called in a fake active shooter report at the University of Arizona campus. This was apparently in retaliation to a cheerleader's failure to realize Islam's cyberstalking was just another way of saying "I love you."

A woman representing an anonymous “Victim #3” of Islam’s was appearing in lieu of a cheerleader at the University of Arizona that Islam admitted to cyberstalking for several months. When the victim stopped responding to Islam’s overtures, he phoned in an active shooter threat to the local police there that a crazed gunman was on the loose at the University of Arizona campus.

According to Robert Sommerfeld, police commander for the University of Arizona, that 2013 swatting incident involved 54 responding officers, all of whom were prevented from responding to a real emergency as they moved from building to building and room to room at the university, searching for a fictitious assailant. Sommerfeld estimates that Islam’s stunt cost local responders almost $40,000, and virtually brought the business district surrounding the university to a standstill for the better part of the day.

Worse, some of Islam's swatting efforts and cyberstalking occurred while he was "cooperating" with federal prosecutors following his arrest for attempting to sell stolen credit cards to undercover agents.

Federal prosecutors wanted to see Islam jailed for nearly four years -- towards the upper reaches of the mandatory sentencing guidelines. Instead, the judge handed down a sentence of two years. Islam has been in federal custody since July 2015 and that time is being credited towards his sentence, meaning it will only be another year at the most before Islam is free again.

The credit for time served makes sense and the departure from the upper limits of the guidelines is something I would be extremely hesitant to suggest is a bad thing. Prosecutors wanted a much longer sentence, and the allegations here would seem to justify a lengthier imprisonment for Islam.

The problem with the government's fear of anything cyber-related is that the default mode for prosecutors is almost always the upper reaches of the sentencing guidelines, even when the severity of the criminal activity doesn't appear to warrant this sort of punitive sentencing. The government sought a longer sentence for Matthew Keys' minimal participation in a 40-minute headline alteration at a news website. Someone who endangered lives of dozens of people by sending heavily-armed law enforcement officers after them -- in addition to doxxing a large number of public figures and participating in multiple cyberstalkings -- was apparently only deemed dangerous enough to warrant a 46-month sentence, as compared to the 60 months sought in the Keys case.

Then there's this:

Judge Moss, in explaining his brief deliberation on arriving at Islam’s two-year (attenuated) sentence, said he hoped to send a message to others who would endeavor to engage in swatting attacks.

Swatting has the potential to kill people, something clearly not reflected by the "severity" of this sentence.

As Brian Krebs points out, it does send a message, although certainly not the one the judge intended. It says you can endanger the lives of others without seriously affecting your own freedom. It also sends the message that the government -- as a whole -- will remain incoherent and inconsistent in its handling of cybercrime.

Filed Under: brian krebs, crime, dox, doxxing, mir islam, punishment, swatting

Proprietary Algorithms Are Being Used To Enhance Criminal Sentences And Preventing Defendants From Challenging Them

from the like-the-Coke-formula,-but-for-years-of-someone's-life dept

When law enforcement agencies want to know what people are up to, they no longer have to send officers out to walk a beat. It can all be done in-house, using as many data points as can be collected without a warrant. Multiple companies offer "pre-crime" databases for determining criminal activity "hot spots," which allow officers to make foregone conclusions based on what someone might do, rather than what they've actually done.

Not that's it doing much good. For all the time, money, and effort being put into it, the databases seem to be of little utility.

Many law enforcement agencies use software to predict potential crime hot spots, and the police in Kansas City, Mo., and other places have used data to identify potential criminals and to try to intervene.

[...]

In Chicago, where there has been a sharp rise in violent crime this year, the police have used an algorithm to compile a list of people most likely to shoot or be shot. Over Memorial Day weekend, when 64 people were shot in Chicago, the police said 50 of the victims were on that list.

So much for "intervention." Having a list of people who have a higher risk of being shot doesn't mean much when all it's used for is confirming the database's hunches. However, these same databases are being put to use in a much more functional way: determining sentence lengths for the criminals who have been arrested.

When Eric L. Loomis was sentenced for eluding the police in La Crosse, Wis., the judge told him he presented a “high risk” to the community and handed down a six-year prison term.

The judge said he had arrived at his sentencing decision in part because of Mr. Loomis’s rating on the Compas assessment, a secret algorithm used in the Wisconsin justice system to calculate the likelihood that someone will commit another crime.

We're locking up more people for more years based on criminal activity they'll no longer have the option of possibly performing. This is nothing new. Sentencing enhancement is based on a lot of factors, not all of them confined to proprietary databases. But what is new are the algorithms used to determine these sentence enhancements, most of which belong to private companies who are completely uninterested in sharing this crucial part of the equation with the public.

In Mr. Loomis' case, the software determined he would be likely to engage in further criminal activity in the future. A so-called "Compas score" -- provided by Northpointe Inc. -- resulted in a six-year sentence for eluding an officer and operating a vehicle without the owner's consent. His lawyer is challenging this sentence enhancement and going after Northpointe, which refuses to release any information about how the Compas score is compiled.

What Northpointe has released are statements that confirm the code is proprietary and that the Compas score is "backed by research" -- although it is similarly unwilling to release this research.

The problem here isn't so much the use of algorithms to determine sentence lengths. After all, state and federal guidelines for sentence lengths are used all of the time during sentencing, which includes factors such as the likelihood of future criminal activity. But these guidelines can be viewed by the public and are much more easily challenged in court.

The use of private contractors to provide input on sentencing renders the process opaque. Defendants can't adequately challenge sentence enhancements without knowing the details of the "score" being presented by prosecutors to judges. The algorithms' inner workings should either be made available to defendants upon request, or the "score" should be determined solely by government agencies, where the data and determining factors can be inspected by the public.

We're now in the unfortunate situation where companies are telling judges how long someone should be locked up -- using data which itself might be highly questionable. The feeling seems to be that if enough data is gathered, good things will happen. But as we can see from Chicago's implementation of this technology, the only thing it's done so far is add confirmation bias toetags to the ever-increasing number of bodies in the city's morgues.

The use of locked-down, proprietary code in sentencing is more of the same. It undermines the government's assertion that prison sentences are a form of rehabilitation and replaces it with the promise that criminal defendants will "do the time" so they can't "do the crime" -- all the while preventing those affected from challenging this determination.

Filed Under: compas assessment, crime, predictions, proprietary algorithms, repeat offenders, sentencing, thought crimes
Companies: compas

James Comey Still Trying To Blame Increase In Violent Crime On 'Viral Videos'

from the pitching-woe dept

FBI Director James Comey says we're "going dark" as more platforms move towards encryption. Nobody's buying it. Not Congress. Not NSA officials. Definitely not those who have actually researched the subject.

He also says people with cameras are causing spikes in crime rates by making police officers so self-conscious they can't do their job. Comey blamed citizens with cameras for escalating crime rates last October. He was immediately contradicted by Attorney General Loretta Lynch. Having learned nothing from the experience, Comey has dusted off his 2015 talking points for redeployment in 2016.

FBI Director James Comey said Wednesday he believes a "viral video effect" causes weak police work and could be "at the heart" of a spike in violent crime in some American cities.

“There’s a perception that police are less likely to do the marginal additional policing that suppresses crime—the getting out of your car at 2 in the morning and saying to a group of guys, ‘Hey, what are you doing here?’” he told reporters at FBI headquarters.

This is a guy with access to some of the best intelligence and advice your tax dollars can buy. And yet he'd rather tuck his thumbs into his suspenders, lean towards reporters and aw-shucks at them with his "I may just be a simple director of the most powerful law enforcement agency in the United States, but…" pitches.

He sounds like a small town local running for sheriff, rather than a top government official with his finger on the pulse of criminal activity and law enforcement technology.

Comey spoke to reporters after being briefed on crime statistics from 40 major cities, most of which saw an increase in murders, he said.

"I was very worried about it last fall and I am in many ways more worried," Comey told reporters at FBI headquarters. "The numbers are not only going up, they're continuing to go up faster than they were going up last year. And I worry very much it's a problem that most of America can drive around. ... I don't know what the answer is, but, holy cow, do we have a problem."

That's classic Comey: You've got problems? I don't have answers.

Encryption got you down? I'm sure the "smart people" in tech can deliver unicorns on command. No, I'm sorry. I don't have any technical details but, you know, those guys at Apple and Google are so damn smart. They'll think of something.

Crime rates spiking in major cities? "Holy cow, do we have a problem?" Any ideas, Mr. Top of the Law Enforcement Food Chain? "I don't know what the answer is."

OK. Well… um… keep on earning that paycheck... I guess.

Not for nothing has James Comey earned a petition calling for his removal. Comey claims criminals are somehow exploiting a "tech gap" the FBI can't seem to close, despite its hundreds of millions of dollars. I don't know how many criminals are staying one step ahead of the FBI in a tech arms race anyone can participate in. (The fact that the FBI can buy/obtain/hoard exploits and malware, along with other high-tech tools the general public can't purchase, somehow always gets lost in law enforcement's portrayal of this so-called "race.") But it can certainly be said criminals are one step ahead of the FBI's top man, who often seems genuinely baffled by the issues confronting his agency.

It may be that Comey is playing dumb because he believes it's the best way to advance his agency's agenda. But he's been doing this for more than a year and there's been no forward movement. If anything, the FBI is less likely to receive Congressional assistance than it was before Comey began running his mouth on these two subjects.

Not only has he lost the support of Congress, but he's not winning any powerful friends within the law enforcement community.

“He ought to stick to what he knows,” James O. Pasco Jr., executive director of the National Fraternal Order of Police, told the New York Times. “He’s basically saying that police officers are afraid to do their jobs with absolutely no proof.”

Unfortunately, this -- and "going dark" -- appears to be all Comey knows.

Filed Under: blame, crime, fbi, james comey, law enforcement, transparency

Michigan Politicians Want People Who Hack Cars To Spend The Rest Of Their Lives In Prison

from the plus-cancer,-where-permitted-by-local-ordinances dept

There's apparently no situation legislators can't make worse. Self-driving cars are an inevitability, as are all the attendant concerns about autonomous vehicles roaming the streets unattended, mowing down buses at 2 miles per hour or forcing drivers behind them to obey all relevant traffic laws.

There are fears that people will just stop paying attention to driving, which is weird, because that's one of the few immediate advantages of self-driving vehicles. There are also fears that a robot car is nothing more than a tempting attack target for malicious hackers. There's some truth to this last one, especially as manufacturers have loaded up vehicles with on-board computers but given little thought to properly securing them.

Even so, that's no excuse for the sort of legislation being proposed by two Michigan politicians, which would reward self-driving car hackers with lifetime stays at the nearest prison.

Michigan Senators Ken Horn and Mike Kowall have proposed a cybersecurity bill aimed at hackers and connected and autonomous cars. While Senate Bill 928 (pdf) sets out the type of crime and corresponding sentencing guidelines for car hacking, Senate Bill 927 (pdf) spells out that car hacking will be a felony. Further down, the legislation says car hacking will be punishable by life in prison.

This would be fine if… well, no, actually it's not fine at all. One tends to think of prison terms as being somewhat related to the harm caused and if someone fires off malware that prevents someone from starting their vehicle, there's no way that should be punished by a life sentence. I'm sure the legislators are contemplating worst-case scenarios where someone electronically hijacks a vehicle and causes someone's death, but that sort of thing should be punishable under other laws more commensurate with the end result of the hacking.

I can also see how not explicitly targeting hacking of vehicles might become a legal loophole which allows perpetrators to walk away from more serious charges. But this is overkill, especially because the list of violations is far too broadly written.

A PERSON SHALL NOT INTENTIONALLY ACCESS OR CAUSE ACCESS TO BE MADE TO AN ELECTRONIC SYSTEM OF A MOTOR VEHICLE TO WILLFULLY DESTROY, DAMAGE, IMPAIR, ALTER, OR GAIN UNAUTHORIZED CONTROL OF THE MOTOR VEHICLE.

Basically the bill says all electronic systems created by manufacturers must be sealed black boxes that purchasers, security researchers, hobbyists, and third-party suppliers should never, ever access under the pain of life imprisonment. "Alter" could mean "make things work better," but it still would be treated as a criminal act under this law. Repairs to on-board computers by "non-certified" mechanics could net them charges, especially if something malfunctions down the road. I'm sure this is a perfectly acceptable outcome to the US automakers still cranking out cars in Michigan, that would now have something more than copyright to threaten people with.

The senators claim this is necessary because they want to stay out in front of any technological developments.

Automotive News quoted Kowall as saying, “I hope that we never have to use it. That's why the penalties are what they are. The potential for severe injury and death are pretty high. Some of these people are pretty clever. As opposed to waiting for something bad to happen, we're going to be proactive on this and try to keep up with technology.”

You don't "keep up" with technology by treating electronic access to certain systems like some particularly powerful form of witchcraft, only punishable by the most severe sentences. This isn't legislators staying abreast of the latest developments. This is legislators bypassing evidence gathering and stocking up on fear. Because nothing eases the mind of the public more than declaring the autonomous car apocalypse to be upon us, with only this badly written bill standing in the way of death and destruction.

Filed Under: autonomous vehicles, crime, hacking cars, michigan