Five Eyes Countries Band Together To Complain About Facebook And End-To-End Encryption

from the breaking-Messenger-will-leave-criminals-with-only-dozens-of-secure-options dept

The world's law enforcement agencies are back at it, advocating for the demise of end-to-end encryption. The last time they all got together like this, they were complaining to Facebook for thinking about adding encryption to its Messenger service.

Because Facebook does so well reporting child porn to the proper authorities, the proper authorities have gathered to decry its decision to encrypt this service, claiming it would result in a lot of unobserved child porn being passed between users. With Facebook unable to eavesdrop on messages, the images and videos can be shared unnoticed.

And, again, the international law enforcement community is asking for weaker encryption… and namechecking Facebook as the cause of and potential solution to all the world's child porn problems. The new "international statement" opens up with a united declaration that everyone loves encryption, before getting to the long list of "buts."

We, the undersigned, support strong encryption, which plays a crucial role in protecting personal data, privacy, intellectual property, trade secrets and cyber security. It also serves a vital purpose in repressive states to protect journalists, human rights defenders and other vulnerable people, as stated in the 2017 resolution of the UN Human Rights Council. Encryption is an existential anchor of trust in the digital world and we do not support counter-productive and dangerous approaches that would materially weaken or limit security systems.

Of course, that last sentence is a lie. At best, it's completely disingenuous. Almost immediately following this assertion that the undersigned have no intention or pursuing counterproductive/dangerous approaches, the Five Eyes crew (along with India and Japan) lists the counterproductive/dangerous ways they'd like encryption to be broken.

Particular implementations of encryption technology, however, pose significant challenges to public safety, including to highly vulnerable members of our societies like sexually exploited children. We urge industry to address our serious concerns where encryption is applied in a way that wholly precludes any legal access to content. We call on technology companies to work with governments to take the following steps, focused on reasonable, technically feasible solutions:

• Embed the safety of the public in system designs, thereby enabling companies to act against illegal content and activity effectively with no reduction to safety, and facilitating the investigation and prosecution of offences and safeguarding the vulnerable;

• Enable law enforcement access to content in a readable and usable format where an authorisation is lawfully issued, is necessary and proportionate, and is subject to strong safeguards and oversight; and

• Engage in consultation with governments and other stakeholders to facilitate legal access in a way that is substantive and genuinely influences design decisions.

I'm not sure what sort of "strong encryption" can handle all of these weak spots being introduced without turning into something easily misused, but these government reps are pretty sure people at these companies will come up with something. These governments have convinced themselves they're "stakeholders" in private conversations between citizens that are facilitated by services like Facebook's Messenger.

And that's what this is about. The statement cites Facebook's success in handling child porn while trying to use that against it.

In 2018, Facebook Messenger was responsible for nearly 12 million of the 18.4 million worldwide reports of CSAM [child sexual abuse material to the US National Center for Missing and Exploited Children (NCMEC)]. These reports risk disappearing if end-to-end encryption is implemented by default, since current tools used to detect CSAM [child sexual abuse material] do not work in end-to-end encrypted environments.”

If this is true, then there's nothing else that can be done. Weakened encryption that allows Facebook to intercept users' messages does nothing for the millions of Facebook users who've never trafficked in illegal content. The company can either give users security and privacy, or it can give these governments what they want. There's no middle ground that's going to accommodate both groups.

And this push against Facebook is working. These statements were converted into news articles claiming Facebook is "responsible" for 94% of all reported child porn. But that wording suggests Facebook is the problem, rather than its users. Facebook made 94% of the reports, showing once again it's been doing what it can to combat the problem.

Its decision to offer encryption to Messenger users isn't being made lightly. It's aware of the downside. But it's also aware of the threat posed to its users by a number of malicious entities, which include authoritarian governments and state-sponsored hackers. If it wants to protect its millions of innocent users, it has to offer the same shelter to criminals using the service. That's how it goes. The middle ground governments think the private sector should nerd towards simply doesn't exist.

Filed Under: australia, backdoors, canada, encryption, five eyes, india, japan, new zealand, security, uk, us
Companies: facebook

India's Supreme Court Declares Country's 5 Month Internet Blackout Illegal

from the self-inflicted-wound dept

As we've been discussing, India's government has blacked out internet access in Kashmir since around August, setting records for one of the longest government-mandated internet blackouts in history. India's Prime Minister Narendra Modi has tried to argue that the blackout is a necessary security precaution in the face of growing unrest in the region stemming from its loss of autonomy earlier this year. Granted like most government internet censorship efforts, the move has a lot more to do with cowardice and fear of an informed public than any genuine concern about public welfare.

Fast forward to this week, and India's Supreme Court has warned that the blackout is clearly illegal:

"In a blow to the Hindu nationalist government of the prime minister, Narendra Modi, the country’s highest court said the expression of opposition to state policy could not justify the crackdown. The court said any suspension of the internet, which it called intrinsic to free speech, must be accompanied by detailed reasons to allow aggrieved persons to challenge it in court.

The ruling came in response to petitions filed by Anuradha Bhasin, the executive editor of the Kashmir Times, the opposition Congress party leader, Ghulam Nabi Azad, and others. "The ruling shows that liberty and security have to be balanced. The court has made it clear that it is people’s freedoms that are paramount, not the government’s agenda,” said Sushmita Dev of the Congress party."

After some initial complaints Modi's government restored landline connectivity, and at least some text messaging services were restored at the tail end of December. Still, many in the region have found the outages make it impossible to maintain contact with loved ones and to find those who have been lost in the conflict. And while the Indian courts have clearly noted that the blackout violates free speech and basic human rights, the ruling effectively leaves it up to Modi's government to do the right thing, or at least be more transparent about doing the wrong thing, something that doesn't seem particularly likely:

"In principle the ruling is good, though it has taken a long time. But in terms of immediate relief, there is none. The court has left it to the administration to decide,” said Bhasin."

The human cost of the blackout has been monumental, and studies have shown that internet shutdowns have cost the Indian economy around $1.3 billion in 2019 alone. And while Modi's government continues to insist the blackouts are essential to preserve security and stability in the region, the reality remains that such efforts are the last refuge of cowards who simply don't want their citizens informed as to the scope of the government's aggressive and sometimes fatal buffoonery.

Filed Under: india, internet blackout, kashmir

Indian Government Sets New Record For 'Internet Shutdown By A Democracy'

from the headed-down-to-the-UN-to-collect-its-medal... dept

India's internet blockade targeting the Kashmir state has set a dubious record that really shouldn't be held by a government that considers itself a democracy.

It is now 134 days since the seven million residents of Kashmir had regular access to the internet beyond a handful of government controlled outlets, the longest denial of access by a democratic state.

This brings India close to its nearest competitors in shutdown longevity, China and Myanmar -- neither of which consider themselves responsive to public concerns or demands. Ever since the Kashmir region lost its autonomy earlier this year, the Indian government has been in crackdown mode. The easiest way to control a population you feel needs more controlling is to remove their communication options.

When the region was still independent, it engaged in its own internet blackouts. But those were nothing compared to the Indian government's efforts, which began with the selective censorship of certain content and expanded to eliminate access to almost everything internet-related.

The excuse for the blackout is national security. The Indian government claims it's necessary to prevent Pakistani-led terror groups from organizing. Whether or not that's been effective, the elimination of internet connectivity has done severe damage to the region's population. People with no connection to terror groups and otherwise uninterested in shrugging off the Indian government's shackles are being hurt.

Asmita Bakshi's article for LiveMint covers the human cost of the internet shutdown. Killing off the internet has disabled support systems for women targeted by violent acts and made people -- like Uber driver Dipesh Sharma -- pretty much unemployed.

His earnings are crucial for his family—his wife and daughter, parents and younger siblings, all of whom he supports financially. He also pays ₹4,000 as rent for his two-room accommodation and ₹11,000 as monthly instalment for his vehicle.

The weekend without mobile internet, therefore, was particularly hard on him. “Saturday-Sunday aap samajh lo main berozgaar tha (On Saturday-Sunday, it was like I was jobless)," he says.

One doesn't typically view India as an authoritarian regime, but Baskhi's report points out India's 134 internet shutdowns in 2018 outpaced a number of countries with worse international reputations, including a handful of nations on the UN's human rights blacklist. Its 2018 total was more than Russia, Congo, Yemen, Iraq, Pakistan, and the Philippines combined.

The long-term shutdown is also causing other collateral damage. The region's service providers are losing money every day no one's paying for internet access they don't actually have. Since they're at the mercy of the government, they're being forced to bleed cash until the Indian government feels it's "safe" enough to lift the blockade.

On top of that, there's further annoyance ahead for residents if the Indian government ever decides to give them back their internet connections. As James Vincent reports for The Verge, those affected by the blockade will likely have to rebuild their personal social networks from scratch.

On Wednesday, reports on social media appeared of Kashmiri WhatsApp users leaving group chats in droves. This was a surprise to friends and relatives outside the region given that India has shut down Kashmir’s internet for over four months as part of a dispute over the area’s autonomy.

Some thought the activity might be sign of a further crackdown, but, as first reported by BuzzFeed News, the accounts are being automatically removed in line with Facebook’s inactivity policy. If users don’t log into their account for 120 days (four months), they’re deactivated, meaning individuals will have to sign up to the service again.

It's not an insignificant loss for WhatsApp, which has almost five times as many users in India than it does in the United States. It's definitely a significant loss for Indian users, whose government has managed to terminate their accounts through an extremely disruptive action followed by more than three months of inaction.

The Indian government may be claiming this is a national security necessity, but the reality is it's insulating itself from criticism and preventing unhappy Kashmir residents from organizing or protesting the absorption of the previously-independent region. Any collateral damage here is acceptable because it helps the Indian government achieve its goal of complete control.

Filed Under: democracy, india, internet shutdown, kashmir

India Is Stifling Kashmir Journalists And Twitter Is Helping Get The Job Done

from the this-isn't-helping dept

India has expressed an interest in being considered a top-tier totalitarian state. Not content to let nearby nations claim all the glory in the "Terrible Places to Live" race, India has been stepping up its censorship and its domestic surveillance, presumably in hopes of being the next country to claim a coveted UN blacklist spot.

The Indian government has asked third party contractors to help it build a massive surveillance network utilizing thousands of cameras and the current cream of the facial recognition crop at the time of deployment. The whole thing needs to be in place less than 8 months after the contract is secured, suggesting the government is more than happy to move forward with whatever it has on hand rather than whatever might actually do the job well.

It's also climbing the global censorship charts, trailing only Russia, China, and Turkey in various social media platform demographics. But it is the king of Facebook censorship, delivering more takedown demands to Facebook than closest rival, Russia. When you're out-censoring Russia, you're playing the censorship game right.

Disputed areas the Indian government claims, but doesn't actually control, are only encouraging further censorship from the Indian government. Unfortunately, US tech companies are helping the government maintain control of the narrative by silencing dissenting voices. Kunal Majumder of the Committee to Protect Journalists has more details:

On August 10, 2018, the Indian government informed Twitter that an account belonging to Kashmir Narrator, a magazine based in Jammu and Kashmir, was breaking Indian law. The magazine had recently published a cover story on a Kashmiri militant who fought against Indian rule. By the end of the month, Indian police had arrested the journalist who wrote it, Aasif Sultan, and Twitter had withheld the magazine’s account in India, blocking local access to more than 5,000 tweets. As of October 2019, Sultan was still in prison, facing terrorism-related charges that CPJ has repeatedly condemned. And the @KashmirNarrator Twitter account was still withheld throughout the country.

There has been almost no improvement over the past year. CPJ reports the government's Kashmir-targeted blackout has only been partially listed. To prevent Kashmir-sympathetic reporting from reaching the territory's residents, the Indian government shut down the region's connection to the outside world by cutting off its internet and phone connections. Some mobile phones have been able to route around the government's blockade, but targeted Twitter accounts remain blocked in the region and journalists have been smuggling out reporting using USB sticks.

Since Twitter is one of the best platforms for spreading news quickly, the Indian government has focused its efforts on this platform. It's following in the footsteps of Turkey and President Recep Erdogan by increasing its targeting of Twitter users. Twitter, unfortunately, has been super-helpful.

A CPJ analysis of those notices reveals that hundreds of thousands of tweets blocked in India since August 2017 under the company’s country withheld content policy were shared by accounts that focus on Kashmir. Among dozens of accounts that were withheld, CPJ identified several besides @KashmirNarrator that were sharing news and opinion, raising serious questions about what safeguards are in place to ensure freedom of the press and the free flow of information.

There are few safeguards built into Indian law. The minimal protections the country allows are not being extended to contested areas the Indian government feels are not deserving of speech protections. Twitter could simply refuse to honor these requests targeting dissenting views, but it has chosen to comply with India's demands, most likely because the country is home to nearly a billion potential users.

If there's any upside to this, it's that the government's targeting appears to be more keyword-based rather than content-based.

CPJ analyzed every account involved, whether the request was based on a single tweet, several tweets, or the account itself, reviewing more than 400 in total. Around 45 percent of those accounts mentioned Kashmir in the handle or bio, or had recently tweeted about Kashmir, according to CPJ’s review.

This censorship is damage that can be routed around. If Kashmir is one of the keywords sought by Indian censors, removing this word might allow links to reporting to sneak past censors. It also appears Twitter is only blocking in certain regions of the country, so tweets and accounts are still visible as long as Twitter believes viewers aren't in the affected areas.

That being said, Twitter's compliance is still problematic. Twitter is unwilling to discuss how it applies local laws to tweets and accounts targeted by governments with track records of stifling dissent. The legal options it has available are generally left unexplored. It makes a certain amount of sense in terms of the bottom line. Challenging foreign rulings and takedown notices requires money and man hours Twitter may not necessarily have to spare. The potential userbase in India is too large to ignore, which means it's probably too large to be considered expendable when principles are on the line.

US tech companies aren't doing all that great dealing with competing interests on a worldwide scale. While some concessions can be excused under the theory that some connection is better than nothing, assisting governments in censorship of critics and journalists isn't acceptable, no matter how much market share is at stake.

Filed Under: censorship, content moderation, india, journalism, kashmir
Companies: twitter

India Looking To Be The Next China, Sends Out Call For Bids On Massive Facial Recognition Program

from the a-testing-environment-containing-1.3-billion-subjects dept

India must be looking across the border at China and nodding approvingly. India is rolling up the global censorship charts, firing off thousands of takedown demands and court orders to American social media companies. The government also seems overly-concerned with "fake news" and has been abusing its national security laws to make social media posts (and sometimes their posters) disappear into the ether.

Tech advancements are increasing the capabilities of the government's multiple surveillance networks. The most immediate beneficiary has been the country's law enforcement, which has added pre-crime analytics to a tool chest containing thousands of cameras and their biometric add ons.

Citizens are also being saddled with digital IDs based on their fingerprints. The tech doesn't work as well as dozens of sci-fi movies led us to believe. The end result is people being unable to convince the government they are who they say they are, thanks to faulty tech or fingerprints that aren't in perfect enough shape to talk print readers into responding appropriately. This had led to people losing access to public assistance, sending the nation's most vulnerable residents into tailspins they may never recover from.

Since this modernization is all going so well, the Indian government wants to expand its biometric collections. The country is seeking to assemble one of the world's largest facial recognition databases, as well as everything needed to make use of it, including cellphone apps for cops running scans and searches while on patrol.

The daunting scope of the proposed network is laid out in a detailed 172-page document published by the National Crime Records Bureau, which requests bids from companies to build the project. Interested parties had until October 11 to submit their proposal.

Currently unnamed, the project would match images from the country's growing network of CCTV cameras against a database encompassing mug shots of criminals, passport photos and images collected by agencies such as the Ministry of Women and Child Development.

It's being done for the children. Or, at least, that's one of the talking points. New Delhi police have been using existing databases to identify and locate some of the country's 300,000 missing children. While this effort is noble and well-intentioned, the expansion of this to encompass pretty much anyone who walks past a government camera is a problem. This isn't about maintaining criminal databases to track suspects who are being sought by the government. It's about adding everyone to the database as quickly as possible and giving law enforcement discretionary access.

According to the bid solicitation document [PDF], this database will be filled with images in bulk from a large number of sources. Here's part of the requested feature list:

Capture face images from CCTV feed and generate alerts if a blacklist match is found.

Add photographs obtained from newspapers, raids, sent by people, sketches etc. to the criminal’s repository tagged for sex, age, scars, tattoos, etc. for future searches.

The system should have option to upload bulk subject images and generate alerts if any of the subject images matches with the registered faces in the database.

The proposed FRS system should have option to input face images in JPEG, PNG etc. image and search and generate face matches with the stored database.

The government wants something it may not be able to have, at least not as soon as it would like it. It wants a database filled with as many photos as it can upload and software that can match faces quickly, even if the person requesting it is a police officer carrying nothing more powerful than a mobile phone in an area with sketchy service. The bid document says the government expects database search results in 3 seconds or less, no matter where the search is performed or what device is being used.

The system shall be able to broadly match a suspect/criminal photograph with database created using photograph images available with Passport, CCTNS, ICJS and Prisons, Ministry of women and child development (KhoyaPaya) State or National Automated Fingerprint Identification System or any other image database available with police/other entity. Match suspected criminal face from pre-recorded video feeds obtained from CCTVs deployed in various critical identified locations, or with the video feeds received from private or other public organization’s video feeds.

The system should also auto-refresh database contents every 30 minutes to ensure anyone using it has access to the latest uploads. The government is also demanding the contractor provide the "latest and the best solution/algorithm of facial configuration."

The Indian government is asking for everything. The winning vendor will have 30 weeks to design and deploy the system. The government wants it live less than eight months after the contract is signed. Given the timetable, it's likely the Indian government will end up with something that doesn't work as well as it wants to, but will involve 1.3 billion beta testers. No worries though. It will only be people's freedom and privacy on the line when the system rolls out, turning India into China 2.0, but with less stress testing and more "we actually care about privacy" talking points.

Filed Under: facial recognition, india, privacy, surveillance

Skynet, But For Welfare: Automating Social Services Is Killing People

from the our-hands-are-clean-said-the-gov't-since-it's-just-robots-doing-the-work dept

We've talked before about the over-reliance on tech to do certain jobs that cannot be simplified to the sum of mathematical parts. The criminal justice system is starting to turn over sentencing to algorithms -- something that seems like the smart thing to do but removes judicial and prosecutorial discretion from the mix, leaving defendants with the unpalatable option of challenging software they're never allowed to examine.

Police departments are also moving towards predictive policing. Relying on historical data, cops are hoping to head off future crimes by allocating resources to areas where crime appears to be more likely to be committed. Sounds good on paper, but in reality, all it does is reinforce biases and push law enforcement to treat everyone in targeted areas as criminals. If the data being fed in reflects biased policing, crunching the numbers even harder isn't going to erase that. It's only going to reinforce it. And, again, suspected criminals aren't able to access the data or software that puts them in law enforcement's crosshairs.

A certain amount of automation is expected as government agencies seek to streamline public services. The problem isn't necessarily the tech. It's the removal of human interaction. As has been stated here frequently, moderation at scale is impossible. So is automated governing. Automated processes are as prone to failure as the people overseeing them. But when you decide software is going to do almost all of the work, those who need the assistance of other humans most are cut out of the loop.

Citizens looking for government assistance have grown accustomed to jumping through red tape hoops. Now, the hoops are inaccessible, but still must be jumped through. The most marginalized members of society are given URLs instead of contact names and numbers when many of them have no reliable access to the internet or a computer. A new series by The Guardian shows the human cost of going paperless. It's happening all over the world, and it's literally killing people.

The most disturbing story comes from Dumka in India. Here, we learn of the horrifying human impact that has befallen families as a result of Aadhaar, a 12-digit unique identification number that the Indian government has issued to all residents in the world’s largest biometric experiment.

Motka Manjhi paid the ultimate price when the computer glitched and his thumbprint – his key into Aadhaar – went unrecognised. His subsistence rations were stopped, he was forced to skip meals and he grew thin. On 22 May, he collapsed outside his home and died. His family is convinced it was starvation.

That's the worst case scenario. But there is plenty of ugliness in between. Governments aren't looking to defense budgets or law enforcement agencies to make cuts. Instead, they're adding to their bottom lines by pursuing citizens they think have screwed the government. Another process being automated is governments' attempts to collect alleged overpayments of social services funds. There's a statute of limitations on most debt, but software is being used to resurrect ancient debt governments feel they're owed. This is resulting in the destruction of people's lives and finances as they find themselves unable to challenge these automated determinations.

In Illinois, the Guardian has found that state and federal governments have joined forces to demand that welfare recipients repay “overpayments” stretching back in some cases 30 years. This system of “zombie debt”, weaponized through technology, is invoking fear and hardship among society’s most vulnerable.

As one recipient described it: “You owe what you have eaten.”

It's not just "zombie debt." It's also "robodebt." The determinations of owed debt are made by automated processes. The collection process is also automated, separating those suddenly facing possibly undeserved clawbacks from the human assistance they need to determine whether or not the claim is valid. Bureaucracies have always been faceless. With the addition of cold calculations, they've weaponized this facelessness to deter citizens from pushing back against a decision-making process composed of 1s and 0s. This, too, is linked to a rising human cost.

Compare and contrast the public statements with reality. Here's how the UK government is pitching its transition to automated governance:

“We are striking the right balance between having a compassionate safety net on which we spend £95bn, and creating a digital service that suits the way most people use technology,” said a DWP [Department for Work and Pensions] spokesperson. “Automation means we are improving accuracy, speeding up our service and freeing up colleagues’ time so they can support the people who need it most.”

If this sounds like a positive development, it's only because you haven't seen it in action.

[C]laimants have warned the existing automation in UC’s “digital by default” system has already driven some to hunger, breakdown and even attempted suicide. One described the online process as a “Kafka-like carousel”, another as “hostile” and yet another as a “form of torture”. Several said civil servants already appeared to be ruled by computer algorithms, unable to contradict their verdicts.

The same thing is going on in Australia. The government's embrace of "austerity," combined with its fondness for automating social services and debt collection processes has resulted in a world of hurt for the many Australians unable to challenge automated determinations or connect with actual humans willing to help them through the process. Asher Wolf's Twitter feed is an invaluable resource for these issues, detailing the fallout of automated social assistance programs all around the world.

It's not that all automation is bad. It's that automation without strict oversight or human control isn't making anything better for the most vulnerable members of society. When governments pay millions to let machines make decisions affecting humans, humans almost always seem to come out on the losing end. Legislators may proudly display charts showing incremental gains in efficiency, but few are willing to discuss the constituents they've sacrificed on the altar of automation. No system is perfect, but one that relies more on math than human discretion isn't an improvement.

Filed Under: aadhaar, algorithms, automation, criminal justice, india, law enforcement, police, social services