Former NSA Lawyers Attack Senator Wyden For Hinting At NSA Surveillance Excesses That Are Now Confirmed

from the secrecy-at-all-costs dept

For many, many years we've covered Senator Ron Wyden's seemingly quixotic attempts to signal to the American public (and press) that the NSA was doing a hell of a lot more surveillance than most people believed, even those who were carefully reading the laws. Because secrecy rules meant that he couldn't directly reveal what he'd learned while on the Senate Intelligence Committee, he had to issue vague statements, documents and speeches hinting at things that were going on that he couldn't actually talk about. Of course, now that Ed Snowden leaked a bunch of documents, it's shown that Wyden was absolutely correct in what was going on (and that the American public wouldn't like it).

You'd think that would lead people to have a lot more respect for the incredible efforts he went through to alert people to these issues without breaking the secrecy laws. And, in fact, many more people are aware of those efforts. The Washington Post has a nice article about Wyden's attempts to bring these issues out and to get a real debate going on them.

However, towards the end, the reporter talks to two different former top lawyers at the NSA, who both appear to be really, really angry about Wyden daring to suggest to the public that the NSA wasn't playing straight with the American public. First up, we've got Stewart Baker, the former NSA General Counsel and top Homeland Security official, who is so anti-civil liberties and pro-surveillance that he's almost a caricature of himself -- including claiming that the Boston bombings prove that Americans need less privacy and that civil libertarians complaining about too much surveillance are the real cause for the September 11 attacks.

Not surprisingly, Baker is not at all happy about Wyden's efforts:

"I would characterize what he's been doing as trolling for leaks. And hinting at the kinds of leaks that he wants to see," said Stewart A. Baker, a former official at the NSA and the Department of Homeland Security. "He's directed everybody's attention — who didn't sign the oath that he signed — to places where they might look."

Oh really now? These "leaks" wouldn't be necessary if the NSA and its lawyers weren't reinterpreting the law to collect the data on every phone call Americans make. He wasn't "trolling for leaks," -- he was alerting the American public to the sneaky tricks that the NSA has been using to violate the 4th Amendment and collect massive databases on Americans.

Another former NSA lawyer is also quoted in that same article attacking Wyden for his (now infamous) questioning of James Clapper, in which Clapper flat out lied to Wyden, saying that it was untrue that the NSA collects information on millions of Americans.

This tactic has been criticized by people close to the intelligence community. Joel F. Brenner, a former NSA senior counsel, called it a "low dishonorable act" in a recent post at the blog Lawfare. Brenner objected to Wyden "putting Clapper in the impossible position of answering a question that he could not address truthfully and fully without breaking his oath not to divulge classified information."

Really? A "low dishonorable act" for asking a rather basic question of the Director of National Intelligence? No, I'd argue that collecting data on every single American's phone calls is a "low dishonorable act." Furthermore, I'd argue that flat out lying to Congress about that collection of data is a "low dishonorable act." But asking the Director of National Intelligence for a straight up answer on what the NSA is doing, which clearly contradicts the plain meaning and intention of the Patriot Act? That's not a "low dishonorable act" at all. As for the claim that this put Clapper in an "impossible position," that's clearly untrue. Clapper could have easily noted that he had answered (or that he would answer) in a classified manner if there really was a legitimate reason for that info to be classified (of course, there never was such a reason).

These attacks are really incredible, and show the lack of shame these former NSA lawyers have. The revelations from Snowden have made it clear that Wyden was doing a real public service, in highlighting massive abuse by the NSA, and now that's public. These lawyers may not like that it's public, but that's not Wyden's fault. The information was going to come out at some point no matter what. Wyden himself points out that this was never a dirty trick, but just exactly what Congress is supposed to be doing in its oversight job:

"You can't do vigorous oversight if the leaders of the intelligence community are misleading the American people, and Congress, in public hearings," Wyden said.

This is obviously true, but the likes of Stewart Baker and Joel Brenner apparently believe that no one in the government -- even those in charge of overseeing the NSA efforts -- should be allowed to call out the NSA for its abuse because that might actually lead to proof that the abuse existed. In other words, they want no actual oversight at all.

Filed Under: joel brenner, nsa, nsa surveillance, ron wyden, stewart baker

Former Top NSA Lawyer Blames Civil Libertarians For 9/11, Says Hype About NSA May Lead To A Repeat

from the fuck-the-4th-amendment,-live-in-fear,-bitches dept

Ah, Stewart Baker. We've mentioned him a few times in the past. He's the former Assistant Secretary for Homeland Security and General Counsel for the NSA. He's, as you may have guessed, strongly in the "pro-surveillance" camp, and has even attacked some of the journalists who revealed the NSA leaks, claiming that by revealing the truth they're no longer journalists, but advocates. He's taking part in a House Judiciary Committee hearing looking into oversight on the administration's use of FISA and his testimony is quite incredible. It goes way beyond what we've seen from others. While it repeats his baseless and confused attack that some journalists who were key players in this story were evil "advocates" rather than journalists, that's nothing compared to his lack of regard for the Constitution and basic civil liberties. In fact, he very clearly blames 9/11 on civil liberties advocates, and fears that all this talk about surveillance may lead to a repeat event.

To be blunt, one of the reasons I'm here is that I fear we may repeat some of the mistakes we made as a country in the years before September 11, 2001. In those years, a Democratic President serving his second term seemed to inspire deepening suspicion of government and a rebirth of enthusiasm for civil liberties not just on the left but also on the right. The Cato Institute criticized the Clinton Administrations' support of warrantless national security searches and expanded government wiretap authority as "dereliction of duty," saying "[i]f constitutional report cards were handed out to presidents, Bill Clinton would certainly receive an F-an appalling grade for any president-let alone a former professor of constitutional law?" The criticism rubbed off on the FISA court, whose chief judge felt obliged to give public interviews and speeches defending against the claim that the court was rubber-stamping the Clinton administration's intercept requests.

This is where I. should insert a joke about the movie "Groundhog Day." But I don't feel like joking, because I know how this movie ends. Faced with civil liberties criticism all across the ideological spectrum, the FISA court imposed aggressive new civil liberties restrictions on governments use of FISA information. As part of its "minimization procedures" for FISA taps, the court required a "wall" between law enforcement and intelligence. And by early 2001, it was enforcing that wall with unprecedented ferver. That was when the court's chief judge harshly disciplined an FBI supervisor for not strictly observing the wall and demanded an investigation that seemed to put the well-regarded agent at risk of a perjury prosecution. A chorus of civil liberties critics and a determined FISA court was sending the FBI a single clear message: the wall must be observed at all costs.

And so, when a law enforcement task force of the FBI found out in August of 2001 that al Qaeda had sent two dangerous operatives to the United States, it did ... nothing. It was told to stand down; it could not go looking for the two al Qaeda operatives because it was on the wrong side of the wall. I believe that FBI task force would have found the hijackers -- who weren't hiding -- and that the attacks could have been stopped if not for a combination of bad judgment by the FISA court (whose minimization rules were later thrown out on appeal) and a climate in which national security concerns were discounted by civil liberties advocates on both sides of the aisle.

Got that? Anyone advocating for basic civil liberties is to blame for 9/11. Holy fuck. This kind of thinking is about as anti-American as I can think of. As we've discussed, protecting civil liberties is at the core of the American way of life. "Give me liberty or give me death" is the phrase that Patrick Henry chose, and apparently Stewart Baker believes the American motto should be "you're all going to die if you fight for civil liberties!" Shameful.

And that's not the only example he uses. He goes back to the early days of organized US intelligence efforts, talking about how we "won" World War II by ignoring limitations on intelligence collections.

The Americans who fought World War II had a different view; they thought that intelligence couldn't be conducted under any but the most general legal constraints. This may have been a reaction to a failure of law in the run-up to World War II, when U.S. codebreakers were forbidden to intercept Japan's coded radio communications because section 605 of the Federal Communications Act made such intercepts illegal. Finally, in 1939, Gen. George C. Marshall told Navy intelligence officers to ignore the law. The military that followed made the officers look like heroes, not felons.

Got that? Ignoring laws that protect your privacy and communications is good, because of one situation where intelligence agencies breaking the law helped the US in war. But that kind of justification is a justification that the government has the power to do anything it wants to achieve its goals. We would all be a lot "safer" if the government could randomly search homes and throw those it doesn't like in jail with no trial. And Stewart Baker could smugly sit in front of Congress with his best "this is my best grave face" and talk about how this "saves lives." But that's not how it works. We don't ignore the Constitution and basic civil liberties because "it makes us safer." Because it doesn't. It shows what hypocrites the US government can be, that it has no respect for the people who duly elected its leaders. That it has no respect for the Constitution. That it will go to any length to control the population, with vague scare stories of "but... but... terrorism."

Baker then moves on to argue that any public debate over the US government absolutely destroying the civil liberties of the public they're supposed to serve only creates problems, because any such discussion just gives bogey men more opportunities to avoid further dragnet surveillance:

Forty years later, though, we're still finding problems with this experiment. One of them is that law changes slowly while technology changes quickly. That usually means Congress has to change the law frequently to keep up. But in the context of intelligence, it's often hard to explain why the law needs to be changed, let alone to write meaningful limits on collection without telling our intelligence targets a lot about our collection techniques. A freewheeling and prolonged debate -- and does Congress have any other kind? -- will give them enough time and knowledge to move their communications away from technologies we've mastered and into technologies that thwart us. The result won't be intelligence under law; it will be law without intelligence.

Basically, shut up with the debate, just let us go back to spying on fucking everyone. If we actually have to "debate" and "protect the Constitution," some "bad guys" might talk without us knowing about it. And then we'll all die.

Later in his remarks, he makes this point even clearer, insisting that "open debate" will cause "great harm."

In short, in both section 215 and section 702, the government has found a reasonable way to square intelligence-gathering necessities with changing technology. Now that they've been exposed to the light of day, these programs are not at all hard to justify. But we cannot go on exposing every collection technique to the light of day just to satisfy everyone that the programs are appropriate. The exposure itself will diminish their effectiveness. Even a fair debate in the open will cause great harm.

Bullshit. We keep hearing this claim, and there's no evidence to support it at all. Most people doing really bad things have always suspected that these telco and internet services were watched closely by the NSA. Just look at how Osama bin Laden communicated with the outside world, and it's clear that Al Qaeda knew how to go to great lengths to avoid leaving revealing marks via phone or internet services, moving messages around on USB sticks, having computers with no internet connection, and sending people many miles away to upload and download things.

In the security world, people have long noted that "security by obscurity" is a recipe for trouble. A truly strong security system can withstand attack even if its details are public. The same holds true for intelligence gathering techniques. If they are truly justified and justifiable, they can withstand public scrutiny and public debate.

Later, he again argues that the openness of this debate has already harmed American interests, in part because European countries are worse than the US with their own surveillance efforts, but since only the Americans are having this open debate, European politicians can attack the US while knowing that their own -- even worse -- surveillance efforts are still secret.

He then tries to flip the whole thing around and argue that supporters of civil liberties are actually anti-technology, because they're trying to limit the government's use of technology. That's ridiculous, since many of the loudest supporters of civil liberties come from the tech and innovation communities. No one thinks the government shouldn't make efficient use of technology -- but that's very different from saying it's okay for the government to either convince or force companies to cough up all sorts of private data on everyone or risk the wrath of the US government. That's not a fair fight. The government has the power to compel people and companies to do things that they would not do otherwise, though I guess an extreme authoritarian like Baker either doesn't realize this or doesn't see it as a problem.

At the end, he makes a bunch of claims about how it's the US government's job to "protect" everyone -- though I'd like to see where that's laid out in the Constitution. As mentioned above, he makes some valid points that other countries are just as bad, if not worse, but that's hardly a compelling argument, because that just allows others to flip it around, and claim that the US has no moral high ground, since it's ignoring the civil liberties of the public -- something that Baker notes he directly supports in this testimony -- for some vague and impossible promises of "safety."

Baker's key claim is the same bogus one we've heard before: an undying belief in a supreme authoritarian government that gets to do whatever the hell it wants in the name of "national security." Civil liberties and basic Constitutional protections just get in the way, and ain't nobody got time for that.

Filed Under: 4th amendments, 9/11, civil liberties, nsa, nsa surveillance, stewart baker

Yes, Journalists Should Be Advocates For Shedding Light On Secret Government Powers

from the say-that-again dept

It's been quite incredible to see defenders of the surveillance state attack not just Edward Snowden for leaking information about the NSA's surveillance efforts, but also go after the reporters who broke the various stories concerning what he leaked. While many of the attacks have been focused on Glenn Greenwald, the other journalist who has access to Snowden is the Washington Post's Bart Gellman, and apparently it's his turn to be attacked for doing a good job in reporting. The attacker, in this case, is Stewart Baker, the former Assistant Secretary of Homeland Security and former General Counsel for the NSA. He wrote an incredible attack on Gellman, arguing that he has somehow crossed the despicable line from "journalist" to "advocate" in his reporting on Snowden's leaks.

Baker and Gellman had a conversation via email concerning why Gellman chose to publish which information when, and as part of his response, Gellman pointed out -- quite rightly -- that in one of the recent leaks, concerning how the NSA goes about "minimizing" the likelihood that Americans are profiled, it needs to be acknowledged that the NSA is collecting tons of data on Americans and that can have a real impact -- an impact that the NSA refuses to acknowledge. Gellman writes convincingly on this topic, and Baker's response is to ignore the entire substance of Gellman's argument, to condescendingly claim that this is no longer journalism:

Maybe it's just me, but I don't think anyone can read that without wondering whether Bart Gellman has slipped from journalist to advocate. And from there it's a short step to wondering whether he suppressed the guidelines in his earlier story because they didn't fit his preferred narrative. Somehow they were not worth disclosing when they might have blunted privacy concerns but they had to be disclosed once "they seem[ed] to demonstrate that the president’s words are untrue." Put another way, it seemed better to hold the truth back until it could be used to sandbag the adversary.

Gellman shot back, via Twitter a key point that is all too often ignored:

What @stewartbaker overlooks is that my advocacy is for open debate of secret powers. That's what journalists do

Journalists have always been advocates. They're supposed to be advocates for openness and transparency, explaining to the public what others are up to which they should know about. To argue that Gellman's reporting is somehow less than worthy because he's advocating for open debate on secret programs of government surveillance is really quite pitiful on Baker's part. Once again, it suggests that the defenders of this kind of surveillance cannot and will not debate the merits of the program in public, instead resorting to what appears to be petty name calling, rather than substantive discussion about this program they love so much.

Filed Under: advocacy, bart gellman, glenn greenwald, government, journalism, openness, reporting, stewart baker, transparency

Former DHS Official Says Boston Bombing Proves ACLU & EFF Are Wrong About Surveillance And CISPA

from the call-up-OED:-'crass'-needs-to-be-redefined dept

There have been a lot of kneejerk reactions to the Boston Marathon bombing. Between certain politicians and pundits quickly turning the horrific event into makeshift planks to support their pet legislation/conspiracy theories and the New York Post cranking out reports so "exclusive" they weren't even true, the internet and airwaves have been filled with the sort of stupidity we've sadly come to expect when tragedy strikes.

Then something comes along that swaggers right up to you and punches you in the face with its breathtaking imbecility. This is Stewart Baker's "contribution" to the national discussion, filed over at the otherwise esteemed Volokh Conspiracy under the heading "Fool Me Once..."

When people say, "The stupid! It burns!" they're usually referring to garden variety stupidity or the occasional bit of advanced moronics that momentarily derails entire comment threads. This thing that Baker has cobbled together out of the stuff he likes best -- surveillance and more surveillance -- towers over other moments of burning stupid like a Wicker Man made entirely from straw. The stupid here doesn't simply burn. It immolates the rational person's mind, replacing coherent arguments with searing, nightmarish pain that reduces responses to stunted internet-native declarations like "wat."

Baker wants us to believe that the EFF and the ACLU are wrong... in both instances. What it actually shows is the EFF/ACLU's consistency on these issues. Unless Baker has heard otherwise, the EFF and ACLU are still against widespread surveillance (along with CISPA). This event, as terrible as it was, doesn't change that stance.

Only someone like Baker, a former DHS "company man" and freelance contributor to the underdeveloped "TSA porn" genre, would take the stance that the FBI's release of camera footage capturing the two bombing suspects' images justifies the massive amount of surveillance many in this country are subjected to in nearly every public space. (His take conveniently ignores the fact that the stills posted by the FBI appear to have been captured by cameras deployed by private businesses.)

Only someone who seems to detest the actions of privacy advocates would insinuate through a disingenuous headline ("What they said about street cameras before the bombing") that the EFF and ACLU would change their views on surveillance after an event like this. They won't. Only fair-weather friends of Constitutional rights and civil liberties change their stances after a tragedy like this. (See also: EVERYTHING THE GOVERNMENT HAS ENACTED SINCE SEPT. 11, 2001 THAT DEALS WITH NATIONAL "SAFETY" OR "SECURITY.")

And only someone who knows CISPA is a purposely flawed bill aimed at giving the government even more control and surveillance powers would have the gall to cheapen this tragedy by attempting to equate the two using a bullshit "conclusion" hastily MS Painted together and dropped unceremoniously into the blogosphere like a flaming bag of foul-smelling rhetoric on the doormat.

One question, though, Stewart, tied into Boston Marathon as you've done with yours: all of this surveillance, all these increased security measures, all this warrantless wiretapping, all these pat downs and scans at the airport, all of these drones flying all over the world, all these double-secret interpretations of super-secret laws, all of these redacted FOIA responses, all of this Cyber Pearl Harbor hand wringing, all of encroachment of the government into every aspect of American existence?

What did it prevent?

Filed Under: dhs, privacy, stewart baker, surveillance
Companies: aclu, eff

Hollywood Still Doesn't Realize That The Internet Drives Popular Culture Now

from the big-miscalculation dept

Stewart Baker, the former DHS official whose warnings about how SOPA would wreak havoc on online security were instrumental in convincing many of our elected officials that SOPA and PIPA were half-baked legislative disasters, now has a fascinating writeup for The Hollywood Reporter, trying to explain why the Republican Party turned strongly against SOPA/PIPA. We've pointed out a few times, that the different reactions by the Democrats and Republicans to the online protests threaten to cost the Democrats a generation of voters who had previously looked to them as the party that "got" the internet.

Of course, where it gets even more insightful is Baker's analysis not just of how the Democratic Party appears to have miscalculated badly the reaction to these bills, but how truly and spectacularly Hollywood has failed to understand what happened -- in part because Hollywood still thinks that it drives pop culture. The truth, however, as Baker points out, is that the internet drives popular culture these days... and on the internet, Hollywood is a big bully:

The [entertainment] industry still doesn't understand its adversary. From the start, studios saw the fight over SOPA as a struggle with a bunch of other companies -- Google and Internet service providers among them -- that were hoping to profit from the Internet travails of the entertainment industry.

That turned out to be wrong. In fact, the industry is fighting what amounts to a new popular culture.

Unlike the old pop culture Hollywood dominated, this one is largely independent of the music, movie and broadcast industries. In fact, people who spend hours online instead of watching TV or going to movies will probably encounter the entertainment industry only when YouTube videos of their kids dancing to Prince or spoofing Star Wars are pulled down by Hollywood's bots, or when the RIAA threatens to sue them for their college savings, or when digital rights software makes it hard to move their stuff to a new tablet or phone.

To the entertainment industry, these episodes might seem like collateral damage in the fight to stop piracy. To the new pop culture, though, collateral damage and misuse of enforcement tools are everywhere, and they threaten everyone. The content industry has made itself into the villain. Increasingly, it looks like an occupying power, obeyed at gunpoint, despised for its ham-handed excesses and resisted from every dark corner. Unfortunately for Hollywood, as its customers migrate to the Internet, it is losing not just their money but their hearts and minds as well.

There's a lot more in Baker's article about the political implications of all of this, which are worth thinking about as well, but I wanted to focus on this key point. Last week, at the Midem music industry conference, I was amazed at how many people from the legacy music business believe, 100%, that the reason SOPA/PIPA were stopped was because Google stepped up its lobbying efforts. I can't even begin to count how many conversations I had with people trying to explain to them that Google only played a small role in what happened, really jumping on the bandwagon pretty late in the game. It was a widespread group of internet users who spoke up, and that really has changed the equation. And Hollywood still can't seem to wrap its mind around that.

That may be because Hollywood was popular culture for so long. It seems to just assume that this is still the case, when there's an awful lot of evidence suggesting otherwise. And really, that explains both Hollywood's confusion in how to deal with all of this, as well as one of the reasons it's lashing out. When Hollywood no longer drives pop culture, it loses its influence, and as it loses its influence, that's going to spell trouble for its business model. The biggest threat to Hollywood's dominance isn't piracy. It's that people no longer view Hollywood as the main source of pop culture any more. Art forms often lose their popularity over time. A few years back, we pointed to a quote from Paul Oskar Kristeller that seems worth highlighting again:

There were important periods in cultural history when the novel, instrumental music, or canvas painting did not exist or have any importance. On the other hand, the sonnet and the epic poem, stained glass and mosaic, fresco painting and book illumination, vase painting and tapestry, bas relief and pottery have all been "major" arts at various times and in a way they no longer are now. Gardening has lost its standing as a fine art since the eighteenth century. On the other hand, the moving picture is a good example of how new techniques may lead to modes of artistic expression for which the aestheticians of the eighteenth and nineteenth century had no place in their systems. The branches of the arts all have their rise and decline, and even their birth and death.

Perhaps it's not piracy that Hollywood is fighting here. Maybe it's the industry's own cultural relevance.

Filed Under: hollywood, internet, movies, pipa, politics, pop culture, sopa, stewart baker

'Nerds' Finally Get Their SOPA Hearings Over Technical Impact... But Not At The Judiciary Committee

from the good-to-see dept

While Lamar Smith and the House Judiciary Committee still have refused to hear from the actual technology experts, Rep. Issa has now scheduled a SOPA-related hearing... in his House Oversight Committee, and it will finally allow tech experts to speak about the technological impact of SOPA. It's a good list of speakers including: famed security researcher Dan Kaminsky (who co-authored the paper about problems of SOPA with Paul Vixie and others), Stewart Baker (former DHS/NSA top official, who has warned about SOPA harming internet security), Dr. Leonard Napolitano (from Sandia National Labs, who also warned about the security problems), Michael Macleod-Ball (from the ACLU). And representing the startup world, we've got Brad Burnham (from Union Square Ventures -- probably the most sought after VC firm for startups today) and Alexis Ohanian, the entrepreneur behind Reddit, Hipmunk and Breadpig, and who has been an outstanding advocate for why SOPA is dangerous. Think of this as the hearing that Lamar Smith didn't want you to hear. Update: Reasonable point in the comments: this hearing is extremely one-sided as well. Perhaps that's fitting "counter-balance" for the pro-SOPA hearing that the Judiciary Committee held, but it still would be nice to have at least some "pro-" voices on the hearing. Of course, can you think of an actual, respected technologist who is in favor of SOPA? Yeah... didn't think so...

Filed Under: alexis ohanian, brad burnham, cybersecurity, dan kaminsky, darrell issa, dns blocking, dnssec, leonard napolitano, michael macleod-ball, pipa, protect ip, security, sopa, stewart baker

Former DHS Assistant Secretary Stewart Baker On SOPA 2.0: Still A Disaster For Cybersecurity

from the no-surprise-there dept

One of the most credible critics of SOPA -- and one whose concerns certainly got the interest of Congress during the November Judiciary Committee hearings -- is Stewart Baker, the former Homeland Security Assistant Secretary and former NSA General Counsel, who argued that it would be a disaster for online security. So now that Lamar Smith has updated the bill to supposedly take into account the concerns of experts like Baker, how does he feel about the bill? Apparently, he still thinks it's a total disaster for online security:

Unfortunately, the new version would still do great damage to Internet security, mainly by putting obstacles in the way of DNSSEC, a protocol designed to limit certain kinds of Internet crime.

Baker lays out, in plain English, the problem here:

Today, it’s not uncommon for crooks to take over Internet connections in hotels, coffee shops and airports -- and then to direct users to fake websites. Users sent to a fake banking site are prompted to enter account and password data, which is used to loot the account. DNSSEC prevents such attacks by giving each website a signed credential that must be shown to the browser by the domain name system server before the connection can be completed.

That’s a great idea, but crooks will predictably try to override it. Their best bet is to claim that the website doesn’t have a signed credential – a claim that will be plausible at least during the transition to DNSSEC. What should a browser do if a website says it doesn’t have a signed credential yet? The site might be telling the truth, or it might be a fake site backed by a DNS server that’s been tampered with. To find out, the browser needs to ask a second DNS server, and if that server doesn’t give an answer, a third and a fourth server until it gets an answer. That’s the only way to keep criminals from blocking the real DNS credentials and offering their own.

Unfortunately, the things a browser does to bypass a criminal site will also defeat SOPA’s scheme for blocking pirate sites. SOPA envisions the AG telling ISPs to block the address of www.piracy.com. So the browsers get no information about www.piracy.com from the ISP’s DNS server. Faced with silence from that server, the browser will go into fraud-prevention mode, casting about to find another DNS server that can give it the address. Eventually, it will find a server in, say, Canada. Free from the Attorney' General’s jurisdiction, the server will provide a signed address for piracy.com, and the browser will take its user to the authenticated site.

That’s what the browser should do if it’s dealing with a hijacked DNS server. But browser code can’t tell the Attorney General from a hijacker, so it will end up treating them both the same. And from the AG’s point of view, the browser’s efforts to find an authoritative DNS server will look like a deliberate effort to evade his blocking order.

This is a pretty big problem, because SOPA has that nasty anti-circumvention clause in it. And just the very act of fraud detection is a form of circumvention, which will violate SOPA. Think about that for a second. Basically a browser that does the most secure and reasonable thing in the face of a possible man-in-the-middle attack... is now liable for breaking the anti-circumvention clause. This is pretty scary.

It’s hard to escape the conclusion that this provision is aimed squarely at the browser companies. Browsers implementing DNSSEC will have to circumvent and bypass criminal blocking, and in the process, they will also circumvent and bypass SOPA orders. The new bill allows the AG to sue the browsers if he decides he cares more about enforcing his blocking orders than about the security risks faced by Internet users. Indeed, the opaque language about “another in concert with such entity” makes perfect sense in the context of browser extensions. It allows the AG to sue not just browsers but also add-ons with this feature.

The end result, of course, is that companies will avoid implementing DNSSEC -- an important standard that's been under careful development for over a decade:

Now imagine you are Microsoft, or Google, or Apple, or Mozilla. The DNSSEC guys come to you and ask you to implement DNSSEC. It won’t increase your revenue, they admit, but it will make the Internet much safer for your users. You want to be a good internet citizen, so you think maybe you should devote some precious code-writing resources to the cause. But first you ask your lawyers whether they foresee any problems.

“Well, yes,” they’d have to say. “If you add code to the browser that implements DNSSEC, you’ll have to add code that circumvents criminal hijackings of the DNS system. And that code can be declared illegal by the Attorney General pretty much whenever he likes. You can litigate about it, of course, but if you lose, the AG can shut down all shipments of your browser until it’s been revised to the satisfaction of his staff and their advisers in Hollywood.”

Faced with that advice, would you implement DNSSEC?

Neither would I.

Yeah. Basically, sixteen years of hard work to build a system that will prevent man-in-the-middle attacks and keep the internet much safer... washed completely down the drain because Hollywood still can't understand basic economics of how to make money online. And folks in Congress actually think this is a good idea?

Filed Under: copyright, cybersecurity, online security, sopa, stewart baker

More And More People Speak Up Against SOPA

from the speak-up dept

With the hearings this morning (more on that later), there were also more statements publicly made against SOPA this morning. Two key ones are, unfortunately, behind Politico's paywall, so I can't link or quote too much. The first, by former Homeland Security Assistant Secretary and former NSA General Counsel, Stewart Baker, was raised a few times during the hearings. Baker focused on the problems of SOPA and PROTECT IP and their impact on online security. He notes that the DNS blocking portions of both bills "run directly counter" to the government's cybersecurity efforts:

Because “block and redirect” is exactly what crooks are doing today to bank customers. If the bills become law, the security system won’t be able to tell the difference between sites that have been blocked by law and those that have been sabotaged by hackers. Indeed, it isn’t hard to imagine crooks redirecting users to sites that say, “You were redirected here because the site you asked for has violated copyright,” while at the same time planting malware on the user’s computer.

There's much more in the article as well, noting that these laws won't actually help Hollywood and will "leave the rest of us hurting and poorer for years." The really tragic part of the hearing is that when all of the panelists were asked about Baker's statement, every single one of them admitted that they didn't understand the technology enough to really comment. The best that the MPAA's Michael O'Leary could blurt out was that he "didn't agree."

The second interesting piece at Politico comes from famed Constitutional scholar Laurence Tribe, who more or less acts as a counterweight to Floyd Abram's letter. He basically highlights all of the problems we've discussed over the past few weeks: vague definitions, broadly targeted, will impact perfectly legitimate sites. And, he notes clearly: "It would violate the First Amendment."

A key provision of the bill would give copyright owners the power to stop online advertisers and credit card processors from doing business with a website, merely by filing a unilateral notice that the site is “dedicated to the theft of U.S. property” — even if no court has actually found any infringement.

The immunity provisions in the bill create an overwhelming incentive for advertisers and payment processors to comply with such a request immediately upon receipt. Courts have always treated such cutoffs of revenue from speech as a suppression of that speech, and the silencing of expression in the absence of judicial review is a classic prior restraint forbidden by the First Amendment.

Just as we have said in the past. It seems that more and more lawyers are making this point. So far, the pro-SOPA side has Floyd Abrams. He's respected, sure, but so is Tribe and so are many of the other lawyers who have questions SOPA's impact on the First Amendment.

Lots of internet companies have come out against the bill as well. Reddit and Tumblr both joined with American Censorship Day, blocking out parts of their site. Tumblr went so far as to blackout their entire dashboard. Along with them Kickstarter and FourSquare both spoke out against the bills as well. These are all platforms that content creators today rely on to create, connect, promote, distribute and monetize their works. In other words, these are the platforms of the future -- the platforms that could be crippled with legal and regulatory compliance under these bills. Burdening them doesn't help content creators. It may help the big record labels and the big studios -- the ones who don't want musicians and filmmakers "going direct" via these platforms... but it doesn't help actual content creators or the public.

Web hosting platform/CDN Cloudflare has weighed in by warning of legal denial of service attacks that would be enabled under the bill:

We've been seeing a disturbing trend recently. Increasingly, we're receiving purported DMCA requests that ask us to identify website hosts that are actually from attackers abusing the legal code. If we reveal the requested information, attacks are launched directly at those hosts, bypassing CloudFlare's protections and knocking legitimate sites offline. Initially, these requests were relatively easy to spot. When we recognized the new attack method, we changed our policies and trained our customer support team to more carefully screen DMCA requests. Increasingly, however, the requests are becoming more sophisticated and difficult to detect.

Imagine the challenge for someone on CloudFlare's support team. If someone writes to us alleging that they are a photographer who took a picture that appears on a website, or a designer who drew a logo, or an author who wrote some text, how can that claim be verified? I'm an attorney and member of the bar. I teach a course on intellectual property and technology law at the John Marshall Law School. I serve on the Board of the Center for Information Technology and Privacy Law. I've reviewed many of these requests and, even with my training in the subject, I have no idea how to effectively and efficiently tell the difference between valid and invalid complaints.

In an Internet without bad guys, the consequences of revealing a host's information is relatively minimal. Unfortunately, the Internet is full of bad guys. There has been a steady rise in attacks, increasingly affecting legitimate small businesses and ecommerce sites. These attacks have been part of why more than 100,000 websites have sought shelter behind CloudFlare in just the last 12 months. We offer great technical protections to shield sites from attack, but I'm concerned some of our efforts could be undermined by new laws like SOPA.

Yes, read that again, because it's downright scary.

Mozilla, the makers of Firefox, also joined in, with the following on their website: They've also put up an entire information page about SOPA.

Perhaps most interesting of all, even Rep. Zoe Lofgren joined in with American Censorship Day by censoring her own logo on her official House website:

Filed Under: copyright, cybersecurity, dns, first amendment, laurence tribe, sopa, stewart baker
Companies: foursquare, kickstarter, reddit, tumblr

Former DHS Official: ACTA 'Sweetheart Deal For IP Owners; Free Gov't Enforcement Of Private Rights'

from the indeed dept

We recently wrote about a 2008 memo and position paper from Homeland Security to the USTR warning that ACTA was a bad idea that could harm national security, and transfer private civil issues to the government to enforce. The author of the original memo, Stewart Baker, who is no longer at DHS, has now commented on our coverage of this issue, stating that DHS did not like ACTA as it was drafted:

It seemed like a sweetheart deal for a few intellectual property owners, who’d get free government enforcement of their private rights, potentially to the detriment of security and traditional customs enforcement. Worse, the sweetheart deal would be written into international treaty, putting it beyond Congress’s reach if the risks we foresaw actually came to pass.

Baker notes that he still feels this way. Of course, he also jokes that it appears to cause us "physical pain" to admit we agree with the DHS. I recognize it's a joke (and kind of amusing, too), but just for clarity's sake, I have no problem agreeing with anyone when I think they're correct (even the RIAA). It's not about who's making the argument. It's about the argument.

Filed Under: acta, copyright, dhs, stewart baker

DHS Official: 'Real ID Has A Bad Bumper Sticker Reputation'

from the you-don't-say dept

CNet reports on a talk by Department of Homeland Security official Stewart Baker, in which he defended the Real ID Act against its many critics. Conceding that the proposal "has a bad bumper sticker reputation," he insisted that the Real ID Act will make it easier to catch identity thieves. But as my colleague Jim Harper has pointed out, the opposite is closer to the truth: by centralizing loads of private data in one database, the Real ID Act will make identity thieves' jobs a lot easier. One sign of how badly Real ID is faring can be judged from the fact that Baker is bragging about the fact that 45 states plus DC have been granted waivers to continue using their existing driver's licenses while they work toward complying with the law by next year. Why is it a victory that 45 states are going to miss the original deadline this coming May? Because the other 5 states have refused to comply at all. There are a couple of things to note about this. First, as Declan McCullagh points out, DHS has been practically begging states to request waivers, and a number of states have accepted waivers while continuing to express doubts about whether they'll ever comply. Second, there's no way the feds are actually going to impose the promised punishment -- refusing to accept state IDs in airports -- on the residents of the five states that have refused to comply with the law's requirements. Imagine the chaos if every traveler in South Carolina discovered that his or her South Carolina driver's license was no longer a valid form of identification. The feds will back down (especially since showing your ID isn't legally required at airports anyway) rather than risk being held responsible for chaos at the nation's airports.

Filed Under: homeland security, real id, stewart baker