CISPA Take 3: Feinstein & Chambliss Draft Another Cybersecurity Bill, Designed To Wipe Out Your Privacy

from the only-massive-amounts-of-government-can-keep-you-safe dept

Washington DC: where no bad idea ever truly dies. CISPA, the infamous "cybersecurity" bill that has twice failed to cross the President's desk is back again. This is the Senate's attempt at a cybersecurity bill, so it doesn't sport the same gaudy initials (those belong to the House), but it's still the same set of terrible ideas.

The Senate's previous attempts to write its own cybersecurity bill were supposedly prompted by privacy concerns, something the House version treated as wholly irrelevant to securing our nation from cyberattacks. This new bill may decide privacy is the only thing irrelevant to national security, seeing as it's been crafted by Dianne Feinstein and Saxby Chambliss, both largely supportive of the NSA's (recently exposed) activities.

The new bill sports the following title: Cybersecurity Information Sharing Act of 2014. CISPA without the "p," apparently. Out with the "protection" (which was nominal) and in with the oversharing of cyberthreat information.

The bill, like others before it, grants broad immunity to participating companies, stripping away one of the few reasons these entities might stick up for their customers (and their data) and consider plugging the security hole before turning that info over to both the military, national security agencies and, well, any number of government agencies or competitors. The text of the bill leaves that almost completely unspecified.

The new, 39-page draft bill, written by Sen. Dianne Feinstein (D-Calif.), chairman of the intelligence committee, and Sen. Saxby Chambliss (Ga.), the ranking Republican, states that no lawsuit may be brought against a company for sharing threat data with “any other entity or the federal government” to prevent, investigate or mitigate a cyberattack.

This immunity screws up incentives and encourages questionable behavior, as it to be expected when accountability is removed.

There's a small nod to privacy in the bill, but it carries with it some potential weasel words that could completely undermine the protection.

An entity sharing cyber threat indicators pursuant to this Act shall, prior to such sharing, remove any information contained within such indicators that is known to be personal information of or identifying a United States person, not directly related to a cybersecurity threat in order to ensure that such information is protected from unauthorized disclosure to any other entity or the Federal Government.

Considering what the NSA and others have deemed "relevant" to their counterterrorism efforts, lots of personal data could easily be construed as being "directly related" to a potential cybersecurity threat.

Other protections are equally as malleable. Law enforcement agencies are allowed to avail themselves of cyberthreat information, but only if given written consent from the entity(ies) involved. But that "only" isn't actually a limitation. The paragraph immediately following the "written consent" stipulation creates the same sort of loophole that agencies like the FBI have abused to the point of surreality in the past.

If the need for immediate use prevents obtaining written consent, such consent may be provided orally with subsequent documentation of the consent.

IN CASE OF EMERGENCY, BREAK PROTECTIONS.

Giving law enforcement or indeed any agency this sort of manual override undercuts anything stipulated previously. This encourages a culture of asking forgiveness, rather than permission. Grab the data and justify it post facto. That's no protection at all, especially when granted immunity gives companies absolutely no reason to push back on these oral requests.

This may only be the draft version, and there will be several changes made before it goes up for a vote, but this groundwork is far from heartening. It appears as though no one involved has learned anything from CISPA's two troubled trips through the House, not to mention the new concerns prompted by leaked NSA documents.

Further gestures in the direction of civil liberties and privacy protections are made later in the bill (under a heading "Privacy and Civil Liberties" no less), but those protections are roughly identical to existing policies governing the NSA's (and FBI's) mass collection of American metadata -- oversight and minimization, both of which have been subverted by these agencies.

The bill also consolidates more power within the DHS, creating an "all roads lead to the DHS" method of managing cyberthreat information. If there's one entity which has proven time and time again to be both a) mostly useless and b) prone to abusive behavior, it's the DHS. And yet, the bill calls for the agency to be the central cyberthreat repository.

IN GENERAL.—Not later than 90 days after the date of the enactment of this Act, the Secretary of Homeland Security, in coordination with the heads of the appropriate Federal entities, shall develop and implement a capability and process within the Department of Homeland Security that—

(A) shall accept from any entity in real time cyber threat indicators and countermeasures in an electronic format, pursuant to this section;

(B) shall, upon submittal of the certification under paragraph (2) that such capability and process fully and effectively operates as described in such paragraph, be the process by which the Federal Government receives cyberthreat indicators and countermeasures in an electronic format that are shared by an entity with the Federal Government…

Unfortunately, as terrible as the DHS is at determining threats and sharing information, there's probably no way to route around it. The post-9/11 agency is now the government's national security clearinghouse, and everything flows to it, even if it's usually the agency least likely to make productive use of the information. While cyberthreats pile up, DHS agents will be chasing down people taking pictures of public structures.

Believe it or not, this bill putting DHS as the central authority is actually one half-step better than the likely alternative, which is making NSA the central player. For many years now, there's actually been something of a turf war between DHS and NSA over who gets to control the (increasingly massive) cybersecurity budget. And a bill that designates DHS as the "winner" of that turf battle at least gives it a slight preference over the NSA -- though, unfortunately, this bill would let DHS share info with NSA freely, which is yet another problem.

CISPA may have seemed at least half-dead, but Feinstein and Chambliss are breathing life into its lumbering carcass. You would think the last several months, combined with CISPA's earlier struggles, would have resulted in a better cybersecurity bill. Instead, it actually seems worse.

“This is definitely a step back,” said Gabe Rottman, legislative counsel and policy adviser for the American Civil Liberties Union, who was shown a copy of the draft. “The problem is the definitions of what can be shared and who it can be shared with are too broad. In this draft, companies can share data with the military and the NSA. Given the past revelations, I think it’s important to keep this information in civilian hands.”

And that's just one of several problems. Combine the bill's wording with the administration's tacit approval of the NSA's exploit stockpile and you've got something that will generate millions of dollars worth of budget line items while doing very little to make anyone -- even the government itself -- any safer.

Filed Under: cisa, cispa, cybersecurity, dhs, dianne feinstein, homeland security, immunity, information sharing, nsa, privacy, saxby chambliss

DHS Fusion Center Admits Photographer Is Covered By 1st Amendment But Just Doesn't Like The Way He Treats Officers

from the rights-apparently-dependent-on-compliant-behavior dept

The uselessness of the Department of Homeland Security's Fusion Centers has been detailed here before, but they've never been quite as useless as this. Here's the backstory, from Carlos Miller at Photography Is Not A Crime.

All Jeff Gray has been trying to do is ensure law enforcement officers honor the oath they swore to the Constitution upon receiving their badge, which is why he routinely video records them in public for his Youtube channel, HONORYOUROATH.

But that has led him to become the subject of an active investigation by the Florida Fusion Center, a collusion of local, state and federal law enforcement agencies encouraging citizens to rat on each other for taking too many pictures or asking too many questions.

When not recording interactions with cops, Gray also photographs publicly-visible structures like government buildings and prisons -- the sort of photography that has been equated with terrorism by the DHS.

Gray sent FOIA requests to several law enforcement agencies for anything they may have collected on his photography and recording efforts. Some requests didn't produce any documents, but others he obtained show that law enforcement agencies clearly don't know how to solve a problem like Jeff.

The most ridiculous document Jeff Gray obtained was from a DHS Fusion Center. Here's the Center's rationale for treating Gray with suspicion: He's clearly covered by the First Amendment. We just don't like his attitude.

Seriously.

On 06-23-2013, units with CCSO were dispatched to CCA, a private prison located within Columbia County, after being contacted by prison staff in reference to a suspicious person. The Subject was recording and or taking pictures of the front as he was standing on a public access across the street from the prison. Once confronted by prison staff the subject only stated that he was an independent journalist and was doing a story on the prison system. The subject refused to stop videoing after being asked to do so by prison staff. During the confrontation the subject referred to his first amendment right to be there and continued to question and press the staff to give him a reason why he could not record the outside of the facility. Once law enforcement arrived, the subject was asked for identification, the subject asked if he was being detained and once told that he was not he refused to provide ID to law enforcement. Ultimately the situation was diffused and the subject left. The subject later posted the videos of his encounters with the prison staff and CCSO Deputies on YouTube and on another website called photography is not a crime.com. This subject is exercising his first amendment rights, however the manner in which he lures the officers in is concerning.

To paraphrase Homer Simpson: it takes two to lure, one to lure and one to overreact to the utter lack of criminal activity. But the Fusion Center obviously believes that, First Amendment or no, Gray should be checked out because he's making police officers, prison staff and government agents looks bad with his "manner."

On the bright side (I guess…), the Fusion Center's "investigation" apparently involved little more than rigorously browsing the internet.

The following information has been learned from viewing the mentioned website and the subject's YouTube account.

The findings? Gray urges people to "flex their rights," and publicly calls out (via YouTube postings) officers who fail to respect his rights. Troubling stuff, but not for the reason the DHS thinks.

Beyond the DHS's belief that Gray's attitude should somehow nullify his rights, other troubling info was uncovered as well.

Gray also obtained a series of field intelligence reports from the St. Johns Sheriff’s Office regarding his video activity. One of the reports includes an incident when he was visited by the Florida Department of Children and Families after they claimed they received an anonymous tip that he had guns in his home, which is not a crime and not even a secret considering Gray is very open about his gun ownership.

But that didn’t stop DCF from interviewing his children at school without his knowledge before paying him a visit at home, which he video recorded and posted on Youtube, as well as his follow-up phone conversation with the investigator that his children were not in any imminent danger, so there was no need to further investigate him.

I guess the lesson here is that "luring" cops and security guards through the open exercise of your rights is all the reason needed for law enforcement and government agencies to open investigations. The implication that there's something more wrong with Gray's "luring" than there is with law enforcement's response is ridiculous. Law enforcement officers certainly don't need to "flex" their misguided muscle when confronted with a citizen "flexing" their rights. One is wholly optional while the other is actually protected activity.

This lousy spin attempt from the Fusion Center does nothing to improve the reputation of this national travesty. Maybe next time, officers could just walk away and not become YouTube fodder. But they can't seem to help themselves, and the DHS seems to believe it's all Gray's fault.

Filed Under: 1st amendment, dhs, fusion center, jeff gray, photographers

Former DHS Watchdog, A Tyrant, Failure And Alleged Felon, 'Punished' With Transfer To Another Government Agency

from the ah,-the-famous-'lateral-demotion' dept

Good news, Americans! The former "top watchdog" for the Department of Homeland Security, Charles K. Edwards, was an incredibly perverse blend of crooked and spineless and yet we still managed to avoid being terrorized to death during his run as Inspector General (2011-2013). That's the resilience of the American public. Even while the agency was being bumblefucked into (even greater) uselessness, those who hate us for our way of life (which now includes drone strikes, neverending military 'interventions' and the constant watching of damn near everybody) were unable to find a way to maneuver around the "security" "provided" by the DHS.

How can you tell when an investigative report is especially damning? When you can't even make it through the table of contents without gasping out loud a few times. Get a load of this:

III. LACK OF INDEPENDENCE
A. Lack of Familiarity with OIG Work
B. Frequent Communications and Personal Relationships with Senior DHS Officials
C. Lack of Independent Legal Advice
D. Improper Alteration or Delay of Reports
1. “Secure Communities” Audit Report
2. “Advance Imaging Technology” Audit Report
3. “Acquisition Management” Audit Report
4. “Secret Service” Investigation and Inspection
5. “Ports of Entry” Audit Report
E. Tainted Audit Reports
F. Apparent Desire for a Permanent IG Position

IV. ABUSE OF AGENCY RESOURCES
A. Assistance with Pursuit of a Ph.D
B. Assistance with Employment at Capitol College
C. Assistance with Pursuit of a Permanent IG Position
D. Travel to Florida
E. Misuse of a Government Vehicle
F. Benefits for Ms. Edwards
1. Nepotism in Hiring
2. Telework from India
3. International Phone Calls
4. Staff Assistance for Ms. Edwards

V. OTHER ALLEGATIONS
A. Notice of Administrative Leave
B. Destruction of E-mails
C. Deletion or Closing of Hotline Complaints
D. Destruction of Phone Records
E. Retaliation
1. Administrative Leave
2. Poor Performance Review
F. Office Environment

Where do you even start? It's all terrible. Edwards apparently wined and dined with DHS leaders, giving them heads up on the findings of investigations. So, there's that, which undermines the oversight. From there, Edwards went to various administration higher-ups and allowed them to control the timing and wording of investigative reports, further subverting the oversight process he was tasked with.

Beyond the major subversion, there's tons of minor issues. Nepotism, misuse of department resources, Edwards using the department to pursue a doctorate and a permanent position as an IG… about the only thing not noted in here is supply closet raids.

Furthermore, it appears Edwards wasn't even qualified to do the job he absolutely failed to do over a three-year period.

Unlike most IGs, Mr. Edwards does not have experience conducting audits, investigations, or inspections, the three main types of work conducted in an Office of Inspector General.

For example, when interviewed by Subcommittee staff, Edwards was unable to articulate guidelines that govern briefing details of an ongoing investigation to DHS. Edwards stated, “I don’t know that offhand here. You will have to talk to the office – to the Assistant IG for Investigations.”

Not only was he a lousy employee, he was a terrible boss. When not setting up his wife with travel, phones, laptops and a position within the department, he mistreated the rest of his staff -- the same staffers he tasked with working on his Ph.D dissertation and documents related to his pursuit of both a position with Capitol College and a permanent IG nomination.

During the Subcommittee’s investigation, current and former OIG employees repeatedly reported that Mr. Edwards had created a hostile work environment. One official characterized the office as a “toxic, totally dysfunctional and oppressive” work environment characterized by low morale, paranoia, and fear. Another official described the atmosphere of the OIG as one of “[c]omplete terror,” such that “there were times that [they] couldn’t even get up out of bed, [they were] so emotionally scared, drained.”

Many employees told the Subcommittee they wanted a change in leadership. According to one official, the OIG staff “want to have a legitimate Inspector General in place to get us back on track.” Another called the office “the worst agency” and said that it has been “run into the ground” under Mr. Edwards’ leadership. Reasons include Mr. Edwards’ reluctance to “seek out advice or guidance from anybody with experience” and that the “people … he surrounds himself with … do not have the background or the experience to be useful to him.”

When faced with low morale, Edwards apparently did what other wholly ineffective leaders do when faced with friction: he retaliated. Staffers claim Edwards routinely placed dissenters on administrative leave or used periodic employee reviews to "get back" at them for their failure to kowtow.

Allegations (some unsubstantiated) that Edwards broke federal law by destroying emails and documents are also included in the report. There are also allegations that Edwards spied on interoffice communications. A former senior OIG official noted that "nearly all" the communications he received about Edwards' actions originated from personal email accounts or phones.

So, what's to become of Edwards, who completely undercut any sort of independent oversight of the nation's foremost security agency, along with possibly breaking a handful of federal laws? A whole lot of nothing.

Edwards, a 20-year federal career employee with expertise in computer engineering, resigned his office in December, three days before he was scheduled to appear at a Senate hearing to answer questions. DHS granted his request to be transferred into its office of science and technology, and the hearing was canceled.

Wonderful. Way to send a message, Chief. That will let the government's Inspector Generals know they'd better be right on that oversight thing OR ELSE [they'll be transferred to another government agency, no questions asked].

The DHS is a joke with no punchline. I'd say DHS head Jeh Johnson has his hands full whipping this disgrace back into some semblance of a respectable government body, but let's face it, it has never been credible during its decade-plus existence. Johnson's not going to turn this around. The department's focus is almost entirely on maintaining a credible terrorist threat in order to justify its $39 billion budget and 225,000 employees. That leaves precious little time or resources to clean house.

People like Edwards who can fill the position while minimizing embarrassing investigative reports are welcomed at the DHS. No one wants to be the guy (or girl) who truly outs the agency as a bloated wreck that does little to nothing in the way of keeping the Homeland secure. Pursuing truly independent oversight just means working your way out of a job.

Filed Under: charles edwards, dhs, homeland security, inspector general, management

Homeland Security Adviser Warns Parents That Their Mouthy Kids May Grow Up To Be Terrorists

from the just-when-you-thought-the-'terrorist-twos'-were-horrible-enough dept

Our nation's singular focus on terrorism has led to various branches of the government and counterterrorism pundits declaring all sorts of things to be warning signs of terrorist activity. Here's a short (but by no means all-inclusive) list of activities that are supposedly indicators of terrorism-in-progress.

• Staying in a hotel and doing any number of "odd" things. Like not using the hotel's wifi, making requests in person at the front desk, not bringing enough baggage, using entrances/exits other than the one in the lobby area or turning down room service.
• Complaining about the TSA.
• Complaining about the water quality.
• Complaining.
• Contributing to Wikileaks (or even frequenting the site).
• Deploying glitter during a protest.
• Being a journalist. (UK edition)
• Encrypting your data.
• Expressing dissatisfaction with government policies.
• Having "money problems."
• Operating a food truck.

Now, here's a new one to add to the list. If Lisa Monaco (White House Homeland Security and Counterterrorism Advisor) is to be believed, nearly every parent, especially those with stereotypical teens in the household, is harboring potential terrorists.

“Parents might see sudden personality changes in their children at home—becoming confrontational. Religious leaders might notice unexpected clashes over ideological differences. Teachers might hear a student expressing an interest in traveling to a conflict zone overseas. Or friends might notice a new interest in watching or sharing violent material.”

That's right, parents. If your child seems moody, unreceptive to your religious leanings, enjoys watching violent "material" or wants to travel nearly anywhere in the world (not a whole lot left outside of the First World that can't be described as war-torn), he or she is your family's very own "insider threat."

Monaco understands this might be troubling for parents to hear, but it's all for the best. Remember, parents: only you can prevent terrorism.

“The government is rarely in position to observe these early signals, so we need to do more to help communities understand the warning signs, and then work together to intervene before an incident can occur.”

The nation's counterterrorism forces are profoundly sympathetic for these terrorist-raisers. They truly wish they could be in the position to catch these early warning signs, but our short-sighted predecessors have prevented them from observing first-hand, thanks to obstacles like the Third and Fourth Amendments.

Not to worry. As Monaco points out, the nation has mobilized parents' neighbors against them, providing them with any number of see-something-say-something venues with which to turn in your confrontational, agnostic, R-rated movie-watching hellspawn -- just in case you don't love America enough to do it yourself.

Oh, and P.S.: the DHS reiterates its commitment to flooding small towns with military vehicles and weaponry.

Monaco said that in addition to citizen alertness, the Department of Homeland Security is increasing its partnerships across the country and making hundreds of millions of dollars in grant money available annually to local law enforcement to help improve anti-terrorism security at the municipal and county level.

A terrorist in every household and a military assault vehicle in every unincorporated township. USA! USA! USA!

Filed Under: dhs, homeland security, lisa monaco, teenagers, terrorists

ICE Rejects My Request To Waive FOIA Fees 'Because .' Yes, 'Because .'

from the why?-because. dept

A few weeks ago, I wrote about the troubling reports that Homeland Security's ICE division had teamed up with domain registrar/hosting company GoDaddy to help censor a Mexican political protest site. GoDaddy had suspended the domain, and when the site's administrators asked why, they were sent information saying that it was from a "Special Agent Homeland Security Investigations." Homeland Security Investigations is part of the new branding for ICE, but it's still the same old ICE. The contact email they were told to reach out to was an @ice.dhs.gov email address.

Given all of this, I filed a Freedom of Information Act request via MuckRock, a service I've used many times in the past to file FOIA requests, without issue. A standard part of doing so, is to ask for a fee waiver. Under FOIA, government agencies can charge for the requested work, but they're supposed to waive the fees if the request is for the public interest or reporting. Basically, the only times they're not supposed to waive the fees is when it's for some sort of (non-reporting) commercial purpose (e.g., a company looking to sell a database that it collects via FOIA requests).

So I was a bit surprised to get back a notice saying that ICE had rejected my fee waiver request. There are very limited reasons for why a government agency can reject such a request, and my request should absolutely have received the waiver. So, I read the waiver rejection letter to find out why, and was... well... a bit surprised to see this: Specifically, after listing out the six factors, none of which should exclude me from getting the waiver, it says:

Based on my review of your March 4, 2014 letter and for the reasons stated herein, I have determined that your fee waiver request is deficient because .

"Because ." Well, that is kind of useless, no? Either way, the rejection is totally bogus, but to claim that the reason is... " ." is sort of the icing on the cake. They also claim that my "fee waiver request has failed to satisfy each of the required factors."

Except that's not true. I actually satisfy all of the factors. Let's take a look.

Whether the subject of the requested records concerns "the operations or activities of the government."

Why, yes it does. I'm trying to find out why the US government requested GoDaddy censor a political protest site.

Whether the disclosure is "likely to contribute" to an understanding of government operations or activities.

Again, yes, of course it will, because I'll be reporting on the results, contributing to the understanding of why ICE felt the need to try to censor political speech in Mexico.

Whether disclosure of the requested information will contribute to the understanding of the public at large, as opposed to the individual understand of the requestor or a narrow segment of interested persons

Again, since the request is for reporting purposes, and I'll be reporting on the results, this should once again be in favor of the waiver.

Whether the contribution to public understanding of government operations or activities will be "significant."

I would think it would be. After all, we're talking about a government agency censoring a foreign website for no clear reason. That seems rather significant.

Whether the requestor has a commercial interest that would be furthered by the requested disclosure

Nope. And, honestly, this is the main one that they normally use to reject fee waivers. It clearly does not apply here.

Whether the magnitude of any identified commercial interest to the requestor is sufficiently large in comparison with the public interest in disclosure, that disclosure is primarily in the commercial interest of the requestor.

Again, I have no commercial interest here, but a journalistic one. And, for those who claim that there's a "commercial interest" as a news site, that is specifically exempted from the FOIA definitions of commercial interest. The DHS's own rules note that, when it comes to journalists: "a request for records supporting the news-dissemination function of the requestor shall not be considered to be used for commercial use." And, again, I've done a bunch of FOIA requests and never had a single fee waiver rejected before.

In other words, none of the conditions set forth as reasons why ICE can reject my fee waiver request have been met, and yet ICE still rejected the request -- and rather than explain why (perhaps because they can't), they said "because ." Yay, government.

I'll be appealing this decision shortly, but it hardly inspires much confidence in the FOIA department at ICE to actually be of any help at all in this matter.

Filed Under: dhs, fee waiver, foia, homeland security investigations, ice, rejections

Boston Bombing Suspect Avoided CIA, FBI Because His Last Name Was Misspelled In DHS Database

from the intelligence-screwups-also-include-typos dept

Everyone makes mistakes. There's hardly anyone out there who can claim a misspelling-free existence. And government employees -- even highly-trained analysts and agents charged with protecting national security -- are no different. Mistakes will be made. Let he who is without sin be the pedantic ass casting stones in the comments below, etc.

The problem is that when mistakes are made on highly-sensitive forms, the damage is almost irreparable. As we've covered extensively, an agent's failure to fill out paperwork properly put a non-terrorist on the government's "no fly" list for over a decade. To add insult to cock-up, the government spent most of that time trying to bury the challenge with layers and layers of "national security" obfuscation. Confirming or denying anything about terrorist watchlists would somehow lead to terrorists gaming the system.

Speaking of terrorist attacks, the Tsarnaev brothers somehow managed to elude those specifically tasked with preventing events like the Boston Marathon bombing. The same lack of inter-agency communication that allowed some 9/11 terrorists to return to the US unnoticed was at play in the recent attack. Unbelievably, these agencies have used both attacks as justification for leaving their surveillance powers intact, arguing that curtailing these programs will somehow prevent them from stopping the next 9/11 or Boston bombing -- despite having been unable to prevent either of those.

But these "terrorist watchlists" the government likes to keep are sacrosanct, even if they're populated by people who shouldn't be on there and missing people who should be, thanks to human error.

On January 21, 2012 Tsarnaev traveled to JFK airport in New York to board an Aeroflot flight to Moscow.

Though an alert was triggered, Tsarnaev was not pulled out for a secondary search or interview. According to sources familiar with the report, there were almost 100 other names on the “Hot List” of individuals traveling through Customs at JFK that day, and Tsarnaev was not considered high priority.

Tsarnaev flew to Moscow, and then to Dagestan, where he stayed for six months and received jihad training, according to U.S. authorities.

On July 17, 2012, Tsarnaev flew back to the United States, landing at JFK. TECS notes remain in effect for one year. The initial TECS note had expired. The second, more urgent TECS note filed in October 2011 that said he might be armed and dangerous had not.

But no alert was triggered when Tsarnaev passed through Customs at JFK, because of the misspelling of his name on the second TECS note. The difference of one letter – Tsarnayev instead of Tsarnaev – meant that he was not detained or questioned despite the warning in his file, according to sources familiar with the report.

It's the sort of error anyone can make. But it had serious repercussions. In Tsarnaev's case, this error helped contribute to an attack on American citizens.

The government aggressively battles anyone who questions their placement on terrorist watchlists, ignoring the fact that it still employs human beings and that those people -- being human -- will occasionally make mistakes. No one's asserting any sort of maliciousness on the government's behalf in Ibrahim's case, but no one should to be willing to completely excuse its behavior in Tsarnaev's, either.

Errors will be made, but it's of utmost importance to correct them. The government needs to stop pretending its watchlists are infallible. It's not as though this is a recent development and possibly the first time these agencies have been made aware of the lists' shortcomings. Back in 2009, the Office of the Inspector General had this to say about the FBI's list.

We found that the FBI failed to nominate many subjects in the terrorism investigations that we sampled, did not nominate many others in a timely fashion, and did not update or remove watchlist records as required.... We believe that the FBI's failure to consistently nominate subjects of international and domestic terrorism investigations to the terrorist watchlist could pose a risk to national security.

The FBI failed in both directions, failing to add suspected terrorists to the list fast enough and being pretty much unresponsive when it came to removing those not deemed a threat. Add this to the fact that clerical errors will always be present in a certain percentage of records and you have a list whose veracity is highly questionable. But the government doesn't see it that way, and that's the problem.

Filed Under: boston bombing, dhs, misspelling, mistakes, tarmerlan tsarnaev, tecs, terrorist database, typos

The DHS May Have (Publicly) Dumped Its License Plate Database Plans But It Still Has Access To Millions Of Records

from the horrible-'setback'-puts-the-DHS-right-back-in-its-original-position dept

As we recently covered, the DHS and ICE asked for bids for a nationwide license plate database before killing off the plan a few days later, apparently realizing more massive government surveillance wasn't exactly what Americans were looking for at this point in time.

But all is not what it seems. As Kade Crockford at PrivacySOS points out, contrary to what's been reported by a majority of the coverage on this issue, the government doesn't need to build a nationwide license plate database because it already has access to one.

[C]ontrary to widespread understanding, DHS’ solicitation for bids had nothing to do with asking a contractor to build a nationwide license plate tracking database. Such a database already exists. The solicitation was more than likely merely a procedural necessity towards the goal of obtaining large numbers of agency subscriptions to said database, so that ICE agents across the country could dip into it at will, as many have been doing for years already. There was never a plan to "build" a plate database. A database almost exactly like the one DHS describes is a current fact. It is operated by a private corporation called Vigilant Solutions, contains nearly two billion records of our movements, and grows by nearly 100 million records per month.

So, instead of being a "win" for privacy-minded Americans, it's not even a tie. The government already has access to collected plate records. It was just looking to expand its existing access. Plate readers, some operated by federal government agencies like the CBP, are adding millions of records a day, and these records are loosely governed by a patchwork of state and local statutes, most of which allow for the retention of "non-hit" data for periods as long as five years.

As I pointed out in my post detailing the cancellation of the bid solicitation, nothing much changes for ICE. It, like many, many, many, OH MY GOD THERE'S SO MANY other law enforcement agencies (click on that pulldown menu and get ready for a whole lot of scrolling), already has warrantless access to a variety of license plate databases. And, as I noted when the news of the bid solicitation first hit, Vigilant seemed to be vying for the top spot, having recently sent out a press release touting its ALPRs' effectiveness in fighting crime, as well as filing a lawsuit against the state of Utah for violating its First Amendment rights by preventing it from setting up shop.

Crockford goes further in his earlier post on the subject, suggesting a national contract with Vigilant is as good as signed.

The department doesn’t intend to build its own license plate reader database, and it isn’t asking corporations to build one. Instead, it is seeking bids from private companies that already maintain national license plate reader databases. And because it’s the only company in the country that offers precisely the kind of services that DHS wants, there’s about a 99.9 percent chance that this contract will be awarded to Vigilant Solutions. (Mark my words.)

According to documents obtained by the ACLU, ICE agents and other branches of DHS have already been tapping into Vigilant’s data sets for years. So why did the agency decide to go public with this solicitation now? Your guess is as good as mine, but it may simply be a formality so that the agency can pretend as if there was actually robust competition in the bidding process.

So, apparently all that's really been achieved is the removal of the bidding process from the public eye. Vigilant may already be in the process of hooking ICE up to the ALPR database mainline and everyone involved is now just waiting for the furor over massive domestic surveillance to die down. The privacy concerns are even less likely to be addressed now that the process has been pushed out of the sunlight. As a private company, Vigilant has the luxury of ignoring constitutional issues, leaving that up to its customers to sort out. All it wants to do is be the top company in the ALPR business. Everything else is someone else's problem.

The bottom line is: nothing was avoided or prevented here. It was a momentary setback for ICE itself, but the government (including entities on state and local levels) already has millions of license plate records to sift through, with millions more being generated every single day.

Filed Under: database, dhs, homeland security, ice, license plates, privacy

So Far, The FBI Is Benefiting The Most From The NSA Leaks

from the thanks-for-taking-one-for-the-team,-NSAbros! dept

The outrage over massive, pervasive surveillance has put the NSA in the spotlight, somewhere its officials are obviously uncomfortable being. The administration's minimal efforts to address domestic surveillance have also focused on the agency. But there's an agency doing just as much privacy-invading as the NSA and its efforts are now going largely unnoticed, as Emily Berman points out at Just Security.

Commissions, oversight boards, and review groups are all the rage these days. Recent weeks have seen hundreds of pages of reports evaluating American intelligence agencies, and there’s a promise of more to come. These reports have recommended dozens of modifications affecting all three branches of government. But there’s an integral part of the surveillance state that has thus far largely escaped the current scrutiny: the FBI. And while failure to “connect the dots” is an oft-cited flaw within the intelligence community, not insisting on examining more closely the FBI’s surveillance activities represents a similar flaw by those outside the intelligence community.

The FBI is now basking in the darkness the NSA used to occupy. The first leak had the FBI's name all over it, and it's the power granted to the FBI that allows the NSA to collect millions of domestic phone records. The NSA technically isn't allowed to vacuum up domestic records. The FBI, however, is. But the NSA "takes home" the bulk collection and "tips" a few hundred phone numbers to the agency whose name is listed on the first page.

As the NSA feels the heat and legislation makes the rounds (both at national and state levels) targeting the agency, the FBI continues to hum along nearly unnoticed.

The vast majority of the FBI’s intelligence collection, by contrast, arguably enjoys even less oversight while focusing largely on Americans, often Americans who aren’t even suspected of criminal activity or of posing a threat to the national security. Rather than statutes and judicial review, constraints on FBI intelligence collection are often limited to those provided by internal guidelines—sometimes secret ones—issued by the Attorney General and the FBI itself. Even FBI tools that are subject to some statutory restrictions—such as National Security Letters (NSLs), which allow the FBI to obtain telephone toll records, e-mail subscriber information, employment history, and financial records—operate free from judicial oversight.

That the FBI still operates under secret mandates should be worrying. Unlike the NSA, which is ostensibly tasked with surveilling foreign threats and national security, the FBI is primarily an investigative law enforcement agency (although it seems to be more focused on fighting terrorism these days), given free reign to surveil US citizens. This has resulted in the widespread, suspicionless surveillance of certain ethnic groups, sometimes in conjunction with local law enforcement.

The FBI may not be sweeping up quite as much data as the NSA but it is every bit as untargeted, intrusive and inefficient as the NSA itself. The supposed terrorists it targets (and I'm using the word very loosely here) with "demographic programs" and other efforts geared towards thwarting Islamic extremists are pretty much turning up nothing but dead ends. The agency's counter-terrorism efforts are better known for catching "terrorists" tangled in "plots" of FBI agents' own devising. The FBI creates the crimes and busts the "criminals." It's all too tidy and it ignores those who are actually targeting the US, as Berman notes.

Indeed, according to a 2011 Council on Foreign Relations report, FBI statistics indicate that “roughly two-thirds of terrorism in the United States was conducted by non-Islamic American extremists from 1980-2001; and from 2002-2005, [that percentage] went up to 95 percent.” More recently, the Department of Homeland Security reported that of the 12 successful terrorist attacks in the United States between 2008 and 2009, only three were linked to Islamic extremism.

What seemed to be just a diversionary talking point now appears to be the sad reality. The FBI, like the NSA, truly wants to "prevent the next 9/11," going so far as to ignore its own statistics in order to surveil Muslims 24/7. (The NYPD is at least as worrisome in its myopia -- something no doubt made worse by its frequent dalliances with the FBI.)

But the larger point is still this: an agency granted the power of domestic surveillance is operating without oversight. The NSA's collections are mostly of the "incidental" variety (when you "collect it all," you get it all), but the FBI's data harvesting is no less expansive. Privacy protections are equally weak, with the FBI's possibly even weaker than the porous guidelines applied by the NSA.

The FBI's tools are also more pliant than even the infamous "rubber stamp" FISA court. The agency routinely abuses NSLs and has the power to open investigations (called "assessments") without even showing reasonable suspicion. Berman's excellent article affirms the assertions made by the ACLU last September, when it reminded the American public there was more than one three-letter agency hoovering up its data. The FBI needs to be watched closely. Unfortunately, overseeing the NSA alone seems to be beyond the reach of the oversight committees. Adding another agency to the oversight mix seems to be out of the question at this point. No legislator has suggested the FBI be subjected to the same scrutiny, but its turn in the national spotlight is long overdue.

Filed Under: dhs, edward snowden, fbi, nsa

Homeland Security Detained US Citizen Inside The US, Used Intercepted Emails To Quiz Her About Her Sex Life

from the free-country? dept

Just recently, we wrote about how the Department of Homeland Security's (DHS) Customs and Border Patrol (CBP) has been increasingly detaining and harassing people at the border (or near the border) under highly questionable circumstances -- and then refusing to comment on any of it. Instead, CBP has relied on a cloak of secrecy to live outside the law, acting out what we've come to expect from authoritarian police states. Recently, the ACLU filed a lawsuit on behalf of a woman, Christine Von Der Haar, who is a senior lecturer at Indiana University, after CBP detained her at the airport.

She was not entering or leaving the country. She was not even boarding a flight. She merely accompanied a friend to the airport so that he could retrieve some computer equipment that he had shipped separately a few days earlier. After detaining Von Der Haar, CBP officials, who clearly had access to some of the emails Von Der Haar and her friend had sent back and forth, quizzed her about her sex life and if she was planning to marry the friend.

CBP appeared to be concerned that the friend, a Greek national named Dimitris Papatheodoropoulos, was trying to stay in the country illegally. Von Der Haar had first met Papatheodoropoulos 40 years earlier while studying abroad, and the two had recently reconnected thanks to the internet. Papatheodoropoulos had obtained a B1/B2 business/leisure visa to the US which actually let him enter and leave the country for a period of 10 years. He came to the US for business, but while there also wished to visit Von Der Haar since they'd been catching up online.

After detaining and questioning Papatheodoropoulos for some time, CBP officials took Von Der Haar into another room and started asking questions specific to the emails between the two of them. According to the lawsuit:

Given that Mr. Papatheodoropoulos had retained his hard drive that contained the emails, the only way that the Customs and Border Protection Agents could have reviewed the emails is for someone to have surreptitiously monitored the communications between Dr. Von Der Haar and Mr. Papatheodoropoulos and reported those communications to the agents questioning her. Defendant Lieba admitted that employees of the United States had read email communications between Dr. Von Der Haar and Mr. Papatheodoropoulos.

This raises all sorts of serious questions. As the post at Papers Please (linked above) notes:

CBP officers grossly exceeded their jurisdiction. Dr. Dr. Von Der Haar’s US citizenship was never questioned; she wasn’t trying to enter, leave, or ship and goods in or out of the country; and she was never accused of any crime. In general, immigration (as distinct from customs) offenses are handled by Immigration and Customs Enforcement (ICE) and the Border Patrol, not CBP. We’re curious what basis CBP will claim for its officers’ authority to detain and interrogate Dr. Dr. Von Der Haar or obtain her email.

The post also wonders how or why CBP got access to those emails, wondering if they were shared by the NSA. There are, of course, other possible explanations as various investigations may have resulted in CBP getting access to the emails separately, but it still raises serious questions about under what authority those emails were obtained and why she was then quizzed about her sex life.

The claims that officials made about Papatheodoropoulos were equally questionable. Again, from the lawsuit:

Customs and Border Protection agents seized Mr. Papatheodoropoulos’ passport.

On June 8, 2012, Mr. Papatheodoropoulos was served with notice that a proceeding was initiated against him for removal from the United States. The notice stated, in relevant part:

You obtained your B1/B2 visa by misrepresenting your intentions to come to the United States to wit; It is your intention to immigrate to the United States, you abandoned your foreign residence, you intend to overstay your admission to the United States.

None of this was true.

Mr. Papatheodoropoulos consulted with lawyers and the Greek Consulate in Chicago and the removal action did not proceed.

His passport was returned to him and he left the United States at the end of August of 2012 and has not returned

The whole thing seems ridiculous yet again, and you can expect DHS to use its standard cloak of secrecy. I'm sure they'll argue some sort of state secrets or national security claim to try to get the entire case thrown out.

Filed Under: cbp, christine von der haar, dhs, nsa

Homeland Security Relies On Secrecy To Violate People's Rights And Humiliate Them At The Border

from the disappointing dept

Back in September, we wrote about the horrific and depressing story from On the Media about how one of its producers, Sarah Abdurrahman (a US citizen) along with her family and friends (all US citizens) were detained at the Canadian US border. The story involved all of them being detained under horrible conditions, with no one explaining anything to them. Their electronic devices were taken and searched. Some of them were physically searched multiple times. Perhaps the most horrific was that one guy was detained for longer while his family was told they could leave. When the guy's wife asked where her husband was, she was told that "an agency" was coming to "pick him up," implying that it was some sort of federal agency. It turned out that the guy had an unpaid ticket from seven years ago for a crooked license plate, and the Michigan State Police were called.

This past week, OTM spent its entire show looking at Homeland Security's secrecy at the border, kicking it off with replaying the original story by Abdurrahman. When I realized they were doing a full hour on the issue, I immediately figured that it would finally include some sort of explanation or some sort of response from DHS. But here's the depressing thing: months have gone by and DHS seems to simply be reveling in the fact that what it does at the border can be a black box, and it doesn't think it needs to answer to anyone. All of the attempts to find out about DHS's policies and how and why it treats people (especially American citizens) this way have resulted in dead ends. Even the few attempts by Congress to find out what's happening have gone nowhere.

The episode is actually quite depressing, because it appears that DHS has learned that as long as it keeps its collective mouths shut and with what appears to be no oversight, no one can find out about its policies or activities, and that allows it to act with impunity, to attack and humiliate people, to violate their rights, to leave people with lasting mental scars, often requiring therapy, and to never have to answer for any of it. As Trevor Timm, at the Freedom of the Press Foundation, notes, the number of stories of DHS using this process to intimidate American journalists is positively scary -- but at least journalists have an outlet for speaking out about it. An unknown number of others face equal or possibly worth treatment and there's absolutely no recourse at all.

Yes, some will say, that there are people out there who seek to attack the US. And, as such, Homeland Security's Customs and Border Patrol (CBP) officers have a big responsibility. But abusing that authority to create such a horrific results at the border clearly does more harm than good. On The Media is still asking people to use their "Shed Light on DHS tool" to demand Congress do something about this, and we highly encourage you to make use of it. It makes it easy to call your representative and raise these issues with them. If enough people call, perhaps Congress will finally stop abdicating its responsibility and start looking into DHS' abusive practices at the border. To make it even easier, we'll embed the tool below. Go test it out.

Filed Under: border patrol, cbp, customs, dhs, search