City Of Tacoma To Pay $50,000 To Privacy Activist For Over-Redacting FBI's Stingray Non-Disclosure Agreement

from the fines-set-to-'MAX' dept

In the fall of 2015, privacy activist Phil Mocek and the Center for Open Policing sued the city of Tacoma for its response to a request for Stingray documents. The documents Mocek obtained were heavily-redacted, despite there being several mostly-unredacted versions of the FBI's Stingray non-disclosure agreement already in public circulation.

(This would be the standard NDA the FBI appends to every Stingray purchase by local law enforcement agencies -- one that says all public records requests should be forwarded to the feds and encourages locals to toss cases rather than expose Stingray use. It's also the same contract the FBI was shocked to hear agencies were complying with after signing on the dotted line to take ownership of their new cell tower spoofers.)

The lawsuit was filed under the state's open records law, with Mocek challenging the Tacoma PD's use of the "investigative records" exemption to withhold significant amounts of a mostly bog-standard nondisclosure agreement. As was noted back then, the continued withholding of this information could become costly (for taxpayers): the state's public records law allows for fines of $500/day for violations.

The court has spoken and the Tacoma PD's excessive secrecy is indeed going to cost residents a chunk of change.

The city of Tacoma will pay a $50,000 fine as well as legal fees for violating the Public Records Act by withholding most of a nondisclosure agreement it signed to obtain cellphone surveillance equipment commonly known as a Stingray.

[...]

In an order signed Friday, Pierce County Superior Court Judge Frank Cuthbertson said the city’s redactions violated state law.

He ordered Tacoma to pay $100 a day for every day the city “wrongfully withheld the unredacted NDA from June 21, 2014, until November 3, 2015, when the city provided this record to plaintiffs,” a penalty period of 500 days. The penalty is the maximum allowable under state law.

The judge determined the exemption cited was improper and withholding large amounts of contractual language served no conceivable law enforcement purpose. The city blamed the FBI for its lavish deployment of black toner. Presumably, the FBI will push back, stating it expects no one to uphold the terms of an agreement it forces them to sign before they can acquire the devices.

This unjustified secrecy is going to hurt the city (and its taxpaying residents) a few more times. The Tacoma New Times points out there are several pending lawsuits dealing with the same Stingray documents, including one filed by the ACLU. The city says it won't seek reimbursement from the federal government for fines and fees, but maybe it should, especially if it's going to blame the FBI for the Tacoma PD's secrecy. This actually sounds like a "good faith" attempt to respect the terms of its agreement with the FBI. The FBI got the secrecy it wanted -- at least temporarily. The least it can do is offer to cover the damages of the NDA it says everyone must sign, but apparently doesn't expect anyone to follow.

Filed Under: fbi, imsi catcher, non-disclosure, phil mocek, privacy, stingray, tacoma

DOJ Argues For iPhone Hack Secrecy By Contradicting Statements Made By The DOJ

from the one-body,-multiple-mouths,-ears-unconfirmed dept

The DOJ is still fighting a lawsuit over the iPhone exploit the FBI purchased to access the (worthless) contents of a phone used by a participant in the San Bernardino shooting. FBI director James Comey and the DOJ made comments at the time stating a couple of things:

1. The phone crack was expensive.

Specifically, Comey said that buying the exploit from this group cost the FBI "more than I will make in the remainder of this job, which is seven years and four months, for sure." Comey makes $185,100 per year at his job, implying that buying the exploit cost at least $1.3 million or so.

2. The phone crack only applied to a small subset of iPhones.

A DOJ spokesperson says... the crack only applied to iPhone 5C devices.

These statements are being wielded against the DOJ by the new agencies bringing this FOIA lawsuit. The DOJ isn't happy seeing the FBI director's words (along with its own) being used to undermine its arguments: namely, that almost nothing about the iPhone exploit can be revealed without ripping holes in the national security fabric or nullifying the FBI's intelligence-gathering techniques.

In its latest filing [PDF] in the lawsuit, the DOJ seemingly contradicts itself while arguing against revealing the contractor's name or even the amount paid for the iPhone crack. (h/t Brad Heath)

Plaintiffs remaining objection is unavailing. They claim that the iPhone tool itself is of no current value. See Opp’n at 15-16 (“Acceptance of the FBI’s argument would also require this Court to ignore that the FBI has been exceedingly public about the fact that the tool applies only to a specific model of phone (the iPhone 5c) running a specific, and already outdated, operating system (iOS9). Were adversaries on the hunt for actually effective countermeasures, they need only to heed [Director] Comey’s public statement and simply use a different kind of phone, or a different operating system.”) (citation omitted). But this argument is unvarnished speculation about the efficacy of this intelligence tool – and this Circuit has made exceedingly clear that such speculation cannot defeat an agency’s summary judgment claim.

Someone's assertions are wrong. Either the DOJ was lying when it said it would only work on certain iPhones, or it's lying now to protect its secrecy by implying the purchased exploit is usable on other iPhones.

The DOJ clarified last spring the exploit affected any iPhone 5c and wasn't limited to those running iOS9. But even if that clarification is applied to its arguments in this lawsuit, this paragraph stills points to someone at the DOJ being dishonest. The counterargument that people wishing to prevent the FBI from accessing their phone's contents could just switch to a newer iPhone still applies. And that's the part the DOJ is calling "unvarnished speculation."

Of course, the plaintiffs are in the unfortunate position of having little more than unvarnished speculation to work with. Some documents pertaining to the purchased iPhone crack have been released, but have been almost completely redacted, save for some standard contractual language of no informational value. The DOJ is leveraging information it doesn't want to release to argue against being forced to release it. That's certainly convenient for the DOJ, as are any of its intelligence gathering arguments, which grant it the power to dispel questions about over-redaction without having to explain its side of the issue.

Thus, while the identity of the vendor may not itself be an intelligence source or method, see Opp’n at 18, releasing that information leads “logically or plausibly” to information about the intelligence source or method, see Judicial Watch, 715 F.3d at 941, and is thus exempt from disclosure under Exemption 3. That is particularly true in light of the “considerable deference” owed to the FBI in this context. Leopold, 106 F. Supp. 3d at 58; see also Ctr. for Nat’l Sec. Studies v. Dep’t of Justice, 331 F.3d 918, 927 (D.C. Cir. 2003) (“[W]e have consistently deferred to executive affidavits predicting harm to the national security, and have found it unwise to undertake searching judicial review.”). Accordingly, the FBI has appropriately applied Exemption 3 to these two pieces of information.

A version of this argument just helped the DOJ keep its journalist-surveilling secrets hidden from journalists (it possibly surveilled) in another FOIA lawsuit. Chances are, the court will side with the FBI and its national security assertions. Unfortunately, the DOJ's contradictory statements aren't on trial here -- just its broad assertions about national security and intelligence-collecting methods, both of which appear to be so easily compromised it can't even let the country know how much it paid to crack a single iPhone.

Filed Under: contradictions, doj, fbi, hack, iphone, james comey

Despite Stream Of Leaks Exposing Tremendous Gov't Surveillance Capabilities, James Comey Still Complaining About 'Going Dark'

from the really-just-working-with-a-single-talking-point-these-days dept

Following the Shadow Brokers' partial dumping of NSA exploits, a new batch of CIA exploits has hit the web via Wikileaks. Contained inside both sets of leaks was information explaining why encryption isn't much of a problem for the intelligence community. The NSA has put plenty of time and money into breaking encryption, but much of its Tailored Access Operations -- much like the contents of the CIA dump -- involve access efforts that bypass encryption completely by making themselves at home on the targeted hardware/device.

Despite these leaks, FBI Director James Comey is still insisting encryption is a problem. In his recent appearance at Boston College's cybersecurity conference, Comey had this to say:

[C]omey said that he a fan of "strong encryption" but noted that "it is making more and more of the room of what the FBI investigates dark."

Between September and November, the FBI received 2,800 devices it had lawful authority to open but could not open 1,200 of them "with any technique," he said.

Comey (again) called for "balance," a term he never bothers to define, but hints heavily at private companies being made to play by his rules, rather than offering any form of compromise from his end.

And it's partially true: devices seized after an arrest can't be forced open by exploits. The exploits need to be present on the devices first. But investigations always precede arrests. At this point, efforts can be made to target known devices to provide access during the investigation and prevent them from being locked up once they're seized. The legal framework, unfortunately, doesn't really exist at this point, but a lack of specific permission has never stopped the FBI from acting first and litigating later.

The FBI also has expanded access to the NSA's full-take surveillance programs, thanks to the recent lifting of restrictions. Nearly every phone utilizes the internet in some way, which would expose data and communications to the NSA's taps. This won't capture everything stored on devices, but it's far more info than the FBI would have otherwise. Comey's repeated complaints about "going dark" make less and less sense every time a new surveillance secret leaks.

Every new surveillance leak points to another disturbing fact: the FBI's promises of security and safety -- in reference to courtroom requests for "technical assistance" from device manufacturers -- are bullshit. If the NSA and CIA can't keep their exploits out of the public's hands, there's zero chance the FBI would somehow keep leakers and/or criminals from obtaining its cell phone-cracking secrets. The only balance that can be achieved by undermining device encryption is one where everyone loses.

Filed Under: cia, encryption, fbi, going dark, jim comey, leaks, surveillance

Vice President Fails To Demand An FBI Investigation After His Private Email Account Is Hacked

from the investigations-are-for-other-people dept

I can only assume Mike Pence is so self-absorbed he's literally incapable of recognizing his own hypocrisy. Either that or he's completely shameless.

After engaging in a presidential campaign where much was made of Hillary Clinton's private email address/server, Pence went to court to prevent his AOL emails from being released to public records requesters.

I can only assume Pence is now welcoming an FBI investigation into his use of an AOL account.

Clinton routed sensitive documents through an insecure personal server. Pence is doing the same. While Clinton was advised against setting up her own personal email server, it's likely Pence has had an AOL account for a long, long, long time. Sure, there's a difference between taking matters into your own hands and leaving your email security up to a third party, but the end result is no different: both were using private accounts to handle government business -- business that included the classified and sensitive information.

The main difference here is we know Pence's email account has been hacked. There were attempts made on Clinton's email server, but nothing out there suggests any of those attacks were successful. Considering Pence's earlier adamance about Clinton's careless email habits, it's probably time to invite the FBI to take a look at his careless handling of sensitive documents.

Emails released to IndyStar in response to a public records request show Pence communicated via his personal AOL account with top advisers on topics ranging from security gates at the governor’s residence to the state’s response to terror attacks across the globe. In one email, Pence’s top state homeland security adviser relayed an update from the FBI regarding the arrests of several men on federal terror-related charges.

Cyber-security experts say the emails raise concerns about whether such sensitive information was adequately protected from hackers, given that personal accounts like Pence's are typically less secure than government email accounts. In fact, Pence's personal account was hacked last summer.

Politicians routinely have to eat their words. They're rarely shy about casting the first (and several follow-up) stones, even while their own sins run dark and deep. But a guy who has an email investigation to at least partially thank for his new position should be following an own-words-based diet for the next several months. If nothing else, it might (MIGHT!) push him towards the occasional second thought before hitting "tweet."

If Pence were intellectually honest, he'd replace Clinton's name with his own in the statement he made to "Meet the Press" last year.

“What’s evident from all of the revelations over the last several weeks is that Hillary Clinton I operated in such a way to keep her my emails, and particularly her my interactions while Secretary of State with the Clinton Foundation governor of Indiana, out of the public reach, out of public accountability,” Pence said. “And with regard to classified information she I either knew or should have known that she I was placing classified information in a way that exposed it to being hacked and being made available in the public domain even to enemies of this country.”

Pence's former office is releasing a small subset of his AOL emails. The Indy Star has obtained around 30 of them, but the governor's office says it's withholding a majority of them because they're either (a) deliberative documents or (b) too damn sensitive to be released publicly.

If the governor's office won't release them, perhaps the hackers will. Sunlight is the best disinfectant, but sometimes an outsider kicking in the door and throwing open the blinds is the only way to achieve the transparency the public deserves.

Filed Under: classified info, emails, fbi, foia, hacked, hillary clinton, mike pence, private servers, public records

Judge: FBI's NIT Warrant Invalid And IP Addresses Do Have An Expectation Of Privacy, But No Suppression Granted

from the good-findings-mixed-with-questionable-conclusions dept

Thanks to the FBI's one-to-many NIT warrant, which was issued in Virginia but reached thousands of computers all over the world, yet another federal judge is dealing with the fallout of the feds' efficiency. Michigan federal judge Thomas Ludington finds plenty he doesn't like about the FBI's malware and the DOJ's defense of it, but still can't quite find enough to warrant suppression of the evidence [PDF link].

Properly stated, the question here is whether the FBI’s NIT warrant so exceeded the limits of the magistrate judge’s jurisdiction and authority or reasonable behavior by law enforcement as to require suppression to deter similar actions in the future. Although the NIT warrant exceeded the scope of Rule 41(b) as it existed at the time, the FBI’s actions in investigating and closing Playpen were reasonable and directed toward securing the judicial review of law enforcement which the Fourth Amendment contemplates. Given the circumstances, suppression is not appropriate.

That being said, the opinion does offer plenty of counters to the DOJ's legal rationale -- something that other defendants in the FBI's massive Playpen investigation might find useful. The court, like others, finds the FBI exceeded the jurisdictional limitations of Rule 41 and no amount of creative phrasing is going to change that.

None of the three bases in Rule 41(b) provided jurisdiction for the magistrate judge to approve the warrant. Rule 41(b)(1) cannot serve as the basis for jurisdiction. Under that provision, a magistrate judge can issue a warrant to seize property “located in the district.” Here, the server housing Playpen had been transported to Virginia by the FBI, but the NIT involved the transmission of information from that server to computers located around the country and then back to the server. The relevant information (or “property”8 ) was the information requested by the NIT from the user’s computer. The NIT cannot be reasonably construed as seizing information “located in the district” even if the request for the information originated from a server in Virginia.

[...]

Even if Kahler had some contact with the Playpen server located in Virginia, the information sought by the NIT was all located in Michigan. The mere fact that the information from outside the district was brought into the district cannot satisfy Rule 41(b)(2). If that scenario was sufficient, then there would effectively be no jurisdictional limit on warrants for seizure of personal property, because property can typically be moved.

It also finds -- during its discussion of Rule 41 limitations -- that the DOJ can't justify its defective warrant by claiming the software was merely a "tracking device." The NIT pulled information from a computer -- including information that would ID the user -- and left nothing behind to track further computer "movements." That changes the purpose -- and the scope -- of the intrusion.

The receipt of the username associated with the computer’s operating system goes beyond simple location data to descriptive data regarding the identity of the user. The NIT is more than just a “tracking device”; it is a surveillance device.

Additionally, the entire purpose of the NIT was to interact with a computer and obtain information that was located in another district. Even though the NIT was nominally installed on the Playpen Server, the NIT’s “tracking” functionality occurred in other districts. Finally, the purpose of the NIT was to discover the location of the users accessing Playpen, not track their movement.

The government also argued that even if the warrant was faulty, it was ultimately unnecessary because the information obtained fell under the Third Party Doctrine. The court disagrees (nodding to the Supreme Court's Riley decision), finding that efforts users make to cloak their identity -- even while engaging in criminal activity -- generates a layer of privacy protection under the Fourth Amendment.

The Government argues that, despite using a software which exists only to veil the user’s IP address from prying eyes, the user has no reasonable privacy interest in his or her IP address. This argument has little to recommend it. If a user who has taken special precautions to hide his IP address does not suffer a Fourth Amendment violation when a law enforcement officer compels his computer to disclose the IP address, the operating system, the operating system username, and other identifying information, then it is difficult to imagine any kind of online activity which is protected by the Fourth Amendment. Internet use pervades modern life. Law enforcement, acting alone, may not coerce the computers of internet users into revealing identifying information without a warrant, at least when the user has taken affirmative steps to ensure that third parties do not have that information.

This contrasts with other decisions dealing with the same subject matter, where judges have found there's no expectation of privacy in IP addresses, even when one has taken extra steps to obscure it. Those findings seem logically contradictory, at best. If someone's attempts to keep third parties from obtaining information, this information can't truly be considered held by a third party. Stripping away these efforts turns the FBI into the "third party," and the government isn't allowed to both act as a third party and excuse its actions with the Third Party Doctrine.

But in the end, there's no suppression. As the court points out, two things weigh against suppressing the evidence, even with the warrant being facially invalid under Rule 41. First, the FBI malware only infected registered users visiting the dark web child porn site, which makes the possibility of accidental infection almost nonexistent. Second, the fact that the FBI had no idea where the site's visitors were actually located makes this an inelegant solution to a problem, not a case of judge-shopping for compliant magistrates.

[T]his is not a case where the FBI purposely avoided compliance with the law. The investigation of Playpen was difficult precisely because the FBI had so little information about the location of the users. If the FBI had known where certain users were located but nevertheless chose to seek a warrant in another district, suppression would be appropriate. In that case, the FBI would have purposely skirted the law despite a legal alternative. Kahler’s arguments, if accepted, would imply that the FBI should not have conducted the NIT investigation at all because the users were masking their true location. The FBI’s decision to adopt novel tactics to bring individuals distributing child pornography behind location-concealing software to justice is not inherently troubling behavior.

In the future, the FBI won't have to deal with nearly as many suppression hearings, thanks to changes to Rule 41. These decisions are becoming relics of statutorial limitiations almost as soon as they're issued. Even if courts find the malware deployment to be a search invasive enough to trigger Fourth Amendment protections, the lack of jurisdictional limits going forward will prevent them from being challenged.

Unfortunately, the rule changes are almost guaranteed to encourage more frequent deployments of tools designed to decloak anonymous internet users. The breadth and reach of these warrants will be almost unchecked and that's bad news for activists, dissidents, and others who just want to stay off the internet grid. Sure, it's also bad news for child porn fans, but child porn, terrorism, drug warring, etc. is where these efforts start. It's seldom where they end.

Filed Under: 4th amendment, doj, fbi, malware, nit, playpen, warrant

Another 'Terrorist' Swept Up By The FBI, Which Had To Purchase $20 Of 'Terrorist' Supplies To Keep The 'Plan' In Motion

from the and-threatened-his-family,-which-is-a-nice-use-of-gov't-resources dept

Perhaps no entity generates more fake news than the FBI's counterterrorism unit. Several times a year, a press release is issued announcing the bust of a so-called terrorist. Almost invariably, the "terrorist" has been handcrafted through the relentless intercession of undercover FBI agents.

Here's how the DOJ website describes its latest self-crafted anti-terrorism coup:

Robert Lorenzo Hester, Jr., 25, of Columbia, Missouri, was charged in a criminal complaint with attempting to provide material support to the Islamic State of Iraq and al-Sham (ISIS), a designated foreign terrorist organization. Hester was charged in federal court based on his role in making preparations to launch a terrorist attack with persons he believed were associated with ISIS, who were actually undercover law enforcement personnel.

And here are the far more mundane and sad details behind the official statement, as provided by Murtaza Hussain of The Intercept.

Robert Lorenzo Hester of Columbia, Missouri, didn’t have the $20 he needed to buy the 9-volt batteries, duct tape, and roofing nails his new FBI friends wanted him to get, so they gave him the money. The agents noted in a criminal complaint that Hester, who at one point brought his two small children to a meeting because he didn’t have child care, continued smoking marijuana despite professing to be a devout Muslim.

This is the supposed terrorist who would have killed hundreds of people on President's Day if the FBI hadn't stepped in to intervene. But the FBI's "intervention" looks suspiciously like "encouragement…" or "entrapment."

[T]he only contact Hester had with ISIS was with the two undercover agents who suggested to him that they had connections with the group. The agents, who were in contact with him for five months, provided him with money and rides home from work as he dealt with the personal fallout of an unrelated arrest stemming from an altercation at a local grocery store.

Undercover agents began working with/on Hester shortly after this arrest. Seizing on his anti-government social media posts [good lord], the agents told Hester they could put him in touch with someone with direct terrorist connections. This "direct connection" was just another FBI agent. It was the FBI that suggested acquiring weapons. And it was the FBI who chose to take Hester seriously, despite his nonexistent terrorist group ("the Lion Guard") sporting a name that had been pulled from a cartoon his children watched.

It was also an FBI agent who suggested that even thinking about planning a terrorist attack was an irrevocable act -- and that entertaining second thoughts about committing acts of violence would be rewarded with acts of violence.

The agent cautioned Hester that once he decided to proceed there was “no turning back.” He also told Hester that under no circumstances was he to do conduct any sort of operation on his own. The agent, referred to in the complaint as UC-2, then “threatened to come back and find HESTER if he learned that HESTER reneged on the promise. For emphasis, and for the purpose of mitigating the security threat posed by HESTER, UC-2 displayed a knife and reminded HESTER that UC-2 knew where HESTER and his family lived, among other forceful words.”

After threatening his family, FBI agents continued to push Hester forward with "his" plan to commit an act of terrorism. His plans required $20 worth of supplies… which Hester couldn't afford. But Hester did promise to be more materially-supportive in the near future:

Hester promised that he would help buy ammunition for the weapons once he had received the money from his tax refund.

A lot of the FBI's standard counterterrorism M.O. is on display here. The agency prefers to work with people in desperate or dire circumstances -- people who don't have the financial independence or mental toughness needed to create and carry out plans on their own. And when they get cold feet, agents apparently suggest their dire circumstances will be made even worse. The end result is the government congratulating itself for rounding up "terrorists" that likely never would have gone beyond anti-government Facebook posts if they'd been left alone. And for the few who appear capable of committing violent acts, the government pushes these people towards extremism rather than attempt to pull them back from this precipice.

Filed Under: doj, fbi, own plot, robert hester, terroism

FBI Arresting More Americans For Targeting Muslims, Than Muslims For Targeting Americans

from the lock-'em-up dept

We've been pretty damn clear that we think the Trump administration's targeting of people from a few countries by banning them from entering the US is both inhumane and misguided. We were proud to sign on to an amicus brief opposing it and happy that the 9th Circuit agreed -- though the case is far from over. As I've noted repeatedly, to me it's an issue of basic humanity and decency, but some have insisted on making arguments about how certain people are somehow out to get us and we need to protect ourselves from them. I know that, these days, it's considered silly to rely on things like facts for an argument, but it seemed worthwhile to actually explore some facts on this particular topic.

We'll start with a post at Lawfare, by Nora Ellingsen. And we should start out by noting that Techdirt and Lawfare have a pretty long history of... well... not agreeing on much. The site is generally supportive of the intelligence community and supportive of actions taken to protect "national security." We tend to be more skeptical. Ellingsen worked in the FBI's Counterterrorism Division for five years, specifically working on international terrorism investigations inside the US. Since leaving the FBI to go to law school, she's been tracking counterterrorism cases in the US, using DOJ data. And she's gone through that data to try to determine if there's any truth to the idea that people from those countries represent a big ongoing threat. And the answer is that it's just not true. In fact, the real "terrorism" threat in America appears to be... from Americans.:

The Program on Extremism at George Washington University has routinely published statistics indicating that the “vast majority” of individuals charged in the U.S. with offenses related to ISIL are U.S. citizens. When considering all terrorism offenses, that claim holds up—80 of the 97 suspects arrested in the past two years, or more than 82 percent, are American citizens.

Most of those, notably, are not naturalized citizens. Of the U.S. citizens, only six were naturalized. In other words, more than 76 percent of individuals arrested by the FBI over the past two years for terrorism-related offenses were U.S. citizens as a result of having been born in the United States.

The post goes through all of the individuals who were not born in the US and looks at what each was charged with (often just making false statements to the FBI) and how many of them (not many) actually came from the list of banned countries.

And, then, of course, the fact that the FBI these days tends to be arresting a lot more people for plotting violent attacks on Muslims, than Muslims plotting violent attacks on the US:

Since January 2015, the FBI has also arrested more anti-immigrant American citizens plotting violent attacks on Muslims within the U.S. than it has refugees, or former refugees, from any banned country. As we wrote about here, here and here, in October 2016, three white men from Kansas were charged with conspiring to use a weapon of mass destruction. According to the graphic complaint, the anti-Muslim and anti-immigrant men planned to attack a mosque in the area. The men progressed quickly with their plot, amassing firearms and explosives. The targets were people from Somalia, who ironically, would now be covered by Trump’s order.

Similarly, the post notes that there were more US citizens arrested en route to join ISIS in Syria than those arrested trying to plan attacks here.

Since we’re already on the topic, let’s talk about Americans traveling to join ISIL. Over the past two years, the FBI has arrested 34 Americans who aspired to leave, attempted to leave or actually left the United States to join a terrorist group overseas. In other words, although two refugees came into the U.S. and were charged with material support,

Seventeen times that number of U.S. citizens tried to leave the U.S. to conduct attacks and fight overseas. More Americans have snuck into Syria to join ISIL, than ISIL members have snuck into the United States. In September 2015, a congressional report indicated that 250 Americans have gone to Syria and Iraq to fight with ISIL. By comparison, as of December 2015, only 71 individuals in the United States had been charged with ISIL-related activities—the vast majority of whom were also U.S. citizens, according to George Washington University.

Meanwhile, over at Slate, William Saletan has pointed out that if the President really wants to ban travellers from regions that import multiple people aiming to harm Americans... it ought to ban travel from North & South Carolina. He goes through story after story of extremists who left North Carolina to conduct terrorist attacks elsewhere. The list is long, but here are just a few:

It began with Eric Rudolph, a Holocaust denier who grew up in the Christian Identity movement. In 1996, Rudolph traveled from North Carolina to Atlanta, where he detonated a bomb at the Olympics, killing one person and injuring more than 100 others. A year later, Rudolph bombed a lesbian bar in Atlanta, wounding five people. In 1998, he bombed a reproductive health clinic in Birmingham, Alabama, killing a security guard and injuring a nurse. The “Army of God,” which hosts Rudolph’s writings, claimed credit for his attacks.

In 2001, Steve Anderson, another Christian Identity follower, was pulled over for a broken tail light on his way home from a white supremacist meeting in North Carolina. He pumped 20 bullets into the officer’s car and fled. Police found weapons, ammunition, and explosives in his truck and home. A year later, he was captured in the western part of the state.

In 2010, Justin Moose, an extremist from Concord, North Carolina, was arrested for plotting to blow up a Planned Parenthood clinic. Moose, who claimed to represent the Army of God, also opposed the construction of a mosque near ground zero in New York. He called himself the “Christian counterpart of Osama Bin Laden.” Eventually, Moose pleaded guilty to disseminating information on how to make and use explosive devices.

Obviously, the Slate piece is tongue-in-cheek in arguing that the Carolinas are the real threat, but the larger point is completely valid. There seems to be no credible evidence for why people from the countries listed in the original executive order should be banned from the US other than outright bigotry. And, somewhat unfortunately, that same kind of ignorant bigotry (which the executive order is only helping to encourage and spread) is resulting in actual violent attacks from Americans who misguidedly think they're stopping "evil."

Filed Under: executive order, fbi, immigration ban, muslims, terorrism

FBI Changes FOIA Policies, Tries To Route More Requesters To Fax Machines, Mailboxes

from the FBI-FOIA:-where-the-present-is-always-several-years-away dept

The FBI's relationship with the FOIA is, at the very least, contentious. The agency clearly would rather follow the letter of the law than its spirit... but only the letters it likes. It will technically release documents -- sometimes years after the request is made -- even if said documents are nothing more than a mostly blank paper telling the requester that all 509 pages have been withheld.

To the FBI -- and to its official FOIA stats -- this release of nothing counts as a "response." Even cutting itself this much slack on "responses" hasn't helped the FBI's FOIA stats. This has led to it preemptively declaring any response that may include more than 50 pages as "complex," in hopes of massaging its clearly awful response times.

Considering the FBI's open antagonism towards FOIA requesters, it comes as no surprise the agency is making it even more difficult for requesters to make requests. The Daily Dot reports on the FBI's latest changes to its FOIA policies.

At the beginning of March, the FBI will no longer accept FOIA requests via email. Instead, requesters will have to rely on fax machines and standard mail (“snail mail”) in order to communicate with the agency’s records management division. The agency will also accept a fraction of requests through an online portal, provided users agree to a terms-of-service agreement and are willing to provide the FBI with personal information, including a phone number and physical address.

In the year of our various lords two-thousand-seventeen, the FBI is pushing requesters towards fax machines and snail mail. Why? Because it makes it incrementally more of a hassle to request documents from the agency. Sure, there are a number of options online to turn emails into faxes, but it's just one more hoop to jump through, put into place by the FBI with absolutely zero justification.

Anything that discourages the filing of a request is a win in the FBI's book. Anything that makes the process more time consuming is just another deterrent. And forcing electronic requesters to provide a phone number and physical address is completely nonsensical. This itself is a deterrent, as some requesters may not feel comfortable giving the FBI this information in exchange for a pile of redated PDF pages at some point in the next six months-five years.

And there's no guarantee requests sent in the FBI's preferred form will even make it through. As was noted here a few years ago, an agency with an annual budget in the high billions (Defense Dept.) was sending letters to requesters to inform them that the Department's FOIA fax machine was broken and might not be replaced until the beginning of the next fiscal year.

Add to that the FBI's internal search system, which appears to be deliberately designed to avoid finding responsive documents. Some of the equipment dates back to the 1980s, and the databases it accesses are siloed off from each other, preventing cross-searches for specified terms. Requesters need to know as much about FOIA documents searches as the FBI's FOIA response team in order to coax even a minimum of compliance from the agency.

The good news is that the FBI has been shamed into rolling back part of its "fax and stamps" FOIA demands. It would still prefer requesters use the most archaic form possible when asking for documents, but it has rolled back restrictions it placed on requests made through its online portal.

Earlier on Tuesday, the FBI told the Daily Dot it would remove the limit on the number of submissions requesters could make and allow users to file requests 24 hours a day.

“The FBI eFOIA portal has been under development and testing for two years. With the full implementation of the portal on March 1, 2017, the terms of service for the site will be modified to allow an unlimited number of requests, no limitation on the number of requests which may be submitted by an individual, and availability seven days a week, 24 hours a day,” the FBI said in a statement.

Even with this belated fix, the FBI has still drawn the attention of Senator Ron Wyden, who plans to ask a bunch of pointed FOIA questions at his earliest convenience.

"Sen. Wyden has a number of concerns about the FBI’s new FOIA policy, even with the revisions announced today,” Keith Chu, Wyden's spokesman, told the Daily Dot in an email. “He plans to ask FBI how it justifies limiting access to information the public has a right to access.”

I'm sure the agency will inform Ron Wyden that it performs the statutory minimum to comply with FOIA law, even if this "compliance" results in routine, lengthy response delays and multiple lawsuits. But it may find it harder to explain how it arrived at the conclusion it could do even LESS than it already does by instituting these policies.

Filed Under: email, fax machines, fbi, foia, transparency

Barrett Brown's Donors Sue DOJ/FBI For Monitoring Their Donations

from the what-kind-of-world-do-you-want-to-live-in? dept

We've written numerous stories about Barrett Brown, the reporter who was sentenced to 63 months in jail after being pressured into signing a plea deal. If you don't recall, Brown's "crime" was trying to get a bunch of people together to crowdsource an investigation into the famous Stratfor email hack. The feds went after him for posting a link (yes, posting a link) to a group to investigate, and because some of the Stratfor info included credit card data, the feds argued that Brown was trafficking in stolen credit cards. Really. And while the feds eventually dismissed the specific charges related to the links, the judge justified the long sentence against him because he copy/pasted that link.

The whole thing was a travesty. Brown is thankfully out of jail now, but earlier this week, Kevin Gallagher, who helped organize a legal defense fund for Brown, sued the Justice Department over claims that the DOJ illegally tracked and monitored everyone who donated to support Brown. Gallagher is looking to make this a class action lawsuit. You can read the full complaint here. From the filing:

The government agents responsible for the arrest and prosecution of the journalist violated the First Amendment by seeking the identities of the donors to the crowd-funding campaign, as well as the amounts of each donation. This violation began when Assistant United States Attorney Candina Heath sent a subpoena (the “WePay Subpoena”) to WePay, Inc. (“WePay”), the host of the crowd-funded legal defense fund, directing WePay to send “any and all information” pertaining to the legal defense fund to Special Agent Robert Smith of the Federal Bureau of Investigation (“FBI”). The subpoena claimed that the information it requested would be used at the trial of the jailed journalist. However, the identities of, and the amounts donated by, the journalist’s supporters are completely irrelevant to the charges levied against the journalist. On information and belief, the WePay Subpoena was part of a larger scheme by Ms. Heath and Mr. Smith to unlawfully surveil the donors in violation of the First Amendment. As the Ninth Circuit has recognized, “[t]he right of those expressing political, religious, social, or economic views to maintain their anonymity is historic, fundamental, and all too often necessary. The advocacy of unpopular causes may lead to reprisals – not only by government but by society in general. While many who express their views may be willing to accept these consequences, others not so brave or so free to do so will be discouraged from engaging in public advocacy.”

The lawsuit further argues that the subpoena violated the Stored Communications Act (part of ECPA), because it sought the content of electronic communications without a warrant. That's because, in using WePay, donors were able to also include messages of support for Barrett Brown -- and the feds requested that info without a warrant (and the content was less than 180 days old, which still does require a warrant). That's... a problem.

The details of the lawsuit also question whether or not the administrative subpoena that was used to request the info was issued under false pretenses (i.e., it was claimed that the info was necessary for the prosecution of Brown, but instead of being sent to the prosecution team, it was sent instead to the FBI):

The WePay Subpoena indicated that the information it requested would be used in the trial of Barrett Brown. Oddly enough, however, instead of asking WePay to send its response directly to Ms. Heath, the prosecutor, or to lodge its response with the court, the WePay Subpoena compelled WePay to produce information directly to Agent Smith of the FBI. This renders the WePay Subpoena improper under Federal Rule of Criminal Procedure 17(c). It also demonstrates that Defendants’ claimed purpose of using the information produced in response to the WePay Subpoena at Barrett Brown’s trial was purely pretextual. The true goal of the WePay Subpoena, rather, was to facilitate the unlawful surveillance of the anonymous donors to the crowd-funding campaign.

I have no idea if this case has any chance at all. My suspicion is that the courts will figure out a way to dump it pretty quickly, but at the very least, it should call attention to the question of why the FBI felt that it needed all of the info on everyone donating to Barrett Brown, a journalist they railroaded into jail.

Filed Under: barrett brown, class action, doj, donations, ecpa, fbi, first amendment, kevin gallagher, sca, stored communications act

The FBI Can Engage In All Sorts Of Surveillance And Snooping Without Actually Placing Someone Under Investigation

from the massessments dept

It's unclear how many Americans are under surveillance by the FBI. Not only would the agency be extremely unwilling to even provide a broad estimate, but the underlying basis for a preliminary investigation is so thin it could conceivably cover a majority of US residents.

A previously-classified document [pdf] obtained by The Intercept gives more insight into the FBI's use of "assessments" -- an investigation the agency doesn't consider an investigation.

Assessments allow agents to look into tips or leads that don’t meet the standard for opening an investigation, which requires specific information or allegations of wrongdoing — an “articulable factual basis” for suspicion, as FBI rules put it. In an assessment, by contrast, an agent just needs to give an “authorized purpose” for their actions. Agents can open assessments “proactively,” in order to evaluate potential informants, collect intelligence about threats surrounding public events, study a field office’s geographical area, or gather information about a general phenomenon of interest to the bureau.

This practice has been referred to elsewhere as "circling the target." The FBI scours publicly-available information on potential investigation targets, gathering anything it can without a subpoena or warrant. But it doesn't stop there. It goes much further, based on little more than unverified tips from confidential informants or indulging in its own hunches.

[I]f agents decide to dig deeper by opening an assessment, they are allowed to have informants collect information, and they can also physically surveil the subject — including by airplane. In some cases, they can issue grand jury subpoenas. If the purpose of an assessment is to evaluate someone as a potential informant, agents can give polygraph tests, dig through trash, and use fake identities in the course of their research.

In addition to these information-gathering tools, the FBI also has access to massive databases of information collected by other government agencies, including the NSA. [Thanks Obama] Analysts use FBI-built tools to uncover links between assessment targets and other suspects by poring through massive amounts of third-party records (email, phone, banking, etc.)

Then the agency starts tracking the target's movements.

The FBI also traces the subject’s travel history through Department of State visa and passport records, a Customs and Border Protection database, and data held by a private company called the Airlines Reporting Corporation, which manages itineraries for airlines and travel agencies. In 2009, Wired reported that the FBI was seeking access to ARC’s full database, which would include billions of travel records showing the data printed on the front of an airplane ticket and the method of payment used.

ARC told Wired it only handed over info in response to subpoenas and National Security Letters, which is likely the impetus for the FBI's push for full access. Anything that eliminates paperwork and paper trails for mostly-suspicionless investigations is a win for the agency. And, it must be noted, the information sought from ARC does not fall under the DOJ's guidelines for what records can be obtained with NSLs.

This is added to everything else the FBI can obtain without actually officially engaging in an investigation -- something that covers records held by the ATF, CIA, and NSA. Powerful data mining tools crack open a target's social media life for deeper exploration while FBI planes circle overhead. And yet, this person remains -- according to the FBI -- not under investigation.

In all fairness to the FBI, the assessments place it in the worst possible position. It's not allowed to convert these into investigations if it can't uncover anything more substantive during its assessment. FBI insiders say there's pressure to convert these as soon as possible, albeit not because of civil liberties concerns. And when its assessments fail to snag people who later engage in acts of terror, the FBI is viewed as incompetent.

Then again, in all fairness to the FBI's track record, it tends to spend a lot of its time converting mostly-incompetent people into "dangerous" terrorists -- effort that might be better expended chasing down truly dangerous individuals. And the sheer amount of information it has access to without actually opening an investigation can do more harm than good. It can generate a lot of false positives while burying stuff the FBI should be focusing on. Signal-to-noise is always a concern for intelligence agencies, and the FBI's dual hat-wearing (law enforcement/counterterrorism) gives it access to more data than more single-minded agencies.

Filed Under: assessment, fbi, investigation, preliminary investigation, privacy, surveillance