Want To Know Why DHS Is Opposing CISA? Because It's All A Surveillance Turf War

from the it's-not-what-you-think dept

As it appears that the fake "cybersecurity" bill CISA is heading to a vote in the Senate, some were surprised this week to see the Department of Homeland come out against the bill with a letter expressing concerns that the bill "could sweep away important privacy protections" with its open ended definitions and provisions:

The authorization to share cyber threat indicators and defensive measures with “any other entity or the Federal Government,” “notwithstanding any other provision of law” could sweep away important privacy protections, particularly the provisions in the Stored Communications Act limiting the disclosure of the content of electronic communications to the government by certain providers. (This concern is heightened by the expansive definitions of cyber threat indicators and defensive measures in the bill. Unlike the President’s proposal, the Senate bill includes “any other attribute of a cybersecurity threat” within its definition of cyber threat indicator and authorizes entities to employ defensive measures.)

This has led to some surprise among people who don't follow this that closely, that "even Homeland Security" doesn't like the bill. But that's really ignoring history and what this fight has always been about. Going back many, many years we've been highlighting that the truth behind all of these "cybersecurity" bills is that it's little more than a bureaucratic turf war over who gets to control the purse strings for the massive, multi-billion dollar budget that will be lavished on government contractors for "cybersecurity solutions." That the bill might also boost surveillance capabilities is little more than a nice side benefit.

The key players in this turf war? The NSA and Homeland Security (with the Justice Department occasionally waving its hand frantically in the corner shouting "don't forget us!"). From the beginning, one of the key questions people have asked is "who gets the data?" Obviously, "none of the above" is probably the best answer, but of the remaining options, Homeland Security tends to be the least worst option out of a list of three really bad options. And, so far, the White House has repeatedly pushed to put DHS in charge, giving it more power over the budget. However, CISA does not put DHS in charge.

So that is why DHS is complaining. Yes, the "privacy" concerns are there, but DHS's true concern is that it's not DHS running the show (and controlling the budget). Reread the DHS letter with this as background, and it appears a lot more understandable:

The Administration has consistently maintained that a civilian entity, rather than a military or intelligence agency, should lead the sharing of cyber threat indicators and defensive measures with the private sector. The National Cybersecurity Protection Act of 2014 recognized the NCCIC to be responsible for coordinating the sharing of information related to cybersecurity risks and to be the federal civilian interface for multi-directional and cross-sector sharing of information about cybersecurity risks and warnings. The NCCIC has representatives from the private sector and other federal entities involved in cyber information sharing, from those with whom we have an agreement and share consistently, to those that passively receive information from the center.

Equally important, if cyber threat indicators are distributed amongst multiple agencies rather than initially provided through one entity, the complexity–for both government and businesses–and inefficiency of any information sharing program will markedly increase; developing a single, comprehensive picture of the range of cyber threats faced daily will become more difficult. This will limit the ability of DHS to connect the dots and proactively recognize emerging risks and help private and public organizations implement effective mitigations to reduce the likelihood of damaging incidents. DHS recommends limiting the provision in the Cybersecurity Information Sharing Act regarding authorization to share information, notwithstanding any other provision of law, to sharing through the DHS capability housed in the NCCIC. This would not preclude sharing with any federal entity (indeed, DHS maintains an obligation to share rapidly with federal partners independent of any legislation), and it would further incentivize sharing through the NCCIC.

There's a lot more like that in the letter as well.

Don't get me wrong. Having DHS come out against CISA and speaking out about the privacy concerns the bill raises is great. But don't think that DHS is against these kinds of "information sharing" bills at all. It is not. It just wants to make sure that it's the queen bee when it comes to who's in charge of cybersecurity information... and, with it, who gets to control the budget.

Filed Under: cisa, cybersecurity, dhs, dod, doj, homeland security, nsa, privacy, turf war

Government Seizes Vehicles Worth $1 Million; Brings No Charges, Keeps The Cars

from the where-'due-process'-is-commonly-abbreviated-as-'GFY' dept

Asset forfeiture: drop the charges, keep the property. I guess the person behind Saeki Co., Ltd. should feel appreciative he actually was graced with charges, rather than just had his purchased vehicles seized and spirited away with a mumbled explanation and some dodgy paperwork.

Saeki Co. bought several luxury vehicles from a place called Texas Motors (which, oddly enough, is located in Florida) with the intent to sell them for a significant markup to wealthy Japanese citizens. This is possibly illegal, but not because of any explicit export ban. The only reason it verges on illegal is because resellers like Saeki ever-so-lightly tread on the toes of major manufacturers and their authorized dealers who do the same thing.

The true legality of the situation is undetermined. The feds behind the first seizures of soon-to-be-exported vehicles didn't seem to have a firm grasp on the matter. They certainly felt it was illegal, and this feeling resulted in plenty of seizures, but these agencies didn't have any crystal-clear guidance on the matter.

The crackdown was driven largely by agents with the Secret Service and the Department of Homeland Security, who questioned whether these small export companies were violating federal law by using straw buyers — people paid small sums to buy cars — to conceal that the vehicles were being bought by people who had no intention of keeping them and were using cash from other people to make the acquisitions. Federal authorities have argued that using straw buyers is a deceptive practice that potentially deprives American consumers of a chance to buy the luxury cars and limits the ability of automakers to keep tight control over sales to domestic dealers and to foreign countries.

It's not so much the American public losing a few opportunities to buy a luxury vehicle as it is the other thing: tight control of sales. The American public can't get many laws written in its favor, but large industries certainly can. This initial thrust led to lots and lots of partnerships with local law enforcement agencies conveniently located near shipping docks. And this led to lots and lots of luxury vehicles ending up in the hands of law enforcement.

Then, the government stopped the crackdown. It claimed to be making an effort to more tightly focus its forfeiture efforts as a result of Eric Holder's reform initiative. The appearance of being an errand boy for corporate interests certainly didn't help. Cases were dropped and charges dismissed. But the vehicles remained in the government's hands.

One person in Saeki Co.'s position spent two years fighting for the return of a seized vehicle and $125,000 in cash. This followed about a dozen similar settlements, most occuring after a legal battle with the agency(ies) holding the vehicles. In other cases, the prevailing parties still have yet to be fully recompensed. And others are still being prosecuted for violating a law the federal government isn't entirely clear on and has lost an interest in enforcing.

Saeki Co.'s story is the worst of the potential situations. It had eight vehicles worth nearly $900,000 seized at the Long Beach Seaport by customs agents. This happened January 3, 2013. Two months later, customs agents seized another of its vehicles (worth over $100,000) in Seattle. Two-and-a-half years later, the feds have abandoned everything about the case but Saeki's vehicles. And it simply doesn't want to talk about the seized property.

Despite the Government’s change in policy, Plaintiff has not received administrative relief from CBP nor any communication from the Government justifying its seizure of Plaintiff’s vehicles.

Other than the fact that it won't be bringing criminal charges.

In or about early 2014, Assistant United States Attorney David Lazarus advised Plaintiff’s counsel that the federal grand jury investigation undertaken in the Middle District of Florida had concluded without any criminal charge lodged against Plaintiff or any of its agents.

So, no criminal activity but the government still wants to keep the cars -- which were seized under a vague "felony interference of a business model" law.

Plaintiff’s vehicles were seized by CBP not because of any wrongdoing by Plaintiff, but because of an ill-conceived program by the Government to support a vehicle export monopoly at the expense of the Constitutional rights of Plaintiff and other vehicle exporters.

As the complaint points out, the government's unwillingness to respond to the plaintiff is swiftly rendering the vehicles worthless. Overseas purchasers willing to pay above US domestic retail for luxury vehicles are most likely going to want this year's model, not something that's been sitting around a government warehouse for almost three years. (And that's not taking into consideration the possibility the vehicles may have racked up miles as government agents' "work vehicles" or the occasional "drive it like you seized it" joyride.)

Then there's the simple fact that a newly-purchased vehicle starts leaking resale value the instant a purchaser drives it off the lot.

Using the generally accepted average vehicle depreciation rate of 20% in the first model year and 15% in subsequent years, the value of Plaintiff’s property has decreased in value by approximately $375,891.00 since their seizure. This measure increases every day that the Government fails to return the seized vehicles to Plaintiff.

Much of the filing details "conversations" with the government about the return of the vehicles, most of which went something like this.

SAEKI CO.: So, there's no criminal charges? This means we can have our cars back, right?
GOV'T:

The lawsuit repeatedly makes claims about Saeki Co. being deprived of due process. Which it has been. But civil asset forfeiture isn't about due process. These statutes provide -- from the very start -- a way for the government to bypass the protections due process affords to citizens. The cases themselves indicate that clearly. It's not the government versus any named individual or company. It's the government against the seized property itself, which cannot advocate in its own defense and can only be spoken for if the government grants the request.

So, while the company is absolutely right about being deprived of this right, in terms of asset forfeiture, this right simply does not exist. This lawsuit may force a response from the government, but it's a step it doesn't consider to be "appropriate" in terms of disputing seizures.

What Saeki does have going for it is the government's ambivalence towards the "law" it claimed Saeki broke. If nothing else, a judge will be asking the government a few tough questions about how its ongoing non-prosecution has managed to tie up not-guilty vehicles for the better part of three years. Given the racket that asset forfeiture is, that's about the best that can be hoped for.

Filed Under: asset forfeiture, civil asset forfeiture, dhs, homeland security, luxury cars, seizure
Companies: saeki co., texas motors

Government Appoints Insider With Terrible FOIA Track Record To Head Up Gov't Info Services At National Archives

from the you-can't-make-something-work-better-just-by-rearranging-broken-parts dept

Update: In writing this post the original link to Alex Howard's piece at Huffington Post, which makes up the majority of quotes here somehow slipped. We apologize to Alex for the error..

The Department of Homeland Security (DHS) is looking to revamp its FOIA system, which is not only suffering from the over-redaction common to intelligence/security agencies, but also from a massive backlog of unfulfilled requests. As befits an agency that often can't tell the First Amendment from a terrorist threat, the effort is going badly.

First off, the DHS recently debuted its mostly-nonfunctioning FOIA request app, which would probably have added to its backlog if only it worked. But it's a move in the right direction -- greater transparency -- even if in practice, it's pretty much the equivalent of tripping over something and calling it "forward progress."

The DHS has similar problems with its internal technology.

A November 2014 report from the General Accountability Office found the DHS duplicates efforts when processing FOIA requests. Holzer acknowledged the issue in a memorandum that said different departments of the DHS are using FOIA software that fails to meet federal standards.

The Holzer quoted here is the current senior director of FOIA operations at the DHS, James Holzer. Under his direction, the DHS has moved ever so slightly towards the "responsive agency" ideal. But every small step forward continues to be undermined by the agency's desire to keep its documents to itself. It currently has the greatest number of partially-filled requests of any government agency.

Part of this is due to the fact that the agency receives more requests than any other agency. And part of this is due to the government talking big about transparency, but refusing to put federal money where its mouth is.

According to the Department of Justice's annual report, there were 3,838 full-time FOIA staff members in 2014. In 2011, there were 4,396.

But part of this is due to Holzer himself, who has erected fee barriers to further distance requesters from the documents they seek.

Holzer wrote a 2014 letter that MuckRock, which provides a FOIA request and hosting service, was "not a member of the news media," though it featured journalists like Michael Morisy and Shawn Musgrave publishing journalism on matters of public interest, like domestic drone programs.

According to Holzer, MuckRock is a "commercial" entity -- apparently basing his determination solely on the fact that MuckRock has a website and internet users visit it to view FOIA documents.

Making documents available on MuckRock's website, even at no charge, drives traffic to the website and furthers its commercial purposes.

On top of all this, the DHS has also been found to censor FOIA responses for purely political reasons and has occasionally handled its massive backlog of unanswered requests by tossing thousands of them into file boxes and forgetting about them.

So, given this background, it's a little disheartening to hear that Holzer is being promoted to a position that will give him even more control over the government's end of the FOIA process.

This week, Archivist of the United States David Ferriero announced that James Holzer would be the new director of the Office of Government Information Services at the U.S. National Archives, beginning on August 9.

"Dr. Holzer’s experience administering FOIA and his demonstrated commitment to transparency will benefit OGIS, the National Archives, and the American public," said Ferriero.

Well, "commitment to transparency" means only as much as the administration itself is committed to transparency -- which isn't much. The promotion of an insider like Holzer to this post means FOIA requesters should expect little more than the status quo for the duration of his tenure. The government isn't imaginative enough to explore the areas outside its confines while filling an open FOIA oversight slot. This is the sort of job that shouldn't be left to a company man, as HuffPo's Alexander Howard points out.

It's hard to find a positive interpretation of the fact that a FOIA officer from DHS has been appointed ombudsman. FOIA requesters will need a strong advocate to arbitrate disputes and push for their requests to be addressed. A candidate from the nonprofit, academic or media worlds would be much more likely to do that than a DHS staffer.

The FOIA program will never approach the ideals of the law as long as it continues to be overseen only by government officials. Their interests are at odds with the public's in most cases. It's yet another area of government that would be better served by an advocate for the public, drawn from the public.

Filed Under: dhs, foia, homeland security, james holzer, national archives, transparency

If You're Looking For A Laborious, Unresponsive Way To File FOIA Requests, The DHS Has An App For You

from the Y2K-COMPLIANT! dept

The DHS isn't the most responsive government agency when it comes to FOIA requests. In fact, this government in general isn't very responsive when it comes to FOIA requests. So, it's completely understandable why its brand new FOIA app is similarly unresponsive.

First off, searching the Google Play store for "DHS" or "FOIA" will NOT find the app. If you use both those words together, however, you'll find it at the top of the list. Clicking through brings you to the app's page, which shows that whatever the DHS paid for its development, it's going to be awhile before it ever returns whatever passes for ROI in publicly-funded app giveaways. 10+ downloads. That's hardly a sign of widespread adoption.

Once you click Install, you're given some information that makes no sense. Why would a government app need your location info? The question is unanswered anywhere in the app's notes. Yes, you do need to turn over a certain amount of personal information to file an FOIA request, but the location it's being sent from is irrelevant.

Now, the idea behind the app is a good one. If you're the inquisitive type, ideas for FOIA requests may strike at inopportune moments. Rather than holding onto it until you're in front of a proper computer, you can just fire one off immediately. IN THEORY.

The app doesn't store your personal information (probably a good thing), so this means every FOIA request will require you to type in your name, address, etc. all over again.

The app's shortcomings become apparent immediately. You're given a list of agencies you can request from, but it's far from complete. Most noticeably, the TSA is not on the list of available agencies and there's no option to add other DHS agencies to the list. Presumably, the TSA will be added when (or if) its FOIA system is told to play nice with the DHS app.


As for the actual entry of personal information (the thing you'll be doing EVERY SINGLE TIME YOU USE THE APP), it's a complete travesty. The UI seems to have been created by a person who knows what a fill-in-the-blank form looks like, but has never actually performed the act on anything but paper.

Look closely at this screenshot. I'm currently in the Zip Code field. You know how I know this? Because when I start punching in numbers, it starts filling up the field. There's no blinking cursor to let you know what field you're in. (Nor does it show up when you need to edit something. It only provides the little teardrop indicator underneath wherever it is [approximately] that you tapped the screen.]


The fields themselves are, um... not smart. Not a single field entry triggers uppercase letters, despite almost every field being the sort of information one normally capitalizes.

It gets worse.

Clicking on State gives you a menu of states to choose from. But not 50 of them. Not even a dozen of them. You'd better hope you live in states None-Colorado because there is no way to scroll down the list (it's static) or even manually enter your state's name.


At this point, I gave up. It's not even worth using as a last resort. You'd be better off writing a reminder in a functioning app and using the DHS's website (or a clearinghouse like MuckRock) to do this twice as fast with half the hassle. The fields are unresponsive, your keyboard routinely covers what you're trying to type in, and, for no apparent reason, the government now knows approximately where you last angrily yelled at its terrible app.

I am hoping this app improves over time -- not because I plan to make use of it, but because it will show the agency is actually trying to make its agency more accessible and transparent, rather than just settling for a "Will this do?" app that actually won't do. Not at all. And I guarantee the development of this app costs more than the development of apps with twice the capability and with at least a passing knowledge of common UI features.

Filed Under: app, dhs, foia, homeland security

FBI & Homeland Security Now 0 For 41 In Predicting Imminent Terrorist Attacks On The US

from the why-does-anyone-take-them-seriously dept

I don't have cable. I almost never watch TV. I never see cable news unless someone points me to a clip online. Yet apparently, with the extended holiday weekend this past weekend, cable news went absolutely bonkers with vague, unsubstantiated claims from government officials about how everyone should be on heightened alert for an attack from ISIS:

CNN has led the pack in whipping Americans into a panic over the Isis threat, running story after story with government officials and terrorism industry money-makers hyping the threat, played against the backdrop of scary b-roll of terrorist training camps. Former CIA deputy director Mike Morell ominously told CBS last week that “I wouldn’t be surprised if we weren’t sitting here a week from today talking about an attack over the weekend in the United States.” MSNBC and Fox joined in too, using graphics and maps right out of Stephen Colbert’s satirical “Doom Bunker,” suggesting World War III was just on the verge of reaching America’s shores.

The Morell appearance was particularly ridiculous, with it posting during the episode the following map of "recent ISIS arrests" in the US to emphasize the bullshit claim that ISIS was already in the US and plotting attacks: The problem, of course, is that none of those arrests were really connected to ISIS in any serious way. Nearly all of them were actually plots cooked up by the FBI to trick gullible individuals that they were in on an ISIS plot.

Before the weekend, Adam Johnson put together an astounding list of how Homeland Security and the FBI are 0 for 40 in their last 40 predictions for terrorist attacks inside the US -- raising serious questions about why the news media actually takes any of these "warnings" seriously. And that doesn't even get into the fact that DHS and the FBI have failed to stop actual plots like the Boston bombing. Here's the list that Johnson put together:

October 2001: “Potential use of chemical/biological and/or radiological/nuclear weapons“

November 2001: California bridges

February 2002: “Hollywood studios”

May 2002: Statue of Liberty

June 2002: “Around the Fourth of July holiday”

July 2002: Stadiums

August 2002: “Landmarks”

October 2002: “AQ to attack Amtrak”

November 2002: “Spectacular Al Qaeda attacks”

February 2003: “Apartments, hotels, sports arenas and amusement parks“

May 2003: “Possibility of multiple attacks”

May 2004: “Attempt to affect the outcome” of presidential election

July 2004: “Military facilities and large gatherings” on July 4th

August 2004: VA hospitals

January 2005: Dirty bomb

March 2005: US/Mexican border

October 2005: NYC & Baltimore subways

March 2006: “Sporting events”

June 2007: Colleges

December 2007: “Shopping malls in Chicago and LA”

November 2008: “Al Qaeda to attack transit during Thanksgiving”

November 2010: Mass transit in New York City

October 2011: “Americans in Europe” facing “commando-style AQ attack”

February 2011: “Financial institutions”

May 2011: “Threats of retaliation”

June 2011: Al Qaeda “hit list”

July 2011: “Private jets of executives” involved in drone manufacturing

September 2011: “Small planes”

September 2011: “New York City or Washington around…10th anniversary of 9/11”

September 2011: Airports

March 2012: “Terrorist hacking”

August 2012: Anarchists blowing up bridge during Tampa RNC

September 2012: “Islamic violence over movie”

August 2013: “San Fransisco on high alert”

November 2013: “cyber attacks”

April 2014: “College students abroad”

December 2014: ISIS targeting Mississippi River bridge

December 2014: ISIS “sabotaging US military personnel” over social media

April 2015: ISIS targeting “parts of California”

May 2015: ISIS targeting “military bases”

And now we can add this past weekend, making them 0 for 41.

Johnson highlights three reasons why these warnings still get issued:

1. The FBI has all the incentive in the world to issue warnings and no incentive whatsoever to not issue warnings. Issuing warnings has no downside, while not doing so is all downside.
2. The FBI, like all agencies of the government, does not operate in a political vacuum. Emphasizing the “ISIS threat” at home necessarily helps prop up the broader war effort the FBI’s boss, the president of the United States, must sell to a war-weary public. The incentive is to therefore highlight the smallest threats. This was a feature that did not go unnoticed during the Bush years, but has since fallen out of fashion.
3. It has no actual utility. What does it mean to be “more vigilant”? It’s a vague call to alertness that officials, aside from “beefing up security” by local police, never quite explain what it means. If the FBI wanted to tell local police departments to up their security of the 4th of July weekend, surely they could do so quietly, without the chair of the House Committee on Homeland Security having to go on all major networks talking over b-roll of ISIS in apocalyptic terms.

There's also one other reason which is related to the first reason above, but is slightly different: if there is actually a big terrorist attack (and not one they can wave off), DHS and FBI officials will be hauled before Congress and asked why they didn't spot it or warn about it. So this is, once again, an example of officials wanting to cover their own asses. As we noted recently in explaining why surveillance state defenders don't care that the programs they defend don't work, a lot of the mental calculus involves covering their own asses in the event something bad does happen. No one wants to have to explain that what they did was useless, so they feel the need to "do something." Combine that with the near total lack of downside, and of course, there are going to be random predictions based on nothing.

So the real question, though, is how come cable news feels the need to fall for it too? As Tevor Timm notes, all this really does is help terrorists in "terrorizing" the American public:

All of this doesn’t mean that a terrorist attack on US won’t eventually happen. Simple math tells us that, no matter the precautions taken or the civil liberties taken away, one may get through. But it is a rare event, and one which human beings have lived with throughout our history. By magnifying it and terrifying everyone, we’re only doing the terrorists’ job for them.

And the cable news teams are helping this right along...

Filed Under: cable news, dhs, fbi, fud, homeland security, isis, terror, terror warnings, terrorists

DHS Opening Office In Silicon Valley To More Efficiently Complain To Tech Companies About Encryption

from the we-have-no-solutions-but-we-do-have-plenty-of-talking-points! dept

If only the endlessly-escalating West Coast cost of living could have prevented this:

Today I am pleased to announce that the Department of Homeland Security is also finalizing plans to open up a satellite office in Silicon Valley, to serve as another point of contact with our friends here. We want to strengthen critical relationships in Silicon Valley and ensure that the government and the private sector benefit from each other’s research and development.

That's Jeh Johnson addressing the crowd at the RSA Conference. Of all the news no one wanted to hear, this has to be close to the top of the list. Three-lettered government agencies are pretty much NIMBY as far as the tech world is concerned, especially after Snowden's revelations have seriously and swiftly eroded trust in the government.

No one wants a next-door neighbor who's going to constantly be dropping by for a cup of decryption.

The current course we are on, toward deeper and deeper encryption in response to the demands of the marketplace, is one that presents real challenges for those in law enforcement and national security.

Let me be clear: I understand the importance of what encryption brings to privacy. But, imagine the problems if, well after the advent of the telephone, the warrant authority of the government to investigate crime had extended only to the U.S. mail.

Our inability to access encrypted information poses public safety challenges. In fact, encryption is making it harder for your government to find criminal activity, and potential terrorist activity.

We in government know that a solution to this dilemma must take full account of the privacy rights and expectations of the American public, the state of the technology, and the cybersecurity of American businesses.

We need your help to find the solution.

"Let me be clear: I understand the importance of what doors bring to privacy. But, imagine the problems if, well after humanity moved out of caves, the warrant authority of the government to investigate crime had only extended to dwellings without doors."

Bullshit. The DHS, along with other law enforcement agencies -- is seeking is the path of least resistance. It can get warrants to search encrypted devices. It just may not be able to immediately crack them open and feast on the innards. It may also get court orders to compel decryption. This is far less assured and risks dragging the Fifth Amendment down to the Fourth's level, but it's still an option.

Then there's the option of subpoenaing third parties, like cloud storage services, to find the content that can't be accessed on the phone. So, it's not as though it's locked out forever. This may happen occasionally but it won't suddenly turn law enforcement into a wholly futile pursuit.

Silicon Valley isn't going to help the DHS "find a solution." There isn't one. The DHS may as well get some legislation going and force companies to provide a stupid "good guys only" backdoor because the tech world already knows you can't keep bad guys out with broken encryption. This should be painfully obvious and yet, the "good guy" agencies seem to think tech companies are just holding out on them.

From there, Johnson switches to his most disingenuous rhetorical device: the assertion that Americans are clamoring for an unrealistic level of safety.

I tell audiences that I can build you a perfectly safe city on a hill, but it will constitute a prison.

Who the fuck is asking you to do that? The only people pushing for "perfectly safe" are government agencies who like big budgets and increased power and the private companies that profit from this sort of fearmongering. Most Americans are far more pragmatic and they'd rather keep what's left of their privacy and civil liberties, even if it means the safety of the country is slightly less assured.

And this makes me want to vomit with contempt:

In the name of homeland security, we can build more walls, erect more screening devices, interrogate more people, and make everybody suspicious of each other, but we should not do this at the cost of who we are as a nation of people who cherish privacy and freedom to travel, celebrate our diversity, and who are not afraid.

THAT IS LITERALLY ALL YOU HAVE DONE SINCE 2001.

In the name of "homeland security," we have TSA agents groping people, breaking their luggage, humiliating people with medical issues and stealing personal belongings -- all without ever having prevented a single attempted hijacking or bombing. In the name of "national security," we have indulged every nosy do-gooder with numerous hotlines to report their neighbors' ownership of luggage or cameras or pressure cookers. In the name of the "war on terror," we have a 100-mile buffer zone around the nation's borders that nearly completely eliminates every Constitutional protection.

Jeh Johnson hasn't been in the position long, but he's already descended into inadvertent self-parody. This speech was apparently delivered with complete sincerity, which means Johnson has no idea how his agency is perceived. There are very few people who believe the DHS is some sort of civil liberties champion. Jeh Johnson is obviously one of them.

Filed Under: dhs, encryption, homeland security, jeh johnson, silicon valley

Homeland Security Will Finally Admit To Banned Flyers That They're On The No Fly List

from the sued-into-acting-like-a-responsive-agency dept

Good news has arrived for fliers who'd like to know exactly what the hell is going on when they're forbidden to board an airplane.

The government will no longer refuse to confirm or deny that persons who are prevented from boarding commercial aircraft have been placed on the “No Fly List,” and such persons will have new opportunities to challenge the denial of boarding, the Department of Justice announced yesterday in a court filing.

Thanks to several lawsuits, the DHS is no longer able to Glomar its way out of responding to travelers who suspect they've been blacklisted from flying. This filing addresses Mohamed v. Holder, but builds on revised redress procedures promised in the wake previous lawsuits.

Under the previous redress procedures, individuals who had submitted inquiries to DHS TRIP generally received a letter responding to their inquiry that neither confirmed nor denied their No Fly status. Under the newly revised procedures, a U.S. person who purchases a ticket, is denied boarding at the airport, subsequently applies for redress through DHS TRIP about the denial of boarding, and is on the No Fly List after a redress review, will now receive a letter providing his or her status on the No Fly List and the option to receive and/or submit additional information.

It's a huge step forward from just being told less-than-nothing by the agency's misnamed "Traveler Redress Inquiry Program." The first step has the DHS performing its own "redress review" -- something that appears to have no time limit for responses. And that's the beginning of the process. Members of the public will finally receive better and more detailed responses, but they will asked to perform several rounds of hoop-jumping, with the first couple of steps seemingly redundant.

If such an individual opts to receive and/or submit further information after receiving this initial response, DHS TRIP will provide a second, more detailed response. This second letter will identify the specific criterion under which the individual has been placed on the No Fly List and will include an unclassified summary of information supporting the individual’s No Fly List status, to the extent feasible, consistent with the national security and law enforcement interests at stake.

Other than "because we're a bureaucracy," there doesn't seem to be any reason full details could not be provided in a single letter. But that's the government for you: if it's not killing trees and utilizing its underused postal service, it's not being productive. Why do in one step what can be done in several (also: in triplicate, if possible), etc.

Even with these redress improvements, some travelers will still receive answers containing little to no information or guidance.

The amount and type of information provided will vary on a case-by-case basis, depending on the facts and circumstances. In some circumstances, an unclassified summary may not be able to be provided when the national security and law enforcement interests at stake are taken into account.

On the upside, the DHS will actually allow this to be a bit more adversarial. Travelers will be able to submit responses to the DHS's initial No Fly List determination and submit information that might prompt a reconsideration of their inclusion on this list. The final decision is still the government's but at least it's open to basing its decision on more than its own security-first worldview and limited, supposedly inculpatory data.

Filed Under: dhs, glomar, homeland security, no fly list, transparency

TSA Agents Outwitted By Cory Doctorow's Unlocked, 'TSA-Safe' Suitcase

from the the-skies-won't-be-safe-until-every-checked-bag-has-been-destroyed dept

Prior to the 9//11 attacks, you only had to worry about airport baggage handlers beating the hell out of your luggage or stealing your valuables. Thanks to the post-attack panic, there's a new layer of ineptitude and deceit your luggage is subjected to on its way to its destination (which may not be your destination).

Boing Boing's Cory Doctorow (or rather, his luggage) was recently subjected to the brutish charms of the Transportation Security Administration.

[T]he TSA still routinely and unaccountably destroys luggage equipped with "TSA-safe" locks, just because they can. Last week, TSA inspectors at Phoenix's Sky Harbor airport pried the locks off of my unlocked, "TSA-safe" suitcase before taping it shut again and loading it onto my London-bound flight.

Here's what Doctorow's luggage looked like after the "TSA-safe" locking mechanism outmaneuvered the TSA agent in charge of crowbar-wielding and packaging tape application.


This appears to be the luggage Doctorow "submitted" to the TSA (although Doctorow's is possibly an earlier iteration), which then handled it with all the grace and skill of two male supermodels trying to retrieve files from a computer.


The TSA should have had no trouble unlocking the suitcase (using keys, rather than physically attacking it). Rimowa's site states that its luggage features "TSA combination locks."


Bypassing it with a master key was the option the TSA was supposed to use. Instead, it just forced it open, taped it back together and handed it back to Doctorow without even a shrug of bureaucratic regret.

It did, however, respond to his legitimate complaint. If you can call it a response. First, it loads up on disclaimers. (Doctorow's interjections are bracketed.)

Thank you for contacting the Transportation Security Administration (TSA) Contact Center regarding damaged or missing checked baggage locks.

TSA is required by law to screen all property that goes onboard commercial passenger airlines, including checked baggage. To ensure the security of the traveling public, it is sometimes necessary for Transportation Security Officers (TSOs) to inspect checked baggage by hand. Locked checked baggage [[MY BAG WAS UNLOCKED]] may cause delays due to the need for TSOs to open locked baggage by using alternative measures, including force. Please be advised that TSA is not liable for any damage to locks or bags that are required to be opened by force for security purposes. [[HOW CONVENIENT – WHY NOT?]]

Yes. The agency takes no responsibility for breaking something that was a.) unlocked and b.) even if it wasn't, had passkeys it could have used. It inexplicably mentions this unused option while explaining why it manhandled Doctorow's luggage like the world's most inept burglar.

In cooperation with private industry, TSA implemented a system under which TSOs are able to identify, unlock, and then relock certain locks using passkey sets available to TSA screeners [[AND ANYONE WITH HALF A BRAIN AND A BIT OF GUMPTION]]. TSA-recognized locks can be opened and relocked by TSOs without force and with little delay. TSA cannot, [[WHY THIS COMMA?]] guarantee that such locks will never be damaged or lost while TSOs and airline employees handle checked baggage [[HOW CONVENIENT]].

On top of being unable to perform its job without destroying luggage, the TSA is apparently unaware that URLs can be copied and pasted, rather than carelessly typed into a response email for maximum ineffectiveness.

To learn more about damaged locks, please visit www.tsa.gov\node\1428.

Just try to do what the TSA didn't and paste that not-a-URL-at-all into an omnibox. (Well, it will be automatically converted into a real URL, but that's only because web browsers are smarter than TSA Customer Service agents.) Doctorow says this indicates some sort of DOS mindset, which is its only level of scary.

So, to recap: the TSA can break your stuff, despite having the tools to do otherwise and despite having a number of luggage manufacturers specifically making passkey-compliant suitcases to prevent this sort of thing from happening and despite the suitcase being UNLOCKED THE WHOLE TIME. And the traveler's path of recourse is a mistyped URL surrounded by "not our fault" boilerplate.

The TSA will never have to pay for broken luggage. Because terrorism.

I miss the good old days when this sort of behavior was only displayed by baggage handlers searching for valuables/setting distance records in amateur luggage-tossing competitions. At least then you could find someone to hold accountable for the damage sustained.

The TSA, however, is above even the most minimal level of accountability. If its employees are outsmarted by a "TSA-safe" lock, it's your fault for not ensuring your checked luggage was already open and dumping its contents all over the conveyor belts by the time it reached the TSA's elite group of suitcase-battering counterterrorists. This entire situation (especially the TSA's "response") cleary shows that Doctorow is the guilty party here. If he truly loved America, he'd have prepared for this eventuality… or at least just taken back the taped-together remains of his $1000 suitcase and shed a tear of gratitude for all the hard work the TSA did to ensure his flight didn't get blown up/hijacked.

Filed Under: cory doctorow, homeland security, locks, luggage, tsa

DHS Takes Another Stab At License Plate Database, But This Time With More Privacy Protections And Transparency

from the it-can-be-taught dept

About a year ago, the DHS -- seemingly completely oblivious to the fact that domestic surveillance programs were being collectively frowned upon in the wake of the Snowden leaks -- began soliciting quotes on a nationwide license plate reader database. Within a week, DHS head Jeh Johnson had shut down the plan, claiming the rogue solicitation had somehow escaped into the wild without a proper official approval and had nothing to do with the backlash it had generated upon discovery.

Not that the disappearance of this solicitation changed anything. The DHS (and ICE) already have access to the many ALPR databases maintained by a variety of private companies. All this would have done was provide the DHS with estimates on subscription fees and perhaps some help on developing a DHS/ICE-specific front end for access.

Nearly a year past the mini-debacle and the DHS is back in the license plate database business. This solicitation, however, is far more specific than last year's botched attempt. (via The Hill)

Immigration and Customs Enforcement (ICE) intends to issue a solicitation to obtain query-based access to a commercially available License Plate Reader (LPR) database.

ICE seems far more interested than usual in alleviating any concerns that this will be yet another domestic surveillance program.

ICE is neither seeking to build nor contribute to a national public or private LPR database. ICE will use LPR information obtained in response to queries of the commercial database to further its immigration enforcement missions. ICE law enforcement personnel will query the LPR database using known license plate numbers associated with the aliens who are immigration enforcement priorities, based on investigative leads, to determine where and when the vehicle has travelled within a specified period of time. The results of the queries can assist in identifying the location of aliens who are immigration enforcement priorities, to include aliens with certain criminal convictions, absconders, illegal re-entrants and those that pose a public safety or national security risk.

Rather than build new databases and grant open access to ICE agents, the agency is only looking to search known plate numbers. While this end will remain targeted, it doesn't do anything limit the collection efforts. Vigilant -- the largest ALPR provider -- claims to be adding more nearly 100 million plate/location records every month. The only thing "limited" about this plan is DHS's access. And even that may not be as limited as the previous paragraph implies.

ICE will also use LPR information obtained from the commercial database to further its criminal law enforcement mission, which includes investigations related to national security, illegal arms exports, financial crimes, commercial fraud, human trafficking, narcotics smuggling, child pornography, and immigration fraud.

So, it's not just immigration and customs enforcement. It's pretty much everything the ICE thinks it should have an active part in.

To its credit, it has at least compiled a Privacy Impact Assessment ahead of its ALPR database plans, rather than allow this to trail implementation by months or years. But within this assessment are hints that ICE's access won't be quite as limited as its earlier statement implies. For one, ICE already operates its own LPR cameras, so it won't solely be making use of preexisting data. It also has no controls in place to limit access when working with outside law enforcement agencies and using their access to LPR databases.

There are indications that the DHS and ICE are attempting to keep this access from being exploited or abused. The assessment notes that agents will be informed (and reminded) that a license plate "hit' cannot be the "sole basis" for law enforcement action. But the limits it's imposing on itself are still a bit too flexible. Plate info will only be allowed to be accessed for a "limited" amount of time, but that "limited" time frame is partly tied to the statute of limitations for the underlying crime. In most cases, the assessment notes, ICE agents will be able to access five years of historical plate/location data -- which it notes is approximately the average amount of time a person owns a particular vehicle.

The assessment also notes that the "Alert List" must be frequently updated to remove plates tied to closed investigations or when a person [but a license plate isn't a person?] is no longer a suspect. While some agents will be more proactive than others, the assessment only suggests an update be performed "at least annually."

The better news is that the DHS and ICE are making moves towards greater transparency, as well as demanding the winning vendor provide "robust audit trails" on any agency database use. Of course, a "robust audit trail" is only as good as the consequences for misuse, and the government in general has never been big on meaningful enforcement of its internal policies. Unfortunately, that's really the only thing preventing this targeted access from becoming the "unwarranted surveillance" the agency's Privacy Impact Assessment claims it's trying to avoid.

That being said, getting out ahead of the program with an impact assessment is almost unheard of in the law enforcement/intelligence field, so the DHS deserves some credit for realizing its past effort in this area was badly mishandled.

Filed Under: alpr, database, dhs, homeland security, license plates, privacy

Lawsuit Over DHS First Amendment-Violating Suspicious Activity Reports Given Green Light By Judge

from the Get-a-job,-terrorist! dept

Say what you will about the internet, but the nation's best conspiracy theorists are employed by the US government. A case involving five individuals who ended up in DHS Suspicious Activity Reports (SARs) is being allowed to move forward. What's remarkable about the lawsuit's allegations is how little it takes to find yourself on the receiving end of extra surveillance and attention.

At the heart of the lawsuit are the SARs themselves -- the paperwork generated with the assistance of "see something, say something" tips from civilians, anything law enforcement/security guards consider to be a "bit off," and the many scattered DHS Fusion Centers' desire to appear useful and fundable.

Case in point: California resident Wiley Gill.

Lead plaintiff Wiley Gill is a white man who converted to Islam as a student at California State University, Chico, and he drew the attention of the Chico Police Department in May 2012. (Chico is about 180 miles due north of San Francisco.) According to the SAR about Gill, the officer entered Gill’s residence in response to an apparent domestic violence incident (Gill was home alone). The officer then saw on a webpage “titled something similar to ‘Games that fly under the radar’" on Gill’s computer.

"Coupled with the fact he is unemployed, appears to shun law enforcement contact, has potential access to flight simulators via the Internet which he tried to minimize is worthy of note," the SAR, entitled "Suspicious Male Subject in Possession of Flight Simulator Game," concludes.

Unemployed. Doesn't hang out with cops. Plays games and uses the internet. All inherently suspicious because of this tenuous thread: the 9/11 terrorists used flight simulators to train for their attacks. (The SAR guidelines warn that "acquisition of expertise" related to "aviation activity" is suspicious enough to be awarded a capital "S.") Had the Chico Police Dept. bothered to toss a little respect the Fourth Amendment's way, Gill would likely be nothing more than just some guy looking for a job rather than currently involved in a federal civil rights lawsuit over government surveillance.

This tiny bit of unrelated "data" was gathered by the Chico PD, which entered Gill's residence without a warrant or his consent. According to the lawsuit filed by the ACLU, the "domestic violence call" that predicated the search of Gill's residence was likely bogus and only used as justification to search a residence the CPD planned to search anyway. For the better part of two years, Gill had several previous "interactions" with Chico police officers, almost all of them based solely on his appearance ("full beard and traditional garb," "pious demeanor") and religious activities.

Gill did nothing more than "look Muslim" and play videogames. Other plaintiffs did little more than commit photography.

Internationally-renowned photographer (and former Sara Lee/Levi's executive), James Prigoff, became the subject of a Suspicious Activity Report for trying to take photographs of something that has been previously photographed hundreds of times without incident: the "Rainbow Swash" painting that adorns a Boston oil refinery's storage tank. Prigoff was approached by the company's security guards and told he couldn't photograph the oft-photographed storage tank. Despite leaving and providing no contact information, Prigoff was visited by a member of the FBI's Joint Terrorism Task Force shortly after returning to his home in Sacramento.

Plaintiff Aaron Conklin, a graphic design student, was approached by sheriff's deputies while photographing a refinery. He was told he would be put on a "NSA watchlist."

Sometimes, all it takes to appear suspicious enough to report is to stay in the same area for an indeterminate amount of time. Another plaintiff, Tariq Razak, was described by the reporting agency as "surveying entry/exit points" of the Santa Ana Train Depot before leaving with a woman wearing "a white burka head dress." In reality, he was really waiting for mother ("white burka"), who was using the restroom.

Sometimes just doing your job can put you on a watchlist.

Khaled Ibrahim is a U.S. citizen of Egyptian descent who works for a computer network consulting and service company in Silicon Valley, California. Mr. Ibrahim is the subject of a SAR that the ACLU of Northern California obtained through a Public Records Act request. The SAR describes a “[s]uspicious attempt to purchase large number of computers.” Mr. Ibrahim had attempted to make a bulk purchase of computers from Best Buy in his capacity as a purchasing agent for his company.

The government's ideas of what might be terrorist-related activity continues to expand. And even as the DHS plumbs the depths of absurdity with its SARs, the real terrorists remain unaffected. As the ACLU notes in its lawsuit on behalf of the five plaintiffs, the GAO itself has called the program worthless, noting that it has produced nothing in the way of "results-oriented outcomes" (arrests, indictments, thwarted attacks) but has done plenty of damage to Americans' civil liberties.

But the DHS clearly wants to continue violating rights while producing no results. The government moved to dismiss this lawsuit, claiming none of the plaintiffs can prove a "legally cognizable injury" and attempted to put the blame back on the shoulders of local law enforcement agencies. This didn't sit well with Judge Richard Seeborg.

Defendants primarily frame their challenge to plaintiffs’ standing as a purported failure to allege facts showing causation and redressability. Defendants’ argument characterizes plaintiffs’ supposed injuries as arising, if at all, primarily from the actions of the “front line” state and local law enforcement authorities. Defendants contend plaintiffs have not alleged, and credibly cannot, that the scrutiny they purportedly received from state and local police, or even from private security personnel, was the result of the challenged protocols or other conduct of defendants.

The allegations of the complaint, however, show that the gravamen of the alleged injuries lie not in actions of “front line” authorities standing alone, but in the fact that those authorities, pursuant to the guidance and training provided by defendants, submit SAR reports under criteria and circumstances that are allegedly inconsistent with legal principles and policies embodied in other law. Plaintiffs’ cognizable challenge is not to the conduct of law enforcement or private security officers during the alleged encounters per se, although there is at least some implication that plaintiffs believe Defendants’ Standards lead front line personnel to overreach even at the point of making initial observations. Plaintiffs are claiming injury from what occurs AFTER the encounters, pursuant to the Standards. As such, defendants’ contentions as to causality and redressability both fail.

The harms plaintiffs seek to remedy arise directly from the existence of Defendants’ Standards. If plaintiffs can show those standards violate the APA, they will be declared invalid.

While invoking causality and redressability as the main purported shortcomings of plaintiffs’ standing, defendants also imply that merely being the subject of an SAR, in the national database, should not be deemed a cognizable injury. In light of the privacy and reputational interests involved, however, this argument is not tenable.

The lawsuit will move forward, dragging along with it the tattered reputation of the DHS and its GAO-condemned "Fusion Centers." When it takes little more than a religious belief and a browser window containing details on flight sim software to raise someone to the level of "terrorist," the underlying system is not only broken, but swiftly becoming an easy-to-use tool for racial and religious profiling. And when the fear of terrorist attacks is used as a crutch to shut down First Amendment activity, the government itself has gone as far off the rails as those who remain convinced the 9/11 attacks were an inside job. They both gather around the same rally point -- the smoking ruins of a terrorist attack -- and see nothing in their fellow citizens but enemies on the verge of violence.

Filed Under: dhs, first amendment, homeland security, sars, suspicious activity reports, wiley gill
Companies: aclu