FBI Arrests Two Suspects Involved With Hacking Of CIA Director's Personal Email Account

from the hack-the-CIA-and-FBI,-but-keep-chatlogs-and-use-Twitter-DMs-because-?? dept

The alleged hackers who social engineered their way into CIA director John Brennan's personal email account have been rounded up by the FBI. The so-called "Crackas With Attitude" collective lost two of its members to the federal court system late last week.

Andrew Otto Boggs, 22, who allegedly used the handle Incursio, or IncursioSubter, and Justin Gray Liverman, who is suspected of using the moniker D3f4ult, were arrested on Thursday, according to a press release by the US State’s Attorney’s Office in the Eastern District of Virginia.

The affidavit [PDF] in support of the arrest warrant is a hell of a read -- although possibly a very trying read for those with limited patience for txt spk and l33t h4x0r screen names. It's also a cautionary tale of hubris winning out over operational security, somewhat ironic for a group of hackers who took obvious glee in pointing out how terrible everyone else's security is.

The group made heavy use of social media, and in particular Twitter, to spread news of the dumps and mock victims. However, according to the affidavit, Boggs allegedly connected to one of the implicated Twitter accounts (@GenuinelySpooky) from an IP address registered to his father, with whom Boggs lived.

Much the same mistake led to Liverman’s identification: an IP address used to access the Twitter handle @_D3F4ULT and another account during the relevant time period was registered to an Edith Liverman. According to the affidavit, publicly available information revealed that Justin Liverman lived with Edith at the time.

The affidavit also includes several sets of Twitter direct messages between members of the group.

Also uncovered during the investigation were stored chat logs and screen recordings of the hackers in action.

Possibly of use in connecting the dots for the FBI was one of the accused's (supposed) participation in the Pentagon's bug bounty program -- something he would have had to sign up for using verifiable information.

Justin Liverman, who goes by the handle “D3F4ULT,” according to a press release by the US Attorneys Office for the Eastern District of Virginia, states on his LinkedIn page that he participated in the HackThePentagon program.

Or not...

HackerOne would not confirm or deny whether Liverman participated in its HackThePentagon program. However, requirements for gaining clearance to submit to the bounty were lax. To qualify, hackers had to be US persons and couldn’t appear on the US Treasury Department’s Specially Designated Nationals list of people and organizations engaged in terrorism, drug trafficking and other crimes, according to a Department of Defense press release.

Tough to verify when the person in question spent nearly as much time shit-posting as hacking. All in all, CWA seemed to be a fun, if not overly-cautious bunch that truly enjoyed worming their way into the inner computing spaces of high-ranking government officials.

However, this does not mean the group was mostly harmless. The affidavit shows the arrestees allegedly engaged in nastier activities as well.

Liverman also allegedly used a phone number linked to the @_D3F4ULT account to call one of the unnamed victims, and even recorded himself paying for a phone-bombing service to bombard the target’s device with calls.

The affidavit contains one of the hackers stating another sent a victim's phone "720 voicemail threats and like a thousand goatse sms image messages."

Also from the affidavit, a little IM action about calling in a bomb threat at a local law enforcement office.

Meanwhile, those remaining are claiming two things: that there are more hackers still on the loose. And that the FBI has the wrong guy… in all senses of the word.

Zoom claimed to have been raided earlier this year, but said he hasn't been arrested nor charged yet. The hacker also claimed that the FBI got the wrong person arresting Boggs because Incursio was actually a woman.

“Its not like this isn't the first time the FBI has been confused,“ Zoom said.

If nothing else, the CWA hackings proved government agencies like the DHS and FBI must not be able to hear themselves talk when they demand more data on Americans, despite not being able to secure the information they already have from 16-year-old hackers who go by the name of "penis" on Twitter. Their efforts also made it clear that most cell phone service providers' authentication processes have miles to go before they even approach "competent."

Filed Under: andrew boggs, cia, crackas with attitude, email, hacking, jon brennan, justin liverman

Colin Powell's Email To Clinton About Personal Devices Shows Routing Around FOIA Is Business As Usual

from the the-public:-worst-thing-to-happen-to-gov't-since-ever dept

Briefly noted in an earlier article about the FBI's investigation into Hillary Clinton's personal email server was the existence of communications that pointed towards FOIA-dodging as a possible factor in her decision to set this up.

Emails released earlier had hinted at this. The FBI's investigation documents contained part of an email from Colin Powell warning her that if it became public Clinton was using a personal BlackBerry, any communications on that device could become subject to FOIA requests. Powell also pointed out that he had routed around this during his years at the State Department by "not saying much" and "not using systems that captured the data."

So, it's not as though government officials need much help from people like Matt Yglesias in keeping more communications related to government work hidden from the public. They've always had plenty of options and appear to be keenly aware of which systems feed into FOIA-able areas.

The full email has now been released (h/t Rebecca Shabad and Steve Ragan) and the contents make it clear Powell had ways of routing around FOIA requirements while heading up the State Department. This appears to be the information Clinton was seeking -- how to avoid having to use the systems the State Department already had or being blocked from using her personal BlackBerry while in office.

Clinton had noticed Powell used a personal BlackBerry and wanted to know what restrictions he ran into and whether he was allowed to use it while "on site" during his tenure as Secretary of State. She added that she was trying to "bring along" the State Department, presumably towards the private email server/personal device future Clinton envisioned.

Powell's response begins with him pointing out he didn't use a Blackberry for stuff he wanted to keep off the FOIA radar. He used his own computer.

I didn't have a BlackBerry. What I did do was have a personal computer that was hooked up to a private phone line (sounds ancient.) So I could communicate with a wide range of friends directly without it going through the State Department servers. I even used it to do business with some foreign leaders and some of the senior folks in the Department on their personal email accounts.

On one hand, Powell wanted to keep some communications (those with "friends") private, which is understandable. On the other, he clearly states he conducted official business with his private device -- including communications with other State Department officials, who were using their own personal email accounts.

It's not just a Powell thing or a Clinton thing. It's a government thing. Many government officials utilize personal devices and accounts. Many of them get away with it. Many government officials say nice things about transparency, too -- all the while creating a stockpile of "public" documents the public never gets a chance to see, much less know exists.

The full statement -- which was partially quoted in the FBI investigation documents -- shows routing around FOIA requirements, record preservation policies, and government accountability ideals comes as naturally to government officials as board of directors' positions at favored corporations following retirement from the public sector. After discussing the issues he had with State Department security, the NSA, CIA, etc. about the supposed threat personal devices posed to government security, Powell notes the real threat is… the public.

However, there is a real danger. If it is public that you have a BlackBerry and it it government and you are using it, government or not, to do business, it may become an official record and subject to the law. Reading about the President's BB rules this morning, it sounds like it won't be as useful as it used to be. Be very careful. I got around it all by not saying much and not using systems that captured the data.

Powell has since defended this email by saying he wasn't attempting to influence her on how to handle potentially FOIA-able communications while running the State Department. Powell backs up this assertion by pointing out Hillary Clinton said his email didn't influence her decision to use private email accounts, private devices, and a private server to handle State Department communications. So, I guess that's all wrapped up and nothing more to see here. [eyeroll]

It's impossible to tell if this conversation was supposed to evade FOIA requirements as well. Powell's email address is redacted, but Clinton's is still exposed. As of the date this was sent (February 2009), Clinton had been a Senator for nearly a decade. The email account used, however, was an AT&T address linked to her personal BlackBerry -- which would suggest personal devices/email accounts had been standard operating procedure for quite some time.

Also of note is this fact -- pointed out by one-man FOIA wrecking crew Jason Leopold: this "new" revelation of Powell's "How To Beat the State Department and the Public at Their Own Transparency Game" advice is actually about three years old. Apparently, Powell detailed his accountability-skirting measures in his 2012 book titled (no shit) "It Worked for Me."

Filed Under: colin powell, email, foia, hillary clinton, security

FBI Publishes Clinton Email Investigation Documents; More Bad News On Documents Mishandling, FOIA Compliance

from the nothing-in-here-says-I-should-be-trusted-with-MORE-classified-info dept

The FBI generally likes to keep as much information as possible out of the public's hands, so its decision to release its files on the Hillary Clinton email investigation are probably best viewed as a one-off, rather than the leading edge of a new era of transparency.

The agency certainly couldn't pretend there isn't significant public interest in the content of the investigative files. The outcome of a presidential election could very well hinge on the voting public's interpretation of the documents' content.

And the FBI certainly has an interest in clearing the air of any hints of politically-motivated favoritism. That the investigation occurred at all does some damage to Clinton's credibility, while the decision not to pursue prosecution doesn't do much for the FBI's.

A closer look at the investigative documents simply gives more credence to the FBI's assertion that it found evidence of stupidity, but not criminal intent. At worst, the private email server allowed Hillary Clinton to better avoid FOIA requests (an effect now nullified by the State Department's ongoing release of nearly every email it's been able to recover) -- something that's a civil violation, rather than a criminal one. From the Washington Post's Matt Zapotosky and Rosalind Helderman's dive into the FBI's docs: [PDF vol. 1, PDF vol. 2]

Clinton told the FBI that she used the private server for convenience, not to evade public record laws. But the documents show that former secretary of state Colin Powell appeared to advise her early in her term that private email could give her more control over her communications in the face of public inquiries.

In January 2009, according to the FBI, Clinton contacted Powell, who also used a personal email account during his time in office, to ask about his use of a BlackBerry. According to the FBI, Powell “warned Clinton that if it became ‘public’ that Clinton had a BlackBerry, and she used it to ‘do business,’ her e-mails could become ‘official record[s] and subject to the law.’”

“Be very careful,” Powell advised Clinton, according to the FBI. “I got around it all by not saying much and not using systems that captured the data.”

Clinton's defense of her private email server was that she was using it for convenience and figured any public records requirements were being met by third-party recipients using official government email accounts. Supposedly, this indicates she wasn't trying to duck FOIA requests. However, this explanation doesn't really mesh with her decision to give staffers email addresses on her private server. Once that happened, there were no third parties preserving records. It was all left up to Clinton. Plenty of efforts were made -- deletion, destruction of devices, etc. -- to purge emails that possibly should have been preserved as public records.

The only criminal issue would have been the mishandling of sensitive information, something Clinton did regularly. But the FBI found no evidence of maliciousness. Just a surprising amount of stupidity from someone who should have known better.

Clinton told FBI agents that she did not know much about how the government classified information. For instance, she said she did not pay attention to the difference between levels of classification, like “top secret” and “secret,” indicating she took “all classified information seriously.” When shown an email she received in which a paragraph had been marked with a “C,” a standard way of indicating it included “confidential” information, Clinton at first speculated to agents that the marking was indicating that email contained bullet points in alphabetical order.

Clinton may have pled ignorance when questioned by the FBI, but these statements directly contradict assertions she made to reporters on Monday:

“I went into the State Department understanding classification. I’ve been on the Senate Armed Services Committee for years before I was Secretary of State. I take classification seriously. The fact I couldn’t remember certain meetings, whether or not they had occurred, doesn’t in any way affect the treatment I had and still have of classified material.”

Clinton says she "understands" classification -- certainly a much different self-assessment than she presented to FBI interviewers. She then says nothing "affects the treatment" of sensitive material. She always handled it "seriously." I certainly hope that word isn't meant to define actions like these:

The FBI’s report traced the history of Clinton’s private server use, detailing ad hoc efforts to backup data and respond to requests for records. In one instance, after Clinton left office, someone created a personal Gmail account to move an archive of Clinton’s email on a laptop to a server run by Platte River Networks, a company Clinton had hired. The person then attempted to ship the laptop back to another person connected to Clinton.

According the FBI report, the laptop, which had not been wiped, got lost in transit. And the FBI would come to find on the Gmail account dozens of classified emails.

While Hillary Clinton may not be directly responsible for a laptop full of email (some of them sensitive) being lost in transit, it was her decision to cobble together a personal email server that led to this mishap. Additionally, while the FBI may not have found any evidence of breach by malicious entities, the private server undoubtedly made an attractive target. With Clinton in sole control of her end of official communications, any breach may have either gone unnoticed or undisclosed for far longer than a similar attack on government-owned servers. This is just another way Clinton sacrificed accountability for "simplicity" by setting up her own server.

The denials contained in the FBI report are expected. No one in a similar position is going to admit they set up a personal server to route around FOIA requests and/or more restrictive official government policies. Even if that's not criminal activity, it's still a bad look for a presidential candidate. More concerning is Clinton's blase attitude towards handling sensitive information, something she'll be seeing even more of if elected.

Filed Under: email, foia, hillary clinton

If You're Learning About It From Slate, Running Your Own Email Server Is A Horrendously Bad Idea

from the don't-do-this dept

So, Slate has a weird article by Nat Meysenburg suggesting that everyday people should run their own email servers. He admits up front that he doesn't think Hillary Clinton should have run her own email server, but for lots of other people he declares it to be "a good idea."

For years, I’ve been trying to convince people that there is value in having an email server in your closet. But few seemed to really get it, so I often found myself wishing for a high-profile example to illustrate why it is a good idea. That wish has, in a way, come true: The casual news consumer has had the pleasure of hearing about a “private email server” quite a lot over the past year.

Except, beyond that, he's basically wrong. Yes, if you're really technologically savvy and want to do it, you can absolutely run your own email server. Though, honestly, it's probably going to be kind of a pain, because you'll need to constantly be patching it and protecting it, and even then it will probably be significantly less secure than if you use an online provider. Meysenberg is right on only one point, barely, and it's that if you run your own email server, and the government wants to get access to it, at least you'll know about it:

When your emails reside on a cloud provider’s server, the owners of that server are ultimately who decide when to let the government, or any other party, access those emails. In the case of your work’s server, those choices are made by your employer. In the case of Gmail (or any other cloud provider), this choice is typically made by the company’s legal team, based on its evaluation of the government’s demands. Most of the big companies, including Google, do have a policy of notifying users about demands before they hand over the requested data, which would give you an opportunity to assert your rights in court. However, there are many cases in which the government’s demand will be accompanied by a gag order forbidding the company from providing that notice.

And, thus, he notes:

Having a private server in your home side steps these uncertainties. At home you as a private individual have the ability determine who has access to your email inbox—just like you have a right to determine who has access to that box of old love letters from high school. By owning the server, all requests for data have to go through you (and/or your lawyers), and any confiscation of the physical hard drives on which your emails are stored requires a search warrant for your home. And unlike with email stored in the cloud, it will always be obvious if and when the police seize your email server.

But, of course, none of that stops the government from getting your server if they want it... it's just that in this one case you'll know about it.

And for what tradeoff? Well, there are some pretty big ones. If you're not particularly skilled and experienced with online security issues, your personal email server is almost certainly significantly less secure than the big companies that have strong security teams and are constantly making it stronger and on the lookout for attacks. If you're that good, you're not learning about the issue of hosting your own email server for the first time in... Slate.

The article insists that it's a myth that running your own server is a security nightmare, but I've yet to see an online security expert who agrees with that even remotely. Even the comments to the Slate piece are filled with IT folks screaming about what a bad idea this is.

In the end, this seems to be an issue of tradeoffs and skills. If you're quite skilled with online security and you think the government might want secret access to your email, then maybe in some limited cases, it might make more sense for you to run your own server -- though, even then you're exposing yourself to being hacked by the government too, because, you know, they do that kind of thing also in some cases. Otherwise, you're almost certainly opening yourself up to a home IT nightmare and a lot more trouble than it's worth for significantly less security.

In short, even if you're not Hillary Clinton, running your own email server is a bad idea. And if you're just now getting the idea from Slate... then it's a really bad idea.

Filed Under: email, email server, privacy, security, warrants

Will DNC Email Hacking Make Legislators More Friendly To Encryption?

from the Betteridge-says... dept

Kashmir Hill is asking an interesting question over at Fusion: in the wake of Democratic National Committee email hacking, will political leaders start scaling back their war on encryption?

Some prominent Democrats have demonized end-to-end encryption, the kind that might have helped lesson the impact of this hack by making emails look like gibberish to anyone without a key. It’s only readable when a person on one end of the communication opens the email, excluding the company storing the exchange, a hacker, and law enforcement.

Senator Dianne Feinstein (D-Calif.) has led the charge on a bill that would make end-to-end encryption illegal, requiring companies be able to decrypt data if served with a court order. Hillary Clinton herself has pushed for breakable encryption, claiming that, “Otherwise, law enforcement is blind—blind before, blind during, and, unfortunately, in many instances, blind after.”

Using end-to-end encryption would have prevented attackers from accessing the content of most of the emails they obtained. It wouldn't have prevented any content from being accessed, but would have greatly mitigated the damage.

Unfortunately, there's a very good chance the wrong lessons will be learned from this experience.

While it would seem obvious that the best way forward would be to encourage the use of strong encryption for everyone, it's far more likely legislators and presidential candidates will continue to try to carve holes for law enforcement access and expand government powers to "hack back" or perform preemptive attacks. The proposed Rule 41 changes will likely slide on through at the end of this year, allowing the FBI to break into computers all over the world.

Another solution suggested by Hill is to move government communications to private platforms like Gmail where end-to-end encryption can be implemented and, more importantly, handled by professionals rather than, say, a bunch of lawyers with access to the spare bedroom.

Government officials may be wary of allowing private companies to handle (and store) government communications, but the public should be just as wary of any government agency that makes a private company its official communications platform. Private platforms used for public business tend to create lots of unnecessary FOIA litigation. Without legislation in place, or additional stipulations added to contracts with private entities, government agencies will not only be able to keep malicious hackers at bay, but also pesky members of the public demanding access to officials' communications.

The worst end result may also be the one most likely to occur. The security of some communications may become more equal than others. Law enforcement backdoors for the public. Secure end-to-end encryption for their representatives. The sort of hybrid approach to legislating we see far too often -- whether it's in response to Congressional insider trading or the numerous buffers placed between law enforcement officers and any form of accountability.

Filed Under: dnc, email, encryption, hacking

Mayor Who Sued His Own City Over A Public Records Request Ordered To Turn Over Official Emails Stashed In A Private Account

from the give-it-up dept

Nearly one year to the date from Sacramento mayor Kevin Johnson's filing of a lawsuit against his own city and a local journalist to block the release of emails from his personal Gmail account, a judge has ordered him to turn over most of the emails he's been fighting to withhold.

[T]his past Friday, Krueger ruled that Johnson and the city must make public 79 of the remaining 113 emails and records. Ballard Spahr, the firm that represents the mayor pro bono, needs to turn them over by July 18.

Johnson had long argued that emails from his personal account weren't subject to public records laws -- even those in which government business was discussed. And, indeed, the city has no policy in place preventing officials from using personal email accounts to conduct official business. However, that's not the same thing as saying these emails can't be obtained with public records requests.

When that argument failed to keep the emails from being released, Johnson's lawyer raised the good old "attorney-client privilege" as a shield against public disclosure. Judge Krueger shot that down as well.

During the hearing, Humphreys was steadfast in his lobbying to keep some of the records secret. He contested that, since Ballard Spahr had reviewed firsthand many of the emails and attachments in question, they were clearly protected from disclosure because of “attorney-client privilege”—a phrase he repeated ad nauseam.

Eventually, Krueger schooled him on the law. “Every document that an attorney has seen does not fall under attorney-client privilege,” the judge explained—adding that this was legal fact no matter how many times Humphreys made a “talismanic recitation of those words.”

In the end, it's a win for the Sacramento News & Review, which was one the parties named in Mayor Johnson's email-blocking lawsuit. Given the nature of the disputed emails, it's easy to see why Johnson wanted to keep them out of the public's hands. Many of the communications cover Johnson's takeover of the National Conference of Black Mayors -- a leadership position he held tenuously, briefly, and under a considerable amount of criticism.

Johnson's 2015 attempt to obtain an injunction against his own city followed his admission that he had destroyed several public records (in this case, text messages) responsive to requests pertaining to the city's $500 million sports arena.

Even though this legal battle has pried loose a few hundred emails over the past year, it's still only a small percentage of Mayor Johnson's "official business" communications safely stashed away in his personal account.

“We’ve been fighting in court for a year over a small batch of records that ended up in the hands of the City Attorney,” Garvin wrote. “The much bigger problem is the thousands and thousands of emails that Johnson has refused to turn over, which were generated by his OMKJ email accounts.”

Politicians are particularly adept at keeping their communications away from the public. Kevin Johnson is the rule, rather than the exception. Fortunately, the lack of internal policies forbidding this activity isn't preventing courts from finding responsive communications have been improperly withheld. But these findings come at a great expense for public records requesters -- many of which will abandon their requests rather than spend thousands of dollars in legal fees to obtain documents that rightfully belong to the public.

Filed Under: email, foia, kevin johnson, mayor, personal emails, scaramento

Huge Win: Court Says Microsoft Does Not Need To Respond To US Warrant For Overseas Data

from the big-news dept

We've been following an important case for the past few years about whether or not the US can issue a warrant to an American company for data stored overseas. In this case, Microsoft refused to comply with the warrant for some information hosted in Ireland -- and two years ago a district court ruled against Microsoft and in favor of the US government. Thankfully, the 2nd Circuit appeals court today reversed that ruling and properly noted that US government warrants do not apply to overseas data. This is a hugely important case concerning the privacy and security of our data.

The key issue here is that the US government was basically on a fishing expedition for information hosted on Microsoft Outlook.com email servers. And there are a few really key issues, concerning jurisdiction, privacy and the all important difference between a subpoena and a warrant (something that many people seem to think are the same thing). Microsoft's own response to the lawsuit did a really good job explaining the issues and how the government wanted to pretend a warrant was a subpoena, and what that meant for the 4th Amendment:

The Government cannot seek and a court cannot issue a warrant allowing federal agents to break down the doors of Microsoft's Dublin facility. Likewise, the Government cannot conscript Microsoft to do what it has no authority itself to do -- i.e., execute a warranted search abroad. To end-run these points. the Government argues, and the Magistrate Judge held, that the warrant required by ECPA is not a "warrant" at all. They assert that Congress did not mean "warrant" when using that term, but instead meant some previously unheard of "hybrid" between a warrant and subpoena duces tecum. The Government takes the extraordinary position that by merely serving such a warrant on any U.S.-based email provider, it has the right to obtain the private emails of any subscriber, no matter where in the world the data may be located. and without the knowledge or consent of the subscriber or the relevant foreign government where the data is stored.

This interpretation not only blatantly rewrites the statute, it reads out of the Fourth Amendment the bedrock requirement that the Government must specify the place to be searched with particularity, effectively amending the Constitution for searches of communications held digitally. It would also authorize the Government (including state and local governments) to violate the territorial integrity of sovereign nations and circumvent the commitments made by the United States in mutual legal assistance treaties expressly designed to facilitate cross-border criminal investigations. If this is what Congress intended, it would have made its intent clear in the statute. But the language and the logic of the statute, as well as its legislative history, show that Congress used the word "warrant" in ECPA to mean "warrant," and not some super-powerful "hybrid subpoena." And Congress used the term "warrant" expecting that the Government would be bound by all the inherent limitations of warrants, including the limitation that warrants may not be issued to obtain evidence located in the territory of another sovereign nation.

The Government's interpretation ignores the profound and well established differences between a warrant and a subpoena. A warrant gives the Government the power to seize evidence without notice or affording an opportunity to challenge the seizure in advance. But it requires a specific description (supported by probable cause) of the thing to be seized and the place to be searched and that place must be in the United States. A subpoena duces tecum, on the other hand, does not authorize a search and seizure of the private communications of a third party. Rather. it gives the Government the power to require a person to collect items within her possession, custody, or control, regardless of location, and bring them to court at an appointed time. It also affords the recipient an opportunity to move in advance to quash. Here, the Government wants to exploit the power of a warrant and the sweeping geographic scope of a subpoena, without having to comply with fundamental protections provided by either. There is not a shred of support in the statute or its legislative history for the proposition that Congress intended to allow the Government to mix and match like this. In fact, Congress recognized the basic distinction between a warrant and a subpoena in ECPA when it authorized the Government to obtain certain types of data with a subpoena or a "court order," but required a warrant to obtain a person's most sensitive and constitutionally protected information -- the contents of emails less than 6 months old.

It was unfortunate that two judges at the district court level basically ignored this argument, so it's good to see the appeals court shoot it down completely.

For the reasons that follow, we think that Microsoft has the better of the argument. When, in 1986, Congress passed the Stored Communications Act as part of the broader Electronic Communications Privacy Act, its aim was to protect user privacy in the context of new technology that required a user’s interaction with a service provider. Neither explicitly nor implicitly does the statute envision the application of its warrant provisions overseas. Three decades ago, international boundaries were not so routinely crossed as they are today, when service providers rely on worldwide networks of hardware to satisfy users’ 21st–century demands for access and speed and their related, evolving expectations of privacy.

Rather, in keeping with the pressing needs of the day, Congress focused on providing basic safeguards for the privacy of domestic users. Accordingly, we think it employed the term “warrant” in the Act to require pre‐disclosure scrutiny of the requested search and seizure by a neutral third party, and thereby to afford heightened privacy protection in the United States. It did not abandon the instrument’s territorial limitations and other constitutional requirements. The application of the Act that the government proposes ― interpreting “warrant” to require a service provider to retrieve material from beyond the borders of the United States ―would require us to disregard the presumption against extraterritoriality that the Supreme Court re‐stated and emphasized in Morrison v. National Australian Bank Ltd., 561 U.S. 247 (2010) and, just recently, in RJR Nabisco, Inc. v. European Cmty., 579 U.S. __, 2016 WL 3369423 (June 20, 2016). We are not at liberty to do so.

In the full discussion, the court points out where the lower court went wrong, thinking that thanks to the PATRIOT Act, a warrant could apply to the location of the service provider rather than the location of the server. But the court says that's clearly wrong, and the Congressional record makes it pretty clear that it was looking to apply the law just to the United States. As for the idea that the warrant was really a subpoena in disguise, the court says that's not how it works:

Warrants and subpoenas are, and have long been, distinct legal instruments. Section 2703 of the SCA recognizes this distinction and, unsurprisingly, uses the “warrant” requirement to signal (and to provide) a greater level of protection to priority stored communications, and “subpoenas” to signal (and provide) a lesser level. 18 U.S.C. § 2703(a), (b)(1)(A). Section 2703 does not use the terms interchangeably. Id. Nor does it use the word “hybrid” to describe an SCA warrant. Indeed, § 2703 places priority stored communications entirely outside the reach of an SCA subpoena, absent compliance with the notice provisions. Id. The term “subpoena,” therefore, stands separately in the statute, as in ordinary usage, from the term “warrant.” We see no reasonable basis in the statute from which to infer that Congress used “warrant” to mean “subpoena.”

[....] We see no reason to believe that Congress intended to jettison the centuries of law requiring the issuance and performance of warrants in specified, domestic locations, or to replace the traditional warrant with a novel instrument of international application.

There is, of course, the further issue of Microsoft being a US company, but the court says that doesn't magically make its overseas data subject to these kinds of warrants, because the intent of the law is to protect the privacy of users' communications, not to make it easier for the government to snoop.

The reader will recall the SCA’s provisions regarding the production of electronic communication content: In sum, for priority stored communications, “a governmental entity may require the disclosure . . . of the contents of a wire or electronic communication . . . only pursuant to a warrant issued using the rules described in the Federal Rules of Criminal Procedure,” except (in certain cases) if notice is given to the user....

In our view, the most natural reading of this language in the context of the Act suggests a legislative focus on the privacy of stored communications. Warrants under § 2703 must issue under the Federal Rules of Criminal Procedure, whose Rule 41 is undergirded by the Constitution’s protections of citizens’ privacy against unlawful searches and seizures. And more generally, § 2703’s warrant language appears in a statute entitled the Electronic Communications Privacy Act, suggesting privacy as a key concern.

The overall effect is the embodiment of an expectation of privacy in those communications, notwithstanding the role of service providers in their transmission and storage, and the imposition of procedural restrictions on the government’s (and other third party) access to priority stored communications. The circumstances in which the communications have been stored serve as a proxy for the intensity of the user’s privacy interests, dictating the stringency of the procedural protection they receive—in particular whether the Act’s warrant provisions, subpoena provisions, or its § 2703(d) court order provisions govern a disclosure desired by the government. Accordingly, we think it fair to conclude based on the plain meaning of the text that the privacy of the stored communications is the “object[] of the statute’s solicitude,” and the focus of its provisions.

The court goes on at length arguing that the Stored Communications Act's default is that communication privacy must be protected, and the exceptions are narrow.

All three judges on the panel agreed, but one -- Judge Gerard Lynch -- wrote a concurrence that tries to undercut the strong 4th Amendment/privacy arguments in the overall opinion, basically noting that he believes the decision doesn't come down to 4th Amendment issues or privacy protection, but merely how Congress drew up the law in the Stored Communications Act -- and basically argues that if Congress doesn't like this result, it can just rewrite the law.

It's also important to note that Rule 41 is the underpinning of much of this case, and that's the rule that the courts recently agreed to change to allow the DOJ more power to simply hack overseas servers. That shouldn't directly impact this particular case or similar situations, but does show how the DOJ is looking for ways to create endruns around limitations on domestic laws to try to get international data.

Still, for now, this ruling is a surprisingly good one, reinforcing privacy protections in overseas data. Kudos to Microsoft for going to court over this when it would have been quite easy for it to just give in and hand over the data. I assume that the US government will seek to get this ruling overturned, either via an en banc hearing on the 2nd Circuit or going to the Supreme Court, so the case isn't over yet. But, as for right now, it's in a good position.

Filed Under: 2nd circuit, 4th amendment, communications, doj, ecpa, email, ireland, jurisdiction, privacy, sca, subpoena, warrant
Companies: microsoft

Emails Show Hillary Clinton's Email Server Was A Massive Security Headache, Set Up To Route Around FOIA Requests

from the breaking-badly dept

More bad news for Hillary Clinton and her ill-advised personal email server. Another set of emails released by the State Department shows the government agency had to disable several security processes just to get its server to accept email from Clinton's private email address.

The emails, reviewed by The Associated Press, show that State Department technical staff disabled software on their systems intended to block phishing emails that could deliver dangerous viruses. They were trying urgently to resolve delivery problems with emails sent from Clinton's private server.

"This should trump all other activities," a senior technical official, Ken LaVolpe, told IT employees in a Dec. 17, 2010, email. Another senior State Department official, Thomas W. Lawrence, wrote days later in an email that deputy chief of staff Huma Abedin personally was asking for an update about the repairs. Abedin and Clinton, who both used Clinton's private server, had complained that emails each sent to State Department employees were not being reliably received.

After technical staffers turned off some security features, Lawrence cautioned in an email, "We view this as a Band-Aid and fear it's not 100 percent fully effective."

While trial-and-error is generally useful when solving connection problems, the implication is undeniable: to make Clinton's private, insecure email server connect with the State Department's, it had to -- at least temporarily -- lower itself to Clinton's security level. The other workaround -- USE A DAMN STATE DEPARTMENT EMAIL ADDRESS -- was seriously discussed.

This latest stack of emails also exposed other interesting things... like the fact that Clinton's private email server was attacked multiple times in one day, resulting in staffers taking it offline in an attempt to prevent a breach. (h/t Pwn All The Things)

In addition to the security issues, there's also some discussion about why Clinton was choosing to use her own server.

In one email, the State Department's IT person explains the agency already has an email address set up for Clinton, but offers to delete anything contained in it -- and points out that using the State Dept. address would make future emails subject to FOIA requests.

[W]e actually have an account previously set up: SSHRC@state.gov. There are some old emails but none since Jan '11 -- we could get rid of them.

You should be aware that any email would go through the Department's infrastructure and subject to FOIA searches.

So, there's one reason Clinton would have opted to use a personal email address and server. More confirmation of the rationale behind this decision appears in an earlier email (2010) from Clinton to her aide, Huma Abedin.

Abedin: We should talk about putting you on state email or releasing your email to the department so you are not going to spam.

Clinton: Let's get separate address or device but I don't want any risk of the personal being accessible.

There appears to be some intent to dodge FOIA requests -- either by ensuring "no documents found" when Clinton's State Department email address was searched, or by being able to control any release by being the chokepoint for responsive documents.

To accomplish this, Clinton's team set up a private email server that was insecure and did not follow State Department guidelines. In fact, her team brushed off the agency more than once before finally informing it that they simply would not comply with State Department regulations.

In a blistering audit released last month, the State Department's inspector general concluded that Clinton and her team ignored clear internal guidance that her email setup broke federal standards and could leave sensitive material vulnerable to hackers. Her aides twice brushed aside concerns, in one case telling technical staff "the matter was not to be discussed further," the report said.

The FBI investigation that Clinton refuses to call an investigation continues. There may be no criminal charges forthcoming, but there's already plenty of evidence that Clinton's use of a private email server was not only dangerously insecure, but put into place in hopes of limiting her accountability.

Filed Under: email, foia, hillary clinton, security, state department, vulnerabilities

FBI Questions Veracity Of Emails It Released To FOIA Requester While Defending Refusal To Discuss Hacking Efforts

from the 'assuming-we-even-wrote-those-words-we-wrote' dept

The FBI has entered its explanation for its declaration that it won't discuss the NIT (Network Investigative Technique) in open court or with the defense -- no matter what. Its decision to run a child porn website for two weeks while it deployed the NIT has backfired immensely, resulting in successful challenges of the warrant and the evidence obtained. For the most part, the NIT warrant used by the FBI has been declared invalid because it violates Rule 41's limitations on deployment: a warrant obtained in Virginia can't be used to search computers located in other jurisdictions.

The FBI says it will only discuss the NIT with the judge in an ex parte in camera proceeding, cutting the defense entirely out of the loop. It also argues against the defendant's portrayal of the agency as inherently untrustworthy, what with its long history of hiding information from the courts, starting with its Stingray NDAs.

While not directly related to the subject matter at hand, Jay Michaud's lawyer is buttressing his arguments against the agency's trustworthiness with a wealth of released documents showing the FBI routinely demanded law enforcement agencies hide Stingray-related information from defendants, judges -- even other prosecutors.

Michaud's defense also submitted emails obtained with a FOIA request that showed the agency even hid information on surveillance tech from other FBI agents and federal prosecutors. The choice to cut the latter out of the chain of evidence was based on a supposed trend of prosecutors examining FBI surveillance technology/methods before retiring to work as defense lawyers.

What's most hilarious about the FBI's arguments is the fact that it openly questions the legitimacy of documents it released to Brad Heath and USA Today.

The actual emails (assuming they are genuine) show no improper concealment.

This is an awfully strange thing to say about documents originating from its own offices and released, presumably after a review, to a FOIA requester. If the FBI is forced to assume the emails it released are genuine, it argues that they don't actually say what they appear to say -- which is that information about FBI surveillance techniques must be hidden from damn near everybody but especially those who might be called to testify in court.

Nothing in the email suggests that anyone should be deceived or misled. Rather, the email merely urges the common-sense practice of not disseminating sensitive information unless there is a reason to do so. This concept is called “need to know.” It is familiar to anyone who has worked in the military or law enforcement, and it is an entirely proper way to protect sensitive information.

The government says this shows the FBI does disseminate this info, but only on a "need to know" basis. But it says nothing as to why the "need to know" list doesn't include judges, defendants or prosecutors involved in these cases.

And its other arguments are just as terrible, but at least they don't include the FBI raising doubts as to the legitimacy of documents it generated itself. It claims -- as it has in the past -- that the restrictive NDAs it forces law enforcement to sign before using Stingray equipment aren't restrictive and don't heavily hint (if not state outright) that agencies are to let perps walk rather than introduce Stingray-related evidence in court.

[A] careful reading of this material shows no evidence that the FBI has deceived or misled courts or prosecutors.

Technically true. But plenty of law enforcement agencies have. And when these omissions are challenged, they tend to excuse them by citing the FBI's NDA. So, the FBI ties up agencies with NDAs in hopes of limiting disclosures. Then it throws them under the bus when disclosures aren't made.

[T]he FBI made no false or misleading statements to courts, prosecutors, or anybody else in the Andrews investigation. The pen/trap application and related statements in Andrews were made by local law enforcement and local prosecutors.

Yes, but only because they felt they needed to do so, or because they may have been explicitly told to do so after asking the FBI. The FBI cites only this case because Michaud's defense only cites this case. There are countless others where it's been made apparent evidence of Stingray use has been hidden from everyone but the agency deploying the device.

We don't know what the outcome will be yet, but it's apparent the FBI will not be discussing the details of its NIT in court -- even as it tries to make itself out as a paragon of transparency in this filing. It even says it would prefer to handle this in an adversarial fashion (in the "allow the defense to participate" sense of the word) but simply cannot because it would presumably allow any number of criminals to escape its NIT tentacles in the future.

Filed Under: doj, email, fbi, foia, hacking, nit

Guy Who Didn't Invent Email Sues Gawker For Pointing Out He Didn't Invent Email

from the shiva,-you-ain't-hulk-hogan,-either dept

Oh boy. Remember Shiva Ayyadurai? The guy who has gone to great lengths to claim that he "invented email," when the reality is that he appears to have (likely independently) written an early implementation of email long after others had actually "invented email." In the past we've called out examples where gullible press have fallen for his easily debunked claims, but he keeps popping back up. He somehow got an entire series into the Huffington Post, which was clearly crafted as a PR exercise in trying to rewrite history. The mainstream press repeated his bogus claims about inventing email after he married a TV star. And, most recently, he decided to scream at the press for memorializing Ray Tomlinson -- someone who actually did have a hand in creating email -- upon his death.

We've gone through in great detail as to why Ayyadurai is simply wrong in his claims. There's a lot more to it, but the summary we've written in the past is this:

First off, no one denies that V.A. Shiva Ayyadurai -- an apparently very bright 14-year-old at the time -- wrote an email software program for the University of Medicine and Dentistry of New Jersey (UMDNJ) in 1978. By all accounts, it was a perfectly decent email system that allowed the UMDNJ staff to send electronic messages. Further, no one doubts that, in 1981, Ayyadurai registered the copyright on his program, which was called EMAIL. The problems are that (1) email was invented long before 1978, (2) the copyright is merely on the specific software code, not the idea of email, and (3) while Ayyadurai may have independently recreated the basics of email (and even added a nice feature), none of his work was even remotely related to what later became the standards of email. What's most sickening about this is that as part of this new PR campaign, Ayyadurai is ridiculously arguing that the reason no one believes him isn't because he's simply wrong, but because they can't stand to believe that "a dark-skinned immigrant kid, 14 years old," invented email, and that it was done in "one of the poorest cities in the US" rather than at a famous university.

Again, that might make for a nice story line if there were some factual basis behind it, but there isn't. The history of email is well-documented from multiple sources and it began way, way before 1978. And while early versions were somewhat crude, by 1978 they had basically everything that Ayyadurai claims to have invented (it is entirely believable that Ayyadurai, as a bright kid, independently came up with the same ideas, but he was hardly the first). There was a messaging system called MAILBOX at MIT in 1965. You can read all the details of it here, including source code. Ray Tomlinson is frequently credited with inventing the modern concept of email for the internet by establishing the @ symbol (in 1972) as a way of determining both the user and which computer to send the email to. By 1975, there were things like email folders (invented by Larry Roberts) and some other basic email apps. As is noted, by 1976 -- two years before Ayyadurai wrote his app -- email was 75% of all ARPANET traffic.

For what it's worth, some have disputed the idea that he even added any features not existing in previous discussions. Nevertheless, he's not the "inventor" of email, no matter how many times he claims he is.

We, of course, have not been alone in debunking his claims. Back in 2012, a few weeks after we first debunked them, Gawker's Sam Biddle did a long and thorough takedown of Ayyadurai's claims. Apparently that story really angers Ayyadurai, and I'm guessing that seeing Hulk Hogan win his crazy lawsuit against Gawker helped Ayyadurai to decide to sue Gawker as well.

And, in keeping with my belief that this is all one giant PR stunt, the lawsuit filing was accompanied by a press release that repeats the same debunked claims, and selectively quotes the very media he fooled as evidence that he really invented email. The actual lawsuit is a joke. As in the Hogan case, Ayyadurai is suing not just Gawker, but also the company's founder Nick Denton, along with the author of the articles (in this case, Sam Biddle).

The filing again lays out Ayyadurai's highly misleading version of history, insisting again that getting the copyright on a program called EMAIL is the equivalent of "inventing" email. He continues to conflate patent and copyright law and misleadingly claim that because you couldn't get a patent on software at the time, a copyright is basically the same thing. This is wrong on both counts. You could patent some software at the time, and either way a copyright is nowhere near the equivalent. He also relies on debunked reports in Time Magazine and CBS. And also Wired, though he leaves out that Wired was just quoting Noam Chomsky, who bizarrely has become one of Ayyadurai's biggest defenders, and that the Wired story includes other evidence that Ayyadurai is wrong.

Ayyadurai claims that Gawker's articles were defamatory, specifically stating:

As described herein, the February 2012 Article arises to the level of defamation per se, in that it falsely states that “[Dr.] Ayyadurai is a fraud.”

As described herein, the March 2012 Article falsely alleges that:

a) Dr. Ayyadurai engaged in “semantic tricks, falsehoods, and a misinformation campaign.”
b) Dr. Ayyadurai is engaged in “revisionism” in his claim of invention of email.

As described herein, the 2014 Article arises to the level of defamation per se, by stating that Dr. Ayyadurai is a “fraud,” thus falsely accusing Dr. Ayyadurai of a crime and causing prejudice to his personal and professional reputation and business.

The 2014 Article also falsely states:

a) Dr. Ayyadurai is a “renowned liar” with respect to his statements that he invented email,
b) Dr. Ayyadurai is a “big fake,” and
c) Dr. Ayyadurai is engaged in “cyber-lies.”

These defamation claims seem extremely weak. First off, as the detailed records show, Ayyadurai did not invent email. So truth is generally a good response to defamation claims. Second, even if he did create email (and he didn't), most of these statements would be protected as either statements of opinion or rhetorical hyperbole. Finally, Ayyadurai as a self-proclaimed public persona would have to show actual malice for it to be defamatory. Hilariously, the lawsuit claims no actual malice is necessary, which is nonsense. Ayyadurai is so focused on making himself a famous person over his exaggerated claims to have invented email that for him to try to argue he's not a public figure is laughable. His lawyers also show no evidence that there is actual malice from Gawker but insist that if they could get to the discovery phase, they could find evidence supporting actual malice.

There are then three other claims: one for "intentional interference with prospective economic advantage," one for "intentional infliction of emotional distress" (the "my feelz!" argument), and one for (and I'm not kidding) "negligent hiring and retention."

Ayyadurai goes into detail about how people pointing out that he is exaggerating his claims has made people less willing to work with him. But that's not the fault of accurate reporting. It's the fault of him focusing so much on a false claim to have invented email.

This is the situation here: Defendants’ false statements in the articles at issue had the effect of so severely discrediting Dr. Ayyadurai—based on the false statement that he is a “fraud”—that Dr. Ayyadurai’s career was severely damaged. As a direct result of Defendants’ publication of the false and defamatory statements about Dr. Ayyadurai, on information and belief, Dr. Ayyadurai has lost teaching positions at MIT, lost several paid speaking engagements at the time and in the future, lost an accolade and display dedicated to his invention at the Smithsonian Institute, lost contracts and renewals, lost opportunities for investment in his emerging companies, suffered substantial personal and professional reputational harm, and suffered substantial harm to his career, business and income.

I'm sure that's distressing, but it's not the fault of Gawker for pointing out that Ayyadurai was exaggerating what he did. It's what happens when you exaggerate like that and make grandiose claims that are not accurate.

The "negligent hiring" claims seems to just be an attempt to attack and mock Sam Biddle. I'm not a Sam Biddle fan by any stretch of the imagination. I think he has a history of taking things completely out of context and creating sensational posts that are misleading, at best. But that's not defamation. It's just bad reporting. And Ayyadurai's claims about "negligent hiring" basically accuse Biddle of being a drug addict and, potentially, mentally unstable. That claim is not going to last very long and seems to serve no purpose other than to attack Biddle's reputation.

The filing also spends a ton of completely wasted space on other lawsuits against Gawker, as if trying to prove that the company has a history of bad actions. But the litany of bad actions listed are extremely exaggerated. Yes, Gawker has been sued for defamation, but Gawker has not lost those cases and they are extremely unlikely to lose them. I mean, you're reaching really, really low if you're citing Chuck Johnson's laughable defamation lawsuit against Gawker that has already been tossed out of a Missouri court for being ridiculous. And yes, Johnson also filed an identical case in California, but it's going nowhere (it was so identical that it focused on the harms in Missouri, despite being filed in California). But Ayyadurai's lawyers pretend that it's evidence of Gawker's defamatory history:

Gawker has been sued multiple times for defamation, including currently in an action in New York State Court, by the Daily Mail newspaper, and in an action in California by an individual named Charles Johnson, for writing and publishing false and unsubstantiated rumors that Mr. Johnson had been involved in misconduct and criminal activity.

The lawsuit also cites a variety of other lawsuits involving Gawker that have nothing to do with defamation at all, including (obviously) the Hulk Hogan case that will almost certainly be overturned on appeal, and also a copyright lawsuit from Dr. Phil and a few other examples of people being unhappy with Gawker's coverage.

This case should go nowhere fast, and Ayyadurai may be opening himself up to a world of hurt in exposing himself to discovery, should the case even reach that stage. Unfortunately for Gawker, Massachusetts -- where Ayyadurai filed this lawsuit -- has an anti-SLAPP statute that is much more limited and unfortunately may not be that helpful to Gawker. Yet another reason why we need a federal anti-SLAPP law as soon as possible.

Filed Under: defamation, email, lawsuit, nick denton, sam biddle, shiva ayyadurai
Companies: gawker