IRS To Public: You Need To Hold Onto Your Records For 2-7 Years; We'll Just Trash Ours Whenever We Feel Like It

from the hire-an-accountant-and-marvel-at-our-lack-of-accountability dept

How long should I keep my records?

Note: Keep copies of your filed tax returns. They help in preparing future tax returns and making computations if you file an amended return.

1. You owe additional tax and situations (2), (3), and (4), below, do not apply to you; keep records for 3 years.
2. You do not report income that you should report, and it is more than 25% of the gross income shown on your return; keep records for 6 years.
3. You file a fraudulent return; keep records indefinitely.
4. You do not file a return; keep records indefinitely.
5. You file a claim for credit or refund* after you file your return; keep records for 3 years from the date you filed your original return or 2 years from the date you paid the tax, whichever is later.
6. You file a claim for a loss from worthless securities or bad debt deduction; keep records for 7 years.

Keep all employment tax records for at least 4 years after the date that the tax becomes due or is paid, whichever is later.

Source: IRS

How long should the IRS hold onto emails that are considered part of public records?

Answer: until the hard drive is recycled.

Ex-IRS official Lois Lerner's crashed hard drive has been recycled, making it likely the lost emails of the lightening rod in the tea party targeting controversy will never be found, according to multiple sources.

"We've been informed that the hard drive has been thrown away," Sen. Orrin Hatch of Utah, the top Republican on the Finance Committee, said in a brief hallway interview.

Citizens, the burden of proof lies on you when the IRS starts asking questions. You retain these records or bear the consequences. When the IRS loses two years of email, it simply rehashes what happens, shrugs its shoulders and waits for the NSA's Glomar on Lois Lerner's email metadata.

On one hand, at the point it was thrown away, those currently being investigated by Congress probably had no idea the emails contained would be requested two years later. On the other hand, the agency has the specific duty to retain this information to remain in compliance with federal public records regulations. Scrapping a hard drive doesn't sound like the move of an agency interested in maintaining public records.

Lerner's crashed hard drive was subpoenaed by Darrell Issa and computer forensics experts were fairly certain they could recover the data from the drive. But the drive no longer exists and it appears the IRS never made an effort to recover anything IRS-related from the drive.

Lerner, however, seemed greatly concerned about the recovery of certain items unrelated to the public records she was supposed to be maintaining. Here's a screenshot of an email discussing the crash, posted by John Hinderaker at Power Line.


If you can't see this screenshot, it says the following:

It was nice to meet you this morning -- although I would have preferred it was under different circumstances. I'm taking you up on your offer to try and recapture my lost personal files. My computer skills are pretty basic, so nothing fancy -- but there were some documents in the files that are irreplaceable. Whatever you can do to help, is greatly appreciated…

As Hinderaker points out, Lerner seems dismayed to have lost some personal files, but is completely unconcerned that years of emails may have been destroyed as well.

It is remarkable that Lerner does not say: "Oh no! My hard drive crashed, and the IRS's only copy of two years' worth of my highly important work has been lost!" No: she is concerned about "my lost personal files," because "there were some documents in the files that are irreplaceable." That is a clearly stated and entirely reasonable concern, but it has nothing to do with losing the agency's only record of two years of work.

As more details come out, the IRS is looking worse and worse. But these additional details are pushing the perception more into the "expected bureaucratic incompetence" area, rather than towards "large-scale conspiracy to destroy evidence."

Still, the agency's long-standing practice of taping over previous backups and pitifully small amounts of email storage doesn't exactly evoke confidence in the IRS's ability to maintain public records. That whatever effort was actually made to recover data from Lerner's crashed computer seems to have revolved around "personal" files makes this situation even worse. The IRS requires hard copy backups of any email that could conceivably be part of the "public record," but it appears that no one involved followed that rule. The rash of coincidental crashes only adds to the negative perception.

The IRS -- and the government -- demands so much from its citizens with pages and pages of federal regulations but it can't even be bothered to follow the few rules it sets for itself. Pathetic.

Filed Under: emails, hard drive, irs, lois lerner, public, records

IRS Now Says It Has Lost Emails From Six More Accounts Tied To The Investigation Of Its Targeting Of Tax-Exempt Groups

from the evil-or-just-stupid? dept

The IRS recently blamed a "computer crash" for the disappearance of two years of email correspondence involving Lois Lerner, the IRS official at the center of the controversy surrounding the agency's apparent targeting of certain non-profit groups (Tea Party, Occupy, open source).

Apparently, this computer crash also destroyed any backups of the email between Lerner's office and outside government agencies, along with the hard copy backups IRS employees are required to maintain as part of its public records obligations. The latter part of that hasn't been specifically denied, but it's assumed no one's rounding up email printouts at the moment. As is the new Standard Operating Procedure for Grandstanding, a Congressman has demanded the NSA hand over the metadata on the missing Lerner emails.

Now, it appears that Lois Lerner's computer crash was only part of a much larger series of well-timed computer crashes.

The Internal Revenue Service says it can't produce e-mails from six more employees involved in the targeting of conservative groups, according to two Republicans investigating the scandal.

The IRS recently informed Ways and Means chairman Dave Camp and subcommittee chairman Charles Boustany that computer crashes resulted in additional lost e-mails, including from Nikole Flax, the chief of staff to former IRS commissioner Steven Miller, who was fired in the wake of the targeting scandal.

The question is still: conspiracy or colossal screwup?

Certainly the fact that emails and accounts directly related to the investigation are missing data from the crucial 2009-2011 period does make it look like the agency's hiding something. But the possibility that this is can be chalked up to regular government ineptitude is never too far away.

As was noted earlier (in the IRS's own documentation no less), the agency uses Microsoft Outlook and Exchange, which would suggest that further backups exist, as does (again) the IRS's own statements. John Hinderaker at Power Line quotes the IRS on its backup processes.

For disaster recovery purposes, the IRS does a daily back-up of its email servers. … Prior to May 2013, these backups were retained on tape for six months, and then for cost efficiency, the back-up tapes were released for re-use. In May of last year, the IRS changed its policy and began storing rather than recycling its backup tapes.

This means that older backups no longer exist, at least anything "taped over" prior to the change of policy. One wonders why the agency was allowed to recycle backups when much of what's being backed up is subject to public records laws. But to make the situation even worse, the IRS greatly restricted the number of emails each employee could retain.

Currently, the average individual employee's email box limit is 500 megabytes, which translates to approximately 6,000 emails. … Prior to July 2011, the limit was lower, 150 megabytes or roughly 1,800 emails.

As Hinderaker points out, someone in Lerner's position could run through that allotment in just a few days, meaning she would most likely begin archiving them to her own computer, something that could actually destroy emails when it crashed.

But this doesn't excuse the missing email, although it does help explain it. As the IRS's own policies note, archiving email to local storage is not an adequate solution and does not comply with public records regulations. So, Lerner and the six others affected should have had hard copy printouts of every email that could possibly be considered a relevant public record. Apparently, they don't and it's highly unlikely that many IRS officials take this Luddic requirement seriously.

Even with this additional information, the coverup theory isn't completely dispelled. One computer crash nuking vital emails is unfortunate. Six computers all taking out relevant email from a specific time period goes far past coincidental. The fact that the IRS hid this from the investigatory committee for months before finally "revealing" it on page 15 of a 27-page letter lends more credence to those who feel there's been a concerted effort to keep information buried. It also should be noted that the IRS itself has not stepped up and explained how something like this could happen (other than saying "computer crash"). Anything pertaining to the IRS's regrettable backup "solutions" and absurdly tiny email storage has been uncovered by the research of others. So, until the agency has anything further to add, the scale remains perfectly balanced between "malice" and "stupidity."

Filed Under: congress, dave camp, destruction, emails, evidence, irs, lois lerner, records

More Than Half Of The House Co-Sponsoring Email Privacy Reform; So Why Isn't It Moving?

from the ecpa-reform-now dept

For quite some time we've talked about the importance of ECPA reform. ECPA -- the Electronic Communications Privacy Act -- is woefully outdated. Passed in the 1980s, when the internet was just a small network that connected a few universities, it has allowed law enforcement and other government officials to snoop on your email based on some very outdated definitions and assumptions. As we've discussed in the past, one very obvious example, is the idea that, under the law, emails stored on a server for over 180 days are considered "abandoned" and that there's no need to get a warrant to view those emails. Of course, that was back when people expected old emails to be either deleted or downloaded. No one predicted "cloud" computing with virtually unlimited storage.

For years now, there's been a major effort at ECPA reform, to actually make sure that law enforcement needs a warrant to view your emails. It has had strong support in Congress for some time, but the main folks fighting against it are the SEC and the IRS, who like the fact that they can search through your emails without a warrant. In fact, the SEC seems to revel in its ability to do some very questionable things, in part thanks to ECPA.

Earlier this week, the main ECPA reform bill in the House, sponsored by Reps. Kevin Yoder and Jared Polis, hit a new milestone: it currently has 218 co-sponsors, meaning that more than half of the House now has their name on the bill. And yet, the bill is still stalled out, because House leadership has been scared off by the SEC and IRS. Hopefully, the House will finally move forward on this bill.

And while Yoder notes in that article that the NSA revelations have actually helped give this bill momentum, it's important to note that this is separate from the NSA reform issue. ECPA reform is unrelated to the NSA stuff, but covers what other government agencies can do with your email. Both are important issues, but it would be great to finally get basic ECPA reform through. This is a fight that's been going on for over a decade, and with more than half the House supporting it, how much longer can Congressional leadership ignore it?

Filed Under: 4th amendment, ecpa, ecpa reform, irs, jared polis, kevin yoder, privacy, sec, warrants

Court Says Feds Violated 4th Amendment By Holding Onto Suspect's Computer Data Too Long

from the hey-the-4th-amendment-still-exists dept

Yet another court has remembered that the 4th Amendment exists. The Second Circuit appeals court has ruled that the government violated the 4th Amendment rights of Stavros Ganias when it held onto data it had seized (legally) from his computers for longer than the warrant in question allowed. In executing the warrant, Army investigators (Ganias was providing tax and accounting services to a couple of companies providing security to the Army at a vacant facility, and there were allegations that people at one of the companies was stealing copper wire from the facility and also playing some games with billing) made copies of Ganias' computer hard drives -- including files "beyond the scope of the warrant" such as his personal financial records.

While Ganias objected to the collection of such files as it was happening, he was told investigators were only concerned with the specific case at hand and would get rid of the other files. Take a guess what didn't happen? Yeah, they hung onto those files, and then in searching them, found some other stuff of interest and passed all of the files along to the IRS. While they claim that they focused on the files the warrant covered, they refused to delete the other files:

They did not, however, purge or delete the non-responsive files. To the contrary, the investigators retained the files because they "viewed the data as the government's property, not Mr. Ganias's property." Their view was that while items seized from an owner will be returned after an investigation closes, all of the electronic data here were evidence that were to be protected and preserved. As one agent testified, "[W]e would not routinely go into DVDs to delete data, as we're altering the original data that was seized. And you never know what data you may need in the future. . . . I don't normally go into electronic data and start deleting evidence off of DVDs stored in my evidence room." The computer specialists were never asked to delete (or even to try to delete) those files that did not relate to IPM or American Boiler.

Now take a guess what happened? After digging deeper into the original files, the IRS suddenly began to suspect Ganias himself of cooking some books, and decided it wanted to look at his personal financial records which, conveniently, were right there in the collection of documents they were never supposed to have or look at. To their (slight) credit, the IRS recognized it couldn't just search those files, and so got another warrant to go through them. However, it only had them because it had sat on them for two and a half years, and Ganias insists that the original files had been changed soon after the Army's copying of his hard drives. At trial, Ganias was convicted, but the appeals court has trouble with the 4th Amendment implications. After going through a quick history of the 4th Amendment it notes (thankfully) that these concepts still apply in the computer age.

These Fourth Amendment protections apply to modern computer files. Like 18th Century "papers," computer files may contain intimate details regarding an individual's thoughts, beliefs, and lifestyle, and they should be similarly guarded against unwarranted Government intrusion. If anything, even greater protection is warranted....

It also notes that with so much stuff stored on computer, sometimes this gets tricky:

Not surprisingly, the ability of computers to store massive volumes of information presents logistical problems in the execution of search warrants. It is "comparatively" commonplace for files on a computer hard drive to be "so intermingled that they cannot feasibly be sorted on site."... As evidenced by this case, forensic analysis of electronic data may take months to complete. It would be impractical for agents to occupy an individual's home or office, or seize an individual's computer, for such long periods of time. It is now also unnecessary. Today, advancements in technology enable the Government to create a mirror image of an individual's hard drive, which can be searched as if it were the actual hard drive but without interfering with the individual's use of his home, computer, or files.

The court notes that creating such a mirror image is okay... but there are limits on what can be done with the seized data. By hanging onto all his records indefinitely, the court found that it interfered with his 4th Amendment rights.

The Government's retention of copies of Ganias's personal computer records for two-and-a-half years deprived him of exclusive control over those files for an unreasonable amount of time. This combination of circumstances enabled the Government to possess indefinitely personal records of Ganias that were beyond the scope of the warrant while it looked for other evidence to give it probable cause to search the files. This was a meaningful interference with Ganias's possessory rights in those files and constituted a seizure within the meaning of the Fourth Amendment.

[....] The Government had no warrant authorizing the seizure of Ganias's personal records in 2003. By December 2004, these documents had been separated from those relevant to the investigation of American Boiler and IPM. Nevertheless, the Government continued to retain them for another year-and-a-half until it finally developed probable cause to search and seize them in 2006. Without some independent basis for its retention of those documents in the interim, the Government clearly violated Ganias's Fourth Amendment rights by retaining the files for a prolonged period of time and then using them in a future criminal investigation.

As for the government's argument that once they have these files they're now "government property," the court rejects that pretty quickly.

As explained above, practical considerations may well justify a reasonable accommodation in the manner of executing a search warrant, such as making mirror images of hard drives and permitting off-site review, but these considerations do not justify the indefinite retention of non-responsive documents.... Without a warrant authorizing seizure of Ganias's personal financial records, the copies of those documents could not become ipso facto "the government's property" without running afoul of the Fourth Amendment

The court also rejects a variety of other attempts by the government to get around this, including the fact that Ganias had not earlier brought a motion to "return" the property. Apparently that was convincing to the lower court, but not so here.

Imposing such a prerequisite makes little sense in this context, where Ganias still had the original computer files and did not need the Government's copies to be returned to him. Moreover, we fail to see what purpose a Rule 41(g) motion would have served, given the Government's position that non-responsive files in its possession could not feasibly have been returned or purged anyway.

In the end, the court outlines how troubling the government's position is in this case:

The Fourth Amendment was intended to prevent the Government from entering individuals' homes and indiscriminately seizing all their papers in the hopes of discovering evidence about previously unknown crimes.... Yet this is exactly what the Government claims it may do when it executes a warrant calling for the seizure of particular electronic data relevant to a different crime. Perhaps the "wholesale removal" of intermingled computer records is permissible where off-site sorting is necessary and reasonable,... but this accommodation does not somehow authorize the Government to retain all non-responsive documents indefinitely, for possible use in future criminal investigations.

There's a separate issue also in the case, concerning a juror commenting (negatively) on the case on Facebook during the case (and also friending another juror on Facebook), but the court didn't seem to concerned about that, rather suggesting that courts should be a bit more upfront with jury instructions to avoid that sort of thing.

Either way, while a very specific issue, it's a nice 4th Amendment win.

Filed Under: 4th amendment, irs, second circuit, seized data, stavros ganias, warrants

IRS Claims Two Years Of Emails Were Destroyed In A 'Computer Crash;' Congressman Asks The NSA To Supply 'Missing' Email Metadata

from the hilarious-except-for-the-tax-dollars-funding-the-debacle dept

The IRS is currently being investigated by Congress for some possibly politically-motivated "attention" it directed towards "Tea Party" and other conservative groups that operated as tax-exempt entities. Along the way, IRS official Lois Lerner, who was the first to publicly disclose the inappropriate targeting, was also one of the first government officials to plead the Fifth (twice) in government hearings.

The Congressional investigation demanded copies of Lois Lerner's emails from the IRS. Some were turned over to the House Ways and Means Committee, but not everything it sought. Now, the IRS is telling the committee that it's not going to get everything it asked for.

The IRS has told Congress that it lost more than two years’ worth of emails involving former IRS official Lois Lerner, due to a computer crash.

House Ways and Means Committee Chairman Dave Camp (R-Mich.) on Friday said it was “unacceptable” that he was just learning of this problem now, after a lengthy investigation into Lerner’s involvement in the IRS targeting scandal.

Camp points out that the IRS withheld these emails for over a year before suddenly "discovering" they were unavailable. The IRS says it can find everything Lerner sent to and received from other IRS employees but nothing containing correspondence with those outside the agency.

Obviously, this convenient "computer crash" has generated a lot of skepticism. For one thing, a "computer crash" doesn't really have the power to destroy electronic communications. Email is always almost stored somewhere else other than the local user's computer. And even if the IRS meant a "server crash" instead of a "computer crash," any decent server system contains multiple levels of redundancy.

The Blaze sought input from Norman Cillo, a former Microsoft project manager, who presented six reasons why he believes the IRS is lying about its inability to recover these emails. Number one on the list seems to be the most applicable.

I believe the government uses Microsoft Exchange for their email servers. They have built-in exchange mail database redundancy. So, unless they did not follow Microsoft's recommendations they are telling a falsehood.

The IRS's own policies on email state that its employees use both Microsoft Outlook and Exchange, which means it should have some form of backup available.

Secure Messaging enrollment is an automated process for all LAN accounts with an Exchange mailbox in IRS. You can find the instructions for configuring the Outlook client to use the certificates at the Secure Enterprise Messaging Systems (SEMS) web site: http://documentation.sems.enterprise.irs.gov/.

According to Cillo, the only other explanation for the IRS's inability to recover these emails is that the agency is "totally mismanaged and has the worst IT department ever." Unfortunately, the government seems to have a lot of mismanaged and terrible IT departments, so this may be closer to the truth than anyone would really like to admit. Perhaps the general ineptitude of large government agencies is behind the Treasury Department's policy that all email sent to or from IRS employees be "archived" via hard copy printouts.

If you create or receive email messages during the course of your daily work, you are responsible for ensuring that you manage them properly. The Treasury Department’s current email policy requires emails and attachments that meet the definition of a federal record be added to the organization’s files by printing them (including the essential transmission data) and filing them with related paper records. If transmission and receipt data are not printed by the email system, annotate the paper copy.

There's more information here, citing the IRS's own internal guidelines on tape backups, etc., that suggest further levels of redundancy, as well as the commissioner of the IRS testifying that the agency stores its emails on servers.

Critics believe the IRS has simply "vanished" the crucial emails in order to cut Lerner adrift and make it appear she acted alone. Any evidence that would tie outside government agencies (including the administration itself) into this situation has been deemed unrecoverable. Supposedly, there should be paper copies of the missing emails, but no one in Congress has requested these and the IRS certainly isn't offering to look.

But one Congressman thinks he has a solution to the missing email dilemma. Steve Stockman (last seen here threatening to bring a defamation lawsuit against someone who uttered true facts about his criminal past) knows some people who have a whole lot of email data just laying around.

“I have asked NSA Director Rogers to send me all metadata his agency has collected on Lois Lerner’s email accounts for the period which the House sought records,” said Stockman. “The metadata will establish who Lerner contacted and when, which helps investigators determine the extent of illegal activity by the IRS.”

Yeah, let me know how that works out for you, Steve. The NSA can't even confirm or deny its monthly water usage at its Utah data site, much less that it has metadata pertaining to Americans' communications.

[Sidebar: I do really love the fact that this sort of thing is becoming increasingly common -- the use of the NSA as the backup-of-last-resort for phone/email/internet communications data. If anyone claims it can't find email X or phone record Y, someone's going to say, "Hey, I'll bet the NSA has a copy!" Hilarious. The NSA will never again be allowed to pretend it doesn't harvest data on American citizens.]

The whole letter, which begins with some light ass-kissing of new NSA director Michael Rogers ("thank you for your 33 years of, and continued service to, our country...") and closes with a bit of grandstanding, surreally asking "the Agency" to send all relevant metadata on the missing Lerner emails to "Donny@mail.house.gov." All in all, probably one of the most incongruous demands the NSA has ever received, a letter which conjures up the image of a late-night meeting in an underground parking garage, with sunglassed NSA liaisons handing over a briefcase full of metadata to a 19-year-old intern dressed in his dad's suit.

It's pretty hard to shake the impression that this is a coverup. As always, the specter of pure ineptitude lurks in the background, as it often does when large bureaucracies tangle with technology. But until the IRS presents further evidence detailing how exactly these emails went missing, it's safe to assume there's been an active effort made to cover up government impropriety.

Filed Under: backups, computer crash, congress, dave camp, irs, lois lerner, metadata, nsa, servers, steve stockman, surveillance

SEC Is A Due Process Nightmare: Searches Emails Without A Warrant, Refuses To Share Exculpatory Evidence

from the the-sec-doesn't-like-the-constitution dept

Back in December, we wrote about the effort to push for ECPA reform by noting that one of the main government agencies fighting against it was the SEC, which wanted the ability to snoop through your emails without getting a warrant. If you don't remember, ECPA is an excessively outdated law from 1986, whose definitions make no sense in the internet era (especially one with cloud computing). The key example often given is that emails on a server that are over 180 days old are considered "abandoned" and thus no warrant is needed to access them. That may have kind of made sense in an era when people downloaded all of their email, but now that nearly all email remains on servers somewhere it makes no sense at all. There are other problems with ECPA similar in nature (opened vs. unopened emails are treated differently, for example), but it's clear the law is outdated.

Two stories popped up last week that raise serious concerns about the way that the SEC tramples on the Constitution. The first is that in a hearing, SEC boss Mary Jo White was asked why the SEC is so resistant to ECPA reform and what's wrong with getting a warrant, and more or less admitted that it's standard practice for the SEC to not get a warrant, but to rely on loopholes in ECPA to get access to emails. Prior to this, many had assumed that this was just a desire of the SEC, not that they were regularly doing it. But White's answer makes it clear that the SEC views this practice -- which seems like it should be a clear 4th Amendment violations -- as standard operating procedure. While she insists that the privacy issues aren't a huge deal, because the SEC tries to "give notice" to the subscriber whose email is being accessed, that still doesn't explain why paper documents require a warrant, and yet the SEC doesn't bother with the much higher standard (including judicial review) of a warrant for electronic documents.

Meanwhile, concerning a separate issue, Mark Cuban and his lawyer published an op-ed in the Wall Street Journal last week, discussing the SEC's totally bogus case against him for insider trading, which got tossed out by a lawyer. The key issue they discussed is how the SEC had exculpatory evidence that proved Cuban had done no wrong from back in 2004 -- and then did everything possible to avoid turning over that evidence, as is normally required in legal proceedings.

In a criminal trial, the federal government has long been obliged to promptly turn over to the defense any evidence that could show that the accused did not commit the offense of which he is accused. The Brady rule (announced in the 1963 Supreme Court case, Brady v. Maryland), prevents one-sided prosecutions in which the defendant is kept in the dark about information that might show that he is innocent.

The government's job as criminal prosecutor is not to obtain convictions, but "to do justice," according to the traditional legal maxim. It should be required to follow the Brady rule in civil trials as well. But the SEC does not, even when it accuses a citizen of fraud. Had the agency complied with this simple rule in its recent insider-trading case against one of us, Mark Cuban, it is unlikely that a lawsuit would even have been filed, let alone go to trial.

At issue were notes the SEC had concerning the details of Cuban's conversation with the CEO of Mamma.com, the search engine Cuban had invested in (and then sold all his shares in), which showed that, contrary to the SEC's claims in the case against him, Cuban had never made certain promises. When Cuban and his lawyer asked for these notes, the SEC resisted.

The SEC, however, resisted the disclosure of these notes for the next three years. Even up until the time Mr. Cuban took the stand, the SEC continued to fight to keep the notes from being shown to the jury by asking the judge to exclude them from evidence. Fortunately, the judge disagreed and the jury ultimately cleared Mr. Cuban of a charge of insider trading.

So, reading both of these stories, we see that the SEC feels that it is free to ignore both the 4th Amendment (against search and seizure without a warrant) and the 14th Amendment (concerning due process). Don't we think that agencies of the federal government should be required to follow the Constitution -- especially basic concepts like protecting the privacy of individuals and giving them basic due process? And, for those of you who think this is no big deal, because it's the SEC, and the SEC just goes after big bad bankers and the like, recognize that the agency following right behind the SEC in fighting ECPA reform is the IRS. Do you feel it's similarly okay for the IRS to search your emails and electronic records without a warrant while also believing that it need not share any of the exculpatory evidence it finds, proving your innocence, while bringing a case against you for violating the law?

Oh, and just for the hell of it, let's take this a step further. Just a few weeks ago, the NY Times reported on an increasingly popular tactic of law enforcement to effectively use the SEC to trick people into effectively implicating themselves in criminal cases. It tells the story of a low-level guy who worked at a law firm, and was asked by the SEC to "help out" with an investigation. Only at the last minute, was it mentioned that someone from the district attorney's office would be present -- and at no time was there any indication that the guy was being investigated for criminal behavior. But thanks to the SEC smokescreen, the guy was indicted, and he's still not sure why.

So, now it's an SEC that ignores the Constitution, searches emails without a warrant, hides exculpatory evidence and surreptitiously uses these "investigations" to help build out criminal charges against people on a highly questionable basis. See the problem, yet?

The folks over at VanishingRights.com are fighting to reform ECPA, which would at least solve half of the problem above. Right now, the SEC and the IRS remain the main government agencies aligned against such reform. It's time to tell those agencies that they need to obey the Constitution too.

Filed Under: 4th amendment, due process, ecpa, ecpa reform, irs, mark cuban, mary jo white, sec, warrantless searches, warrants

Feds Own Cybersecurity Efforts Are A Joke: Employees Have 'Gone Rogue' To Avoid 'Ineptitude' Of IT Staff

from the get-your-house-in-order dept

One of the key parts of the various cybersecurity bills that have been pushed over the past few years is the idea that the federal government would help the private sector better protect against attacks. Of course, for that to makes sense, you'd think that the federal government would have its own "cybersecurity" house in order. However, a report from the Senate shows what even it describes as "ineptitude" by various government agencies. Pick your agency and you'll find problems. Let's take a look at Homeland Security, one of the agencies that has been vying for control of the federal cybersecurity budget. Turns out that DHS's own cybersecurity team repeatedly failed to install basic security updates for easy targets of hackers like Microsoft applications and Java (tip: if you're using Java, you're probably not secure). As the report notes, this is "the sort of basic security measure just about any American with a computer has performed." But not DHS cybersecurity employees!

What else? Well, just in DHS, there were the following problems:

Sensitive databases protected by weak or default passwords. At NPPD, which oversees DHS’s cybersecurity programs, the IG found multiple accounts protected by weak passwords. For FEMA’s Enterprise Data Warehouse, which handles reports on FEMA’s disaster deployment readiness and generates other reports accessing Personally Identifying Information (PII), the IG found accounts protected by “default” passwords, and improperly configured password controls.

Computers controlling physical access to DHS facilities whose antivirus software was out of date. Twelve of the 14 computer servers the IG checked in 2012 had anti-virus definitions most recently updated in August 2011. Several of the servers also lacked patches to critical software components.

Oh, and then there's the following concerning our good friends at ICE, Immigrations and Customs Enforcement, the group that styles themselves as Hollywood's personal police force:

To take just one example, weaknesses found in the office of the Chief Information Officer for ICE included 10 passwords written down, 15 FOUO (For Official Use Only) documents left out, three keys, six unlocked laptops-- even two credit cards left out.

Moving on to the Nuclear Regulatory Commission. Here things are so bad that the report notes that NRC employees believe their own IT staff is "inept" and they've "gone rogue."

Perceived ineptitude of NRC technology experts. There is such “a general lack of confidence” in the NRC’s information technology division that NRC offices have effectively gone rogue–by buying and deploying their own computers and networks without the knowledge or involvement of the department’s so-called IT experts. Such “shadow IT” systems “can introduce security risks when unsupported hardware and software are not subject to the same security measures that are applied to supported technologies,” the NRC Inspector General reported in December 2013.

And this has resulted in a bunch of problems, such as storing sensitive data on unsecured shared drives, including the details of the NRC's cybersecurity programs. Also on an unsecured shared drive? A commissioner's passport photo, credit card image, home address and phone number. The NRC also failed to report security breaches:

How often does the NRC lose track of or accidentally expose sensitive information to possible release? The NRC can't say, because it has no official process for reporting such breaches.

Moving on to everyone's favorite government agency: the IRS. The report notes that every year the GAO finds 100 cybersecurity weaknesses in IRS systems, and the IRS fixes half of them. Then the GAO does another audit... and finds another 100 problems with the IRS's cybersecurity. Among the problems? Failure to encrypt sensitive data. Failure to fix known vulnerabilities. And, the ever popular weak passwords:

Examples of easily-guessed passwords are a person’s username or real name, the word “password,” the agency’s name, or simple keyboard patterns (e.g., “qwerty”), according to the National Institute of Standards and Technology. In some cases, IRS users had not changed their passwords in nearly two years. As a result someone might gain unauthorized access to taxpayers’ personal information and it “would be virtually undetectable,” potentially for years. GAO has cited IRS for allowing old, weak passwords in every one of its reports on IRS’ information security for the past six years.

How about an organization like the SEC, who deals with tons of sensitive information? Apparently, they're so careless and cavalier about this stuff they used personal email accounts, unencrypted information and often used unsecured open WiFi connections -- including once at "a convention of computer hackers."

Team members transmitted sensitive non-public information about major financial institutions using their personal e-mail accounts. They used unencrypted laptops to store sensitive information, in violation of SEC policy--and contravening their own advice to the stock exchanges. Their laptops also lacked antivirus software. The laptops contained “vulnerability assessments and maps and networking diagrams of how to hack into the exchanges,” according to one SEC official.

The investigation also found that members of the team took work computers home in order to surf the web, download music and movies, and other personal pursuits. They also appeared to have connected laptops containing sensitive information to unprotected wi-fi networks at public locations like hotels--in at least one reported case, at a convention of computer hackers.

And yet these folks claim they can help secure everyone else's computers?

Filed Under: cybersecurity, dhs, federal government, homeland security, irs, nrc, sec, senate

If You're An American Who Believes In The 4th Amendment, You Have No Excuse Not To Sign This Petition

from the don't-let-it-continue dept

We've written a few times recently about the importance of ECPA reform, to bring a woefully out of date law into the 21st century. Specifically, we've urged people to sign this White House petition in favor of ECPA reform. That petition closes soon, and it's still a bit short of the 100,00 goal.

Why is this important to you? Because, without it, it's much easier for the government to snoop on your emails without a warrant. What people want is for emails and regular mail to be treated the same, which is simply not the case today. While this is a separate issue from the NSA stuff, it does matter quite a bit, and this is a chance for there to be a real win that helps protect your privacy. Fighting against this proposal are a variety of government agencies, led by the IRS and the SEC, which have made good use of this loophole to read emails without getting a warrant. This is not what the law was intended for at all. It's a loophole based on the outdated law, which was written in 1986, before anyone could comprehend things like web-based email. The IRS and SEC like having this loophole, and they don't want it to go away. In fact, they want it to be made explicit, rather than an accidental loophole of history. That should be a massive affront to folks who believe in the 4th Amendment and the basic concept that a search should require a warrant based upon probable cause.

I know that many people have dismissed the whole concept of White House petitions, and take a rather cynical view of the whole thing. That's a very dangerous approach here, only helping to further the problems:

1. Yes, it's true that the White House has ignored certain petitions in the past. It's also true that there are certain issues where the White House doesn't really seem to care what people have to say, it's made up its mind.
2. But, that is not always the case, and the White House has used these petitions to take strong positions in the past -- including on things like SOPA and mobile phone unlocking. When accompanied by a strong campaign beyond just the petition, the White House seems open to taking certain issues more seriously. This is one of those.
3. By all indications, there are some in the White House who agree that ECPA is out of date and needs to be fixed. There appears to be an internal debate about where the official White House position will be -- whether it's siding with the IRS and SEC -- or with the 4th Amendment rights of the public. Having a ton of signatures from the American public on their side will absolutely help those in the White House who support real and meaningful ECPA reform push back against the agencies.
4. This isn't an empty gesture. There are bills in the House and Senate to fix ECPA, close the loopholes and protect your 4th Amendment rights. Getting White House support could finally push those bills over the edge and make them law.
5. Sticking with the cynical approach and refusing to sign guarantees failure. Not signing works to the advantage of the IRS and SEC and others who like using this loophole. Even if you're cynical about this, signing the petition at least gives it a chance to influence the debate.

And, yes, I know that outside of the general debate over ECPA, people will look at the NSA situation and argue that it doesn't really matter what the law says. That's not true. Yes, the NSA issue is a big one that needs to be dealt with, but this is about a loophole that goes way beyond the NSA, and is used and abused by different government and law enforcement agencies. Here's a real chance to push back on that and to score a real victory for privacy. Letting cynicism and apathy dictate your move here guarantees that the forces pushing against your 4th Amendment rights win. So take a chance and sign the petition.

Filed Under: 4th amendment, ecpa, ecpa reform, irs, petition, privacy, sec, warrants

The IRS And SEC Want To Snoop Through Your Email Without A Warrant; Don't Let Them

from the speak-up,-fix-ecpa dept

We've talked a lot about ECPA reform -- which is the incredibly outdated "electronic communications privacy act" which actually makes sure that you have less privacy than other forms of communication. This isn't necessarily on purpose, but because the law was written in the mid-1980s when email itself was a relatively new concept. It includes some bizarre distinctions between opened and unopened emails and if a message has been "left on a server" for more than 180 days (at which point it's considered "abandoned" and not subject to a warrant). Obviously it never anticipated the kind of internet we have today. It also goes against basic 4th Amendment principles and treats electronic messages differently from physical messages.

There actually is a fair bit of support in both Congress and the White House to fix this... if we can get enough public support behind it, which includes getting more people to sign this petition. As with SOPA, there's a strong suggestion that if this petition tips the scales at 100,000, we can get the White House to come out in favor of ECPA reform.

What's standing in the way? Well, a bunch of government agencies, honestly. There are the obvious ones like the DOJ and DHS. That's to be expected. They always want to make it easier to snoop through emails and written communications. But apparently some of the strongest voices trying to block ECPA reform within the government are coming from the SEC and the IRS, because they too see plenty of advantages in trying to snoop through emails without having to take the trouble of getting a warrant.

As I write this, I'm participating in a Reddit AMA (Ask Me Anything) with Chris Calabrese from the ACLU, Mark Stanley from the Center for Democracy and Technology and Julian Sanchez from the Cato Institute. This coincides with a day of action involving a bunch of companies and organizations trying to get more people to speak out on the importance of ECPA reform. And, finally, the folks at TechFreedom have put together a great infographic, which we've also embedded below.

Filed Under: ecpa, ecpa reform, emails, irs, messaging, privacy, sec, warrants

Congress Asks Eric Holder To Explain Why NSA Supplies DEA Info Which It Then Launders To Go After Americans

from the about-time dept

A few weeks back, Reuters broke the news that the NSA (and other intelligence agencies) were funneling information to the DEA, IRS and others, telling them about potential wrongdoing, but then also telling them to effectively launder the information, so that it never came out where they got the information from, and that it didn't show up in any court case. For example, they might send info to the DEA about a likely drug deal, and the DEA would then tell its agents that they should come up with a pretense to stop a certain truck at a certain truck stop at a certain time. The agents would work with local police to concoct a reason to pull the truck over, and voila, drugs found. But, most importantly, at no point would the fact that such information was used to lead to the stop be revealed, and that's unconstitutional. If you're accused, you're supposed to have access to all of the evidence being used against you.

It appears that a bunch of folks in Congress want some answers about this program, and so Eric Holder has been sent yet another letter with questions from a bunch of Senators and Representatives, and there will be yet another briefing where I'm sure he'll promise a full investigation into the practice and maybe promise some internal changes to guidelines, but where nothing will actually change. It really does seem like a very significant portion of Eric Holder's job these days is to respond to the latest scandal of government overreach by promising that he'll fix it, and nothing much ever seems to change.

Filed Under: congress, dea, eric holder, irs, nsa, sod