'Trusted Third Parties' Add One More Link In The Supply Chain Between Your Data And Government Requests

from the a-new-wave-of-data-brokers dept

Just how many entities have their hands on your data when the NSA makes requests? Well, it's not just the service providers and any number of analysts at the NSA. There's a whole industry subset of third parties that actually handle requests, implement wiretaps, direct searches for communications/data and deliver this information to the intelligence agency.

ZDNet's Zack Whittaker has the details.

With permission from their ISP customers, these third-parties discreetly wiretap their networks at the behest of law enforcement agencies, like the Federal Bureau of Investigation (FBI), and even intelligence agencies like the National Security Agency (NSA).

By implementing these government data requests with precision and accuracy, trusted third-parties — like Neustar, Subsentio, and Yaana — can turn reasonable profits for their services.

Little is known about these types of companies, which act as outsourced data brokers between small and major U.S. ISPs and phone companies, and the federal government. Under the 1994 law, the Communications Assistance for Law Enforcement Act (CALEA), any company considered a "communications provider" has to allow government agencies access when a valid court order is served. No matter how big or small, even companies whose legal and financial resources are limited do not escape federal wiretapping laws.

Subpoenas, search warrants, court orders -- even those from the FISA court -- run through these trusted third parties. From the information Whittaker has gathered, this market seems to have evolved out of limited legal resources retained by smaller ISPs and service providers. Incoming requests are forwarded to these companies, which vet them for legal issues and determine what exactly needs to be done to satisfy them. Some of this is just CYA -- an extra insulating layer to serve as a buffer between the service provider and the possibly aggrieved customer(s). Some of it is due to practicality. Smaller ISPs and service providers do not retain lawyers with the security clearance needed to inspect/challenge certain orders.

One of those attorneys, who declined to be named for the story because the person holds top-secret security clearance, explained that although hundreds of lawyers have the same clearance — including those serving terror suspects in Guantanamo Bay — very few have been in front of the FISA Court to defend their clients. These clearance-holding lawyers have been in high demand over the past year representing major Silicon Valley companies implicated in the NSA's surveillance programs.

For the majority of smaller companies (as well as larger ones, who have refused to comment on challenging such warrants), complying with data demands may be their only option. The vast majority, however, do not have the resources to handle such requests.

"If they don't have an internal lawyer [reviewing FISA warrants], they could use a third-party service. That third-party can't provide legal advice, but it can create a system for reviewing the data, pulling, and processing the data," the security clearance-holding attorney said.

Because these companies have the sort of clearance the ISPs lack, smaller ISPs are often nothing more than dumb terminals for government agencies to manipulate. The trusted third parties are often the only entities that see certain court orders and requests, and ISP participation in the approval and response processes is often non-existent. In many cases, the ISP cannot even see the court order it's being directed to comply with.

"Of what worth is our permission when we don't even know what we're being asked to give access to?" a senior staffer at [ISP] Cbeyond admitted.

In the unlikely event that a request is rejected, it's usually done by the third parties, again without the participation of the ISP itself. The trusted third parties are better equipped -- in terms of legal team security clearance -- to do this than smaller ISPs are, but that additional expertise is of little use should ISPs decide to directly challenge a court order.

If the ISP or phone company decides to fight a warrant, the third-party can stand back and wash its hands of it.

Burr said Neustar "has and will" reject subpoenas that are inadequate for one reason or another. But should its clients choose to fight a FISA warrant or court order it believes to be overbroad, Neustar will not join the battle in court.

Other trusted third-parties take a similar approach.

"We're out of the picture," said Marcus Thomas, chief technology officer at Subsentio, another trusted third-party company, founded in 2004, and based out of Littleton, Colorado.

While the third parties may be collecting money from ISPs for handling data and intercept requests, their desire to stay in the government's good graces appears to outweigh any loyalty to the businesses that retain their services.

"It's the provider's problem," [Yaana Executive VP Tony] Rutkowski said. "The nice part about the trusted third-party business is that just from a liability standpoint, we don't want to be left holding the bag here." [Yaana CTO David] Grootwassink agreed. "We provide the gears. We don't get involved in fights between the governments and our clients."

And therein lies part of the problem. While it may be easier to turn over what is largely a compliance function to third parties, there's very little oversight into these companies' actions and processes. Even the ISPs that hire them seem to have limited insight into what's actually being done. These go-betweens have carefully dodged liability by refusing to be involved in legal challenges, leaving underequipped ISPs to fight their own battles. While some trusted third parties have issued transparency reports detailing the requests they've facilitated, this basically leaves the public to perform the oversight, something of very limited use. About all the public can do is switch providers, which, if even an option, only puts them in the hands of another company using the same practices.

Filed Under: 4th amendment, data, isps, phones, records, surveillance, third parties

Counter-Strike Player's Twitch Stream Captures His Own SWATting... And Some Questionable Police Behavior

from the LOUD-NOISES dept

One of the more unfortunate side effects of police militarization isn't directly the fault of law enforcement agencies or their enablers at the Pentagon. But it is related. Thanks to the Drug War, nearly every town in the US has a SWAT team or one minutes away, whether they need one or not. This has led to the rise of SWATting -- calling in a false report in order to send a charged-up SWAT team to raid someone's home.

This has been used by scam artists against security bloggers and by trolls against celebrities, but has especially seen an increase as a form of harassment within the gaming community. A recent incident is not only notable for dragging schools into the mix, but also for being caught on tape.

Jordan "Kootra" Mathewson, who streams his sessions on Twitch, was streaming from an office near a Littleton, CO school (which was put on lockdown) when the SWAT came "knocking."

What's interesting about this (beyond the lengths griefers will go to make someone miserable) is some of the actions caught on video.

At the beginning, the SWAT team does the usual cop thing of everyone yelling at the same time because that apparently works better than having a point person designated to deliver concise, well-enunciated instructions. (Note: it does work better than other situations where officers have yelled contradictory instructions over each other ["Stand up!! Lay on the ground!!].) Bonus points for swearing because no one takes guys with assault rifles and Kevlar vests seriously unless they use variations of the word "fuck."

About two minutes in, after Mathewson has been searched and cuffed (and held on the ground by SWAT boots, just in case), an officer asks where his phone is. He picks it up and casually starts looking through it. First off, the new rules say get a warrant, although I'd imagine an active shooter situation (even if fake) falls under exigent circumstances. But there doesn't seem to be any hesitation on the officer's part. He just asks where Mathewson's cell phone is… and then takes it. He continues looking through it for the next couple of minutes while asking questions occasionally.

Also of note: around the 4:30 mark, Mathewson explains to the cops that he's streaming. Once he explains that people are watching, the attention shifts from Mathewson to the camera -- which the cops then disable. They have no reason to and they certainly don't have the right to, but they just go ahead and do with a notable lack of hesitation. (The same cop who casually started looking through Mathewson's phone leads the way.)

As the camera is gracelessly dismounted, you can hear the other SWAT member ask: "If you heard us yelling, why didn't you move?" Mathewson answers that he had earphones on, but the better answer would have been, "Because I didn't want to get shot." I can think of no earthly reason why someone being raided by a SWAT team would make any movements that he or she hasn't been directed to make. At the point that Mathewson realizes what's happening, the SWAT team is still clearing rooms. Had he decided to make a surprise appearance in the hall, there's a good chance he would have-- at minimum -- been subjected to even rougher treatment. There's also a rather healthy (ha!) chance that someone might have fired off a round or two, given that these officers were looking for an active shooter and not, say, a serial parking law violator.

Mathewson has to walk them through the whole process of killing the stream (audio can still be heard for another minute or so), leaving the rest of the narrative to be captured in police reports. Fortunately, nothing went "wrong" in this raid, so no one was wounded or subjected to excessive amounts of force. It's also rather fortunate that Mathewson was using headphones, because one can only imagine what might have happened if the steady stream of Counter-Strike gunfire had been audible.

There have been several SWATings in recent months, but none of them have given us a look at one in progress. The SWAT team did nothing wrong by taking the threat seriously, although one officer's actions definitely approach the outer edges of what's acceptable/Constitutional and he did so with a practiced ease.

Filed Under: counter strike, jordan mathewson, kootra, law enforcement, phones, recording, search, swatting, warrant

NYPD Officers Expect Public To Be Stupider Than They Are; Justify Shutting Down Recording With 'iPhones Are Guns' Claim

from the you-can't-fix-stupid,-you-can-only-assign-it-to-desk-duty dept

When the appeal to authority fallacy doesn't work, try appealing to ludicrousness. That seems to be the M.O. in play here. NYPD officers arrested a bicyclist for running a red light, but that arrest wasn't effected until the bicyclist attempted to film the interaction. Here's all ten seconds of it before the cop shut the arrestee's impromptu shooting down.

Will Paybarah, the scofflaw in question, received this memorable explanation for the hasty neutralizing of his iPhone while sitting in the back seat of the unmarked squad car.

I was told by another officer while in the car that recording a police officer was illegal because people are using iPhones as guns and shooting cops through the camera lens...I told him that I have the right to be recording a cop and he said that there were incidents, specifically in uptown Manhattan where a kid shot a cop with his iPhone. Straight face. Very serious.

Now, it's true that recording footage is often slangily referred as "shooting footage," and that cops are increasingly on the receiving end of these types of "shootings." But there has yet to be any evidence produced that indicates phones and cameras are being converted into guns on any sort of mass scale or that these new hybrids are so common that this "fear" has a rational basis.

A kid may have "shot" a cop with his iPhone, but without any data to back up this claim, the only thing taking a hit was the officer's mistaken belief that public service is afforded an expectation of privacy. Cops telling citizens this sort of cop-centric urban legend to defend the trampling of the First Amendment indicates that they believe citizens are idiots.

Paybarah, meanwhile, spent 13 hours in lockup over a red light infraction. Well, not entirely. By the time the cop was finished effecting the arrest of the person holding the theoretically weaponized iPhone, charges of resisting arrest, obstruction and criminal mischief had been added -- charges that are just as malleable as cops' minds.

Cops walk or drive by plenty of people holding "weapons" in plain sight, all of them unlicensed and potentially deadly. An overwhelming majority of the public wouldn't even consider leaving the house without being "strapped," and yet, months and years go by without cops being shot in the face by iGuns. Perhaps the police chalk up this low rate of deadly incidents to their expedient neutralization of camera gun wielders. The price of freedom is eternal vigilance and all that, and the cops can't be expected to protect the freedoms they'll take from you if they're constantly being "shot" by armed citizens.

Better safe than sorry -- that's the real intent of the Constitution. An officer getting home safe (and unrecorded) at the end of every shift is a far worthier goal than the vague rights pre-supposed to idiot citizens by a handful of amendments.

Maybe the cops should switch out their service pieces for deadly cameras -- you know, in order to keep up with "the streets" in the arms race. That way, the next time they get drunk and start shooting, the end result will be nothing more than a bunch of shitty Instagrams.

Filed Under: filming police, guns, iphone, nypd, phones

The Stupidity Of Installing Bloatware That No One Uses... And Everyone Hates

from the just-a-bad-idea-all-around dept

A new study from Strategy Analytics highlights what you almost certainly already know, that no one actually uses the crappy bloatware apps that Samsung puts on its phones. This shouldn't be a surprise at all. But I actually wanted to highlight a different issue I'd noticed recently: which is that not only do people not use the bloatware apps, by making them both default and unintstallable, Samsung pretty guarantees that everyone hates those apps.

Now, I can imagine the execs at various app developers who got all excited when they had a chance to become a default app on a Samsung flagship phone like the S3, S4 or S5. After all, Samsung sells a ton of these phones. So if Samsung approaches you and offers to make you a default, it's got to be hard to say no. Because what they're offering is to put your app in front of many millions of potential users. And given the big hurdle of getting people to even download free apps, that must seem like a huge victory.

Until you realize that everyone hates unnecessary and unwanted bloatware. Beyond the study above showing that no one uses those apps, I recently looked at the Google Play Store reviews of many of the Samsung choices for bloatware. And pretty consistently, the large majority or reviews are about how they don't know why the app is on their phone and they're pissed that they can't delete it. Take, for example, Blurb Checkout, part of Samsung's near-totally-useless "book-making app." People absolutely loathe it almost entirely because it's a bloatware default app. Out of over 22,000 reviews, it has over 16,000 one star reviews. And nearly all of the reviews look like the "highlighted" ones on the page: Or how about the Lumen Toolbar? Frankly, I have no idea what it does, but it's there. The aggregate reviews on this aren't quite as bad as Blurb above, and there do appear to be some people who really do like this toolbar. But the reviews are still filled with angry rants: I'm sure HP thought it was a great way to jumpstart its mobile printing efforts by having its HP Print Service Plugin installed as default bloatware on Samsung (and, apparently, on Nexus) devices. Until everyone started yelling about how they want that crap off their phone. And, of course, none of this even touches on Samsung's own apps, in which it has weak copies of much better apps out there, such as S Health, S Memo and S Voice -- all of which are stuck on your phone, even though there are much better and much more functional alternatives available in the Play Store and elsewhere. The thing is, all of these apps could be the greatest possible apps in the world, but by making them part of preinstalled bloatware and making it so you can't uninstall them, it's pretty much guaranteeing that people will hate on these apps, making it even worse than just not using them -- they're actively harming the reputations of those apps for folks who might actually like them.

Filed Under: android, bloatware, phones
Companies: samsung

NSA Has Capability To Record And Store ALL Foreign Phone Calls In Certain Countries

from the collect-it-all! dept

The latest scoop from Barton Gellman, reporting for the Washington Post on documents Ed Snowden leaked, highlights an NSA program known as MYSTIC, with some snazzy clipart... and the ability to retrieve all recordings of phone calls in certain (non-US) countries going back at least 30 days. Apparently, this is a relatively new capability -- the program launched in 2009 and reached "full capacity" in 2011.

In the initial deployment, collection systems are recording “every single” conversation nationwide, storing billions of them in a 30-day rolling buffer that clears the oldest calls as new ones arrive, according to a classified summary.

The call buffer opens a door “into the past,” the summary says, enabling users to “retrieve audio of interest that was not tasked at the time of the original call.” Analysts listen to only a fraction of 1 percent of the calls, but the absolute numbers are high. Each month, they send millions of voice clippings, or “cuts,” for processing and long-term storage.

While the Washington Post agreed not to reveal what countries MYSTIC is operational in, it's difficult to see how the NSA could do this without assistance (knowing or unknowing) from the various telcos in the targeted countries. And, of course, once this effort is online, the NSA just wants to keep expanding it:

Some of the documents provided by Snowden suggest that high-volume eavesdropping may soon be extended to other countries, if it has not been already. The RETRO tool was built three years ago as a “unique one-off capability,” but last year’s secret intelligence budget named five more countries for which the MYSTIC program provides “comprehensive metadata access and content,” with a sixth expected to be in place by last October.

Basically, once the NSA has the ability to snoop on everyone's phone calls, it only wants to do more of that. And more and more. As Gellman's report notes, this seems to (once again) contradict claims by US officials, including President Obama, that "the United States is not spying on ordinary people who don’t threaten our national security... and that we take their privacy concerns into account." Of course, that all depends on how you define "spying." In the "collect it all" world of the NSA, merely collecting that data isn't considered "spying."

This program also helps to explain why the NSA has been so focused on getting that massive data center online in Bluffdale, Utah. There had been talk that the NSA had too much data to store and analyze effectively, but prior leaks didn't seem to involve enough data to really cause a problem. However, storing the audio of 30 days of every phone call in a half a dozen (or more!) countries could certainly add up quite quickly. And, indeed, that's what the documents suggest. Another document notes that this project "has long since reached the point where it was collecting and sending home far more than the bandwidth could handle." Hence: Utah.

And, of course, having full audio of all phone calls can lead to all sorts of detailed information, including information on Americans (who, remember, the NSA isn't supposed to spy on):

Highly classified briefings cite examples in which the tool offered high-stakes intelligence that would not have existed under traditional surveillance programs in which subjects were identified for targeting in advance. Unlike most of the government’s public claims about the value of controversial programs, the briefings supply names, dates, locations and fragments of intercepted calls in convincing detail.

Present and former U.S. officials, speaking on the condition of anonymity to provide context for a classified program, acknowledged that large numbers of conversations involving Americans would be gathered from the country where RETRO operates.

The NSA does not attempt to filter out their calls, defining them as communications “acquired incidentally as a result of collection directed against appropriate foreign intelligence targets.”

At this point, these kinds of leaks aren't that surprising, but this does confirm some people's suspicions about the NSA's capabilities -- and the continuing mission creep as it gets more and more powerful in what information it can collect and store.

Filed Under: mystic, nsa, phones, privacy, recordings, retro, surveillance

Another CA Cop Thinks A Cell Phone Might Be A Dangerous Weapon

from the 'to-serve-and-elicit-incredulous-laughter' dept

Citizens recording police activity often find their subjects in no mood to be photographed. These amateur photographers/filmmakers are threatened, attacked or dragged to the nearest police station and booked, using charges like "interference" or "disorderly conduct" or "walking in an alley" to make sure they don't walk away unintimidated.

A new thought process seems to be taking hold, however. As we covered a few weeks ago, police officers are now trotting out the bizarre theory that the cell phone filming them might be a weapon. Photography Is Not A Crime has rounded up another instance of a cop playing the "cell phone=gun" card in order to prevent being recorded.

A California cop who was being video recorded by a smartphone said she was in fear for her life because the phone could have possibly been a gun, marking at least the fourth time this year a cop in this country has uttered those nonsensical words.

The trend of insinuating cell phones can be guns began earlier this year when Juan “Biggie” Santana had his Sony Bloggie confiscated by Hialeah police officer Antonio Sentmanat in South Florida.

It continued when San Diego police officer Martin Reinhold slapped a phone out of Adam Pringle’s hands and arrested him while writing him a citation for smoking a cigarette on a beach boardwalk.

Then again in Arkansas when a cop ripped an iPhone out of a man’s hands who had been trying to document the Exxon oil spill outside Little Rock.

It certainly hasn't reached epidemic levels yet, but the argument seems to be increasing in popularity. The story we covered contained a statement by the police officer that indicated this new "cell phone=gun" logic is part of the training process.

Now, it's not entirely impossible to make a weapon shaped like a cell phone. It's just highly unlikely. PINAC's article contains a video of a cell phone/gun, but it seems to require a bulky, out-of-date antenna to hide the barrel. The weapon exists (or existed), but it (or any knockoffs) never made an appearance here in the US.

[T]hat weapon never even made it to the United States, according to ExCopLawStudent, a former cop turned law student who firmly believes in the right of officers to ensure their safety, but who also understands police paranoia doesn’t override the Constitution.

In 2000 or 2001, police in Europe discovered a four-shot gun disguised as a cellphone. Since then police officers in the United States have claimed on multiple occasions that civilians who were recording video with their cellphones had to put the phone down. Why? Because it could be a weapon.

Geez, guys, you’re killing us. There have been no cellphone guns recovered in the United States, according to the Bureau of Alcohol, Tobacco, Firearms, and Explosives. None. Zero. Nada. Zilch.

In addition, there are exactly zero court cases that discuss the issue. As a matter of fact, there is nothing in the legal world that discuss the issue. No law review articles, no trial or appellate briefs, nothing.

So, the threat of a weaponized cell phone is hovering at zero, or close enough to it to be laughable when a law enforcement officer uses this "danger" as an excuse to prevent being recorded. Even the supposedly trained-in-the-art-of-phoneguns cops don't take the argument seriously. Or at least no more seriously than the TSA agents who are instructed to consider 3 ounces or less of a liquid "safe," ignoring the fact that any traveler with opposable thumbs could pour 6 ounces of liquid into two three-ounce containers and sail right through the checkpoint with a "dangerous" amount of contraband.

[I]f Detective Shannon Todd of the Newark Police Gang Unit was really so stupid to believe that the phone could have been a gun, then why did she first order the citizen to place it back into his pocket?

The rhetoric is used solely to shut down filming. If this was an actual weapon, one presumes it would be confiscated and the carrier arrested, or at least detained until proper paperwork was produced (cell phone bill?). This also conveniently ignores the fact that many everyday objects that people carry around have also been converted into weapons at one point or another.

The only threat a cell phone presents to an officer making this assertion is the possibility of public embarrassment. I suppose we should be happy that these officers are at least going above and beyond the "you can't film me" argument and showing a little creativity in their shutdowns of amateur policewatchers. But this one crosses the "fine line between clever and stupid" and just keeps running.

Filed Under: phones, police, weapons