Supreme Court's Warrant Requirement For Cell Site Location Info Apparently Killed Another Domestic Surveillance Program

from the i,-for-one,-welcome-a-Supreme-Court-killing-spree dept

Oh, guess what? The NSA has ended another third party data collection -- one it hopefully ended right after the Supreme Court's Carpenter decision was released. Spencer Ackerman fills in the details at the Daily Beast.

U.S. intelligence agencies have stopped collecting cell-phone location data without a warrant on people inside the United States, the office of the director of national intelligence has affirmed.

Sounds good. Sounds like the NSA probably doesn't have a legal way to continue this warrantless collection now that the Supreme Court has ruled historical cell site location info is covered by the Fourth Amendment. It's been nearly 18 months since this decision was released. The letter sent to Ron Wyden by the ODNI indicates the Intelligence Community abandoned its harvesting of CSLI shortly after that ruling.

But, as Ron Wyden points out, the ODNI isn't willing to state publicly that the Supreme Court's decision was a contributing factor to its mothballing of the CSLI collection.

“The Intelligence Community has now publicly revealed that, since the Supreme Court decision more than a year ago, it hasn’t used Section 215 of the PATRIOT Act to track Americans,” Wyden said in a statement provided to The Daily Beast. “At the same time, the government is hedging its bets by not formally acknowledging that the Supreme Court case applies to intelligence surveillance…"

This is another of the NSA's Section 215 collections. The most famous collection under Section 215 was the one exposed by the first Snowden leak: phone call metadata. This collection was retooled by the USA Freedom Act, which forced the IC to approach telcos with targeted orders supported by reasonable suspicion. The NSA was apparently so used to just collecting it all, it couldn't manage to find a way to obtain this data without violating the law. It was abandoned and the NSA recommended to have it shut down forever. The FBI doesn't like that idea, though, and wants Congress to give the phone metadata collection -- along with everything else harvested under Section 215 -- a permanent reauthorization.

At least that's not going to happen. It looks like the phone metadata collection will now become the only thing that's truly forever: dead.

A forthcoming bill from the House judiciary and intelligence committees will reauthorize three other surveillance measures set to expire, but will not permit the Call Detail Records program to survive. With expiration set for Dec. 15, whatever the Senate does the Call Detail Records program, barring some eleventh-hour legislative chicanery, looks like the rarest of birds: a post-9/11 surveillance activity on course for extinction.

You can draw a straight line from the Snowden leaks to the death of this collection. The Patriot Act gave the NSA a handy way to spy on Americans. 14 years later, the USA Freedom Act scaled back that power, altering the program enough that the NSA couldn't seem to find a way to collect these records without violating the law. Five years after this minor surveillance reform effort, the program will be put out of its misery.

But the NSA has plenty of other collection authorities that will remain unchanged and mostly unexamined. Even this Section 215 collection -- which seemingly violates Supreme Court precedent -- hasn't received much public discussion. It seems clear warrantless collection of cell site location info is now illegal, but until more details head Wyden's way, we probably should assume the Office of Legal Counsel is trying to assemble a rationale that allows the Intelligence Community to route around the Carpenter roadblock.

But, if nothing else, the phone metadata collection is dead. Forever. And that's worth celebrating.

Filed Under: 4th amendment, cell site location info, csli, location info, nsa, odni, ron wyden, surveillance, warrants

Senators Wyden And Paul Put A Hold On Dangerous CASE Act; Will Propose Alternative

from the no-more-copyright-trolls dept

Last week we noted that the House (overwhelmingly) voted in favor of the CASE Act, which is presented as a "small claims court" for copyright issues, but which has significant Constitutional issues, and would almost certainly lead to an uptick in copyright trolling activity. As we noted, the bill still needed to go to the Senate, and it appears that this is (at least for now) being blocked by Senators Ron Wyden and Rand Paul who have put a hold on the bill, and will introduce an alternative approach.

Sen. Ron Wyden... is crafting alternative legislation to a bill that overwhelmingly passed the House and would create a voluntary small claims board within the Copyright Office... a Wyden aide told us. He and frequent partner here Sen. Rand Paul... recently placed holds on the Copyright Alternative in Small-Claims Enforcement (Case) Act... according to aides.

Wyden notes that the concept of enabling more access to copyright holders to an enforcement/remedy makes sense, but he has problems with the nature of the CASE Act:

Wyden says he agrees small copyright owners "are less likely" to reap the full benefits of the copyright system than major corporations like Disney or Sony. But he said the bill would "create an extrajudicial, virtually unappealable tribunal that could impose statutory damages of $30,000 on an individual who posts a couple of memes on social media, even if the claimant sustained little or no economic harm." The threat of litigation could stifle fair copyright use and free expression and enable copyright troll harassment, he said.

From that, it sounds like Wyden is working on some sort of compromise version that deals with the problems (including the fact that it's probably unconstitutional) and seeking a better approach for setting up a form of a small claims court for copyright violations. He did this last year with the Music Modernization Act as well, taking a really, really bad bill, and turning it into something that was actually okay (not great, mind you, but was a general improvement -- and one that got more or less everyone on board). Hopefully this new bill will do the same.

Unfortunately, it looks like those who have already decided the unconstitutional pro-copyright trolling version is the approach to take don't really want to deal with Wyden and Paul seeking a better approach:

Bill sponsor Sen. John Kennedy... told us of "two headaches" in the Senate Thursday. "We're working on it. I'm going to make them an offer they can't refuse," he said, declining to name names.

Hey, Senator John Kennedy, did you license that quote from whoever holds the copyright on The Godfather? Or are you ready to pay up to $30,000 for it?

Either way, that quote is fucked up. Wyden and Paul are seeking to make sure the bill is (1) Constitutional and (2) won't destroy lives. And Senator Kennedy thinks that's deserving of a Godfather-style threat? What is wrong with him?

Filed Under: case act, copyright, john kennedy, rand paul, ron wyden, senate, small claims

In These Partisan Times, The Only Thing That Gets Bi-Partisan Agreement Is That Blizzard Sucks

from the crossing-aisles dept

We live in partisan times. The left and the right might as well be cats and dogs, mostly incapable of living together and the subject of fascination by the public when they manage to work together in the slightest way. The country needs a rallying cry. Something to bring both sides of the aisle together to demonstrate to all that they can actually agree on things.

Blizzard appears to be that something. In the wake of the backlash against Blizzard for its actions taken to silence and punish eSports competitors that chose to voice support for the ongoing protests in Hong Kong, it seems that everyone from Alexandria Ocasio-Cortez to Marco Rubio agrees that the company needs to do much, much better.

Today, United States Senators Ron Wyden and Marco Rubio signed a bi-partisan letter with support from Representatives Alexandria Ocasio-Cortez, Mike Gallagher, and Tom Malinowski addressed to Bobby Kotick, CEO of Activision Blizzard, over the recent suspension of professional Hearthstone player Chung “Blitzchung” Ng Wai.

“We write to express our deep concern about Activision Blizzard’s decision to make player Ng Wai Chung forfeit prize money and ban him from participating in tournaments for a year after he voiced support for pro-democracy protests in Hong Kong,” the letter reads. “This decision is particularly concerning in light of the Chinese government’s growing appetite for pressuring American businesses to help stifle free speech.”

Now, it's true that this particular letter is toothless. It's also true that Blizzard has already reduced some of the penalties it levied on Chung, even though such a reduction was entirely besides the point and lowered the temperature on this controversy not at all. Still, what this really should highlight for the reader is that the public backlash against Blizzard has reached a volume that Congress critters are making public statements about it, and in a bi-partisan way. That's no small thing.

There is a great deal for one side or the other of the political aisle to be angry about these days. For Blizzard to unify that anger against itself should really inform the company's assessment as to how beneficial it is to bow to Chinese demands to stifle the speech of its competitors.

Again, this is a toothless letter...for now. But if it changes the calculus on future decisions Blizzard might take, that's a good thing.

Filed Under: alexandria ocasio-cortez, blitzchung, free speech, hong kong, marco rubio, mike gallagher, ron wyden, tom malinowski, video games
Companies: activision, activision blizzard, blizzard

FISA Court Finds The FBI Is Still Violating The Fourth Amendment With Its Abuse Of NSA Collections

from the no-surprises-here dept

The NSA isn't the only agency to abuse its surveillance powers. The FBI's ability to access unminimized data harvested by the NSA has resulted in abuse after abuse, as the FBI loves to use the massive data haul to perform "backdoor searches" of its domestic targets.

This concern has been raised repeatedly, most notably by Sen. Ron Wyden, who has been calling out surveillance abuses for years -- specifically calling out these backdoor searches and hinting (strongly) that they are much more prevalent than most people believed. Nothing much has been done about it, other than multiple federal agencies suggesting they too should be put on the ever-growing list of entities with access to the NSA's multiple collections.

A FISA Court opinion released by the Office of the Director of National Intelligence (ODNI) details even more abuse of the NSA's Section 702 collections by the FBI. When you give an agency the power to dig into massive amounts of data with minimal oversight, abuses will happen. But this goes further than "inadvertent" collections or erroneous access of unminimized data. This ruling [PDF] -- first reported on by the Wall Street Journal -- shows the FBI treats sensitive collections as its personal playground.

The October 2018 court ruling identifies improper searches of raw intelligence databases by the bureau in 2017 and 2018 that were deemed problematic in part because of their breadth, which sometimes involved queries related to thousands or tens of thousands of pieces of data, such as emails or telephone numbers. In one case, the ruling suggested, the FBI was using the intelligence information to vet its personnel and cooperating sources. Federal law requires that the database only be searched by the FBI as part of seeking evidence of a crime or for foreign-intelligence information.

In other instances, the court ruled that the database had been improperly used by individuals. In one case, an FBI contractor ran a query of an intelligence database—searching information on himself, other FBI personnel and his relatives, the court revealed.

The partially-redacted, 138-page opinion makes it clear the FBI has frequently abused its access to the NSA's surveillance collections, which include emails, phone numbers, and a host of other digital detritus. Using collections authorized only to be used for national security purposes to perform security reviews of FBI personnel is obviously contrary to the intention of the program -- a purpose that is always reiterated loudly any time someone suggests surveillance should be curtailed. This opinion vindicates Wyden's incessant demands the FBI come clean about its backdoor searches. Wyden argued the FBI abused this power frequently. This opinion makes it clear the FBI abuses its "backdoor" access to domestic data constantly.

The weirdest thing is the Trump DOJ argued in court the program the FBI abused cannot be modified without harming the security of the nation. Yep, the administration that claims the "Deep State" is out to get it showed up in court to argue the Deep State should not have its power curtailed.

The court rejected this faulty premise. It also pointed out how severely any misuse of this power contains the potential to harm dozens, if not thousands, of people. Considering the breadth of the collection, running a single improper search returns hundreds, if not thousands, of records the FBI has no business retrieving. Using the database to vet employees or perform natsec vanity searches does not comply with the restrictions on the FBI's searches, which are only supposed to return data related to criminal activity (and then only certain crimes) and/or foreign intelligence information.

As usual, Sen. Ron Wyden was the first to go on record criticizing the FBI and its backdoor searches following the release of the FISA opinion.

Last year, when Congress reauthorized Section 702 of FISA, it accepted the FBI's outright refusal to account for all its warrantless backdoor searches of Americans. Today's release demonstrates how baseless the FBI's position was and highlights Congress' constitutional obligation to act independently and strengthen the checks and balances on government surveillance. The information released today also reveals serious abuses in the FB's backdoor searches, underscoring the need for the government to seek a warrant before searching through mountains of private data on Americans. Finally, I am concerned that the government has redacted information in these releases that the public deserves to know.

Wyden makes good points. And they're points he's made for years. Unfortunately, the FBI continues to do the stuff it shouldn't and the public has to read between the redactions in an (often vain) attempt to see what's being done to them in the name of "national security."

The abuses will continue until Congress or the FISA Court decide they've seen enough. While both entities have chastised agencies with access to NSA collections, neither have taken any action that will head off future misuse of surveillance databases in the future. We're a reactionary nation when it comes to surveillance abuse and that's just not going to prevent future abuses. But that's the nature of the national security beast. No one's allowed to know what's going on until after everything bad has happened.

Filed Under: 4th amendment, backdoor searches, fbi, fisa court, fisc, nsa, odni, ron wyden, vanity searches

Clapper Continues To Pretend He Didn't Lie To Congress About Domestic Surveillance Programs

from the six-years-of-deflection dept

James Clapper is going to take his Section 215 lie to his grave. One day after the first Snowden leak exposed the breadth of the NSA's phone metadata program, Sen. Ron Wyden asked the then-Director of National Intelligence if the agency collected data on Americans. Despite published documents clearly showing otherwise, Clapper went with this answer:

Wyden: Does the NSA collect any type of data at all on millions or hundreds of millions of Americans?

Clapper: No sir.

Wyden: It does not?

Clapper: Not wittingly. There are cases where they could, inadvertently perhaps, collect—but not wittingly.

Since everyone clearly knew he was lying, Clapper spent the next several days claiming he wasn't. First, he said he meant the NSA wasn't "voyeurestically" reading everyone's emails. Good, but not what Wyden asked. Then he said it was the only response he could give to Wyden's "when did you stop beating your wife" question. Then he claimed he thought Wyden was asking about another collection entirely: the foreign-facing Section 702 program (which does, inadvertently, collect a lot of US person data/communications).

This is the legacy Clapper has secured for himself. He won't be remembered for his IC leadership or his post-IC career talking headmanship. Nope, it will be his super-weak, super-transparent lie, delivered to a US Senator against a backdrop of leaked documents showing the NSA did "wittingly" collect data on hundreds of millions of Americans.

Nearly six years later, Clapper is telling the same story to anyone who asks him about this hearing, ensuring the word "Clapper" and "lie" will remain inseparable. The Section 215 program Clapper was alluding to -- the program exposed in the first Snowden leak -- is back in the news, thanks to an unexpected early retirement.

In an interview with CNN about the surprise Section 215 shutdown, Clapper again pretended he didn't know what program he was being asked about.

“As far as the comment, the allegation about my lying, I didn’t lie, I made a big mistake and I just simply didn’t understand what I was being asked about. I thought of another surveillance program, Section 702 of the Foreign Intelligence Surveillance Act when I was being asked about Section 215 of the Patriot Act at the time, I just didn’t understand that...”

Clapper's repetition of this excuse hasn't made it any more believable. None other than Senator Ron Wyden popped up on Twitter to point out Clapper's lies about his lie.

If you can't see/read the tweet, it says:

James Clapper needs to stop making excuses for lying to the American people about mass surveillance. To be clear: I sent him the question in advance. I asked him to correct the record afterward. He chose to let the lie stand.

That's the face of IC leadership, as portrayed by James Clapper. Clapper managed to exit the public sector unscathed, turning over a limping surveillance ship to his successor while stepping into the private sector with no threat of punishment hanging over his head. He lied to Congress and got away with it. And he's going to spend the rest of his life pretending he didn't.

Filed Under: james clapper, lies, mass surveillance, nsa, ron wyden, section 215

Google, Apple Called Out For Hosting Saudi Government App That Allows Men To Track Their Spouses' Movements

from the not-a-good-look dept

Seems like this would be something that would go without saying: if you're an American tech company, don't willingly assist oppressive regimes in the oppression of their populace. Twitter is forever helping the Turkish government silence critics and journalists. Facebook has allowed governments to weaponize its moderation tools, quite possibly contributing to government-ordained killings.

Now, Ron Wyden is calling out both Apple and Google for making it easier for Saudi Arabian men to treat their spouses (and employees) like possessions, rather than people.

Apple and Google have been accused of helping to "enforce gender apartheid" in Saudi Arabia, by offering a sinister app which allows men to track women and stop them leaving the country.

Both Google Play and iTunes host Absher, a government web service which allows men to specify when and how women can cross Saudi borders, and to get close to real-time SMS updates when they travel.

There's really no reason either company should be hosting this app in their app stores. If Absher's creators want to distribute an app that prevents certain Saudi citizens from being treated as equals, they're free to host it on their own site. It's not like the developers don't have the clout to go it alone. The app is developed and supported by none other than the Saudi government.

This isn't the sort of thing American companies should be giving platform space to, even if it technically meets the inconsistent standards both companies apply to app submissions.

As critics have pointed out, both companies have policies against apps that "facilitate threats and harassment." Absher may have some benign functions built in (like paying parking tickets) but the overall point of the app is to allow Saudi men to dictate when and where their wives can travel, as well as be alerted to any movements suggesting their spouses are trying to escape the horrible abuses allowed by this country's laws. Threats and harassment are all but guaranteed, and that's without even delving into the app's ability to provide employers with 24-hour surveillance of their employees.

Seems like the easy decision would be to pull the app. What's the potential downside? An oppressive regime complaining about a slight dip in oppression?

Filed Under: absher, app stores, ron wyden, saudi arabia, surveillance
Companies: apple, google

Another Day, Another Massive Cellular Location Data Privacy Scandal We'll Probably Do Nothing About

from the ill-communication dept

We've noted a few times now that while Facebook gets a lot of justified heat for its privacy scandals, the stuff going on in the cellular data and app market in regards to location data makes many of Facebook's privacy issues seem like a grade-school picnic. That's something that was pretty well highlighted by the recent Securus and LocationSmart scandals, which showcased perfectly how cellular carriers and location data brokers routinely buy and sell your daily travel habits with only a fleeting effort to ensure all of the subsequent buyers and sellers of that data adhere to basic privacy and security standards.

This week, Joseph Cox at Motherboard dropped yet another bombshell report on this subject, noting how he was easily able to pay a bounty hunter $300 to obtain the (supposedly) private location data collected by his cellular provider (T-Mobile). Much like the Securus scandal, the problem once again is the countless location data brokers and third party vendors which are being sold this data, then doing pretty much whatever they'd like with it. In this instance, his data was collected by T-Mobile, shared with brokers and aggregators like Microbilt and Zumingo, then in turn shared with bail bond outfits and private investigators:

"Microbilt buys access to location data from an aggregator called Zumigo and then sells it to a dizzying number of sectors, including landlords to scope out potential renters; motor vehicle salesmen, and others who are conducting credit checks. Armed with just a phone number, Microbilt’s “Mobile Device Verify” product can return a target’s full name and address, geolocate a phone in an individual instance, or operate as a continuous tracking service."

Cellular carriers make a small fortune collecting and selling this data, and there's virtually no oversight of the practice. Consumers often sign one privacy agreement with their cellular provider, which in turn is then broadly interpreted as a green light down a long road of companies which then collect and sell that data in turn. As we saw with the Securus scandal (when a local Sheriff was busted snooping on the private cellular location data of Judges and fellow law enforcement officers), everybody in this chain of dysfunction likes to play stupid when the problem repeatedly comes to light. The same thing occurred here:

“We take the privacy and security of our customers’ information very seriously and will not tolerate any misuse of our customers’ data,” A T-Mobile spokesperson told Motherboard in an emailed statement. “While T-Mobile does not have a direct relationship with Microbilt, our vendor Zumigo was working with them and has confirmed with us that they have already shut down all transmission of T-Mobile data. T-Mobile has also blocked access to device location data for any request submitted by Zumigo on behalf of Microbilt as an additional precaution.”

When the NY Times broke the Securus scandal story last year, cellular carriers all played stupid, insisted they'd ceased the sale of such data, and breathlessly assured everybody that this behavior wouldn't happen again. When Senator Ron Wyden complained, you might recall that T-Mobile CEO John Legere took to Twitter at the time to insist he'd learned the error of his ways:

Apparently not.

Needless to say, Wyden, who has been pushing new privacy legislation, isn't particularly impressed:

If you were an industry hoping to avoid government regulation of your business, you'd think you'd be a little more cautious in the way you treat private data. But as we've noted countless times, this kind of cavalier treatment of private data is the norm for telecom. From hoovering up your clickstream data to covertly modifying data packets to track you around the internet, telecom has long played fast and loose with consumers' private data. Some have even flirted with the idea of only seriously respecting your privacy if you pay an additional fee, effectively making consumer privacy a luxury feature.

So while broadband giants will surely whine incessantly during the looming quest to pass some meaningful rules of the road, it's worth remembering they had ample opportunities, over decades, to avoid stricter government intervention by adopting better, more ethical business practices. It's also worth reminding folks that ISPs lobbied furiously to convince the GOP to kill some fairly basic privacy protections at the FCC that would have required ISPs clearly inform users who is buying and selling this data, giving users a little more control over how it was shared.

And it's also worth noting that even without legislation or those rules, the FCC still has Section 222 authority to police this kind of behavior. While the FCC's privacy rules were killed, mobile carriers are still subject to CPNI rules for voice calls, which were expanded in 2005 to include subscriber location information. The bottom line is that the Ajit Pai FCC could easily address this problem using the authority it has now, they've just chosen not to because it might just hurt telecom revenues. The FTC could also probably ding T-Mobile for being "unfair and deceptive" under Section 5 of the FTC act, yet has been similarly mute as carriers bullshit their way around their failures on this front.

All of that said, there's countless folks who think they're taking meaningful steps to protect their privacy by deleting Facebook (or on-phone apps), yet are oblivious to the perils of walking around with a stock carrier phone in their pocket. It might be time to stop being quite so collectively naive about US privacy practices if we're going to have a serious (and undeniably difficult) adult conversation on what privacy rules of the road should look like. One thing we can probably mostly agree upon: this practice of hoovering up your every move and selling it to an ocean of companies with little to no real attempt to protect it is behavior we need to change, one way or another.

Filed Under: bounty hunters, john legere, location data, mobile operators, privacy, ron wyden, selling data
Companies: at&t, microbilt, sprint, t-mobile, verizon, zumingo

Senator Wyden Releases Draft Of Privacy Rules That Silicon Valley Probably Won't Like Very Much

from the but-will-it-help? dept

As I've pointed out repeatedly, we're really really bad at regulating "privacy" in large part because most people don't understand privacy -- and it means different things to different people. And, so far, most attempts at regulating privacy have created massive negative consequences, while doing very little to actually protect privacy. The ones most making the news are the GDPR in the EU (though reaching well outside of the EU), which is a total mess and California's unmitigated disaster of a privacy bill that was passed in an insane rush to stop an even worse privacy law from being on the ballot. And, of course, all of this comes against the backdrop of various companies doing a horrifically bad job of protecting the public's private information.

Given all of that, it is inevitable that Congress will, at some point, attempt to pass some sort of privacy bill. And, it seems likely that it will be a disaster. In the last year or so, Senator Ron Wyden, who historically has been seen (unfairly and inaccurately) as an "ally" of Silicon Valley companies is now the first to throw his hat into the ring, releasing a discussion draft of the bill (you can also see a one pager about the bill and a section by section breakdown -- all also embedded below).

Above, I mentioned that it's been unfair to argue that Wyden was a booster of Silicon Valley companies. If you look at his history, he has always been focused mainly on being an ally of the users of the internet. Many times, those two things align, but when they do not, Wyden has repeatedly taken the side of the users, not the companies. And that is the case here, for the most part. Over the last year, Wyden has been on a bit of a rampage in basically telling the companies that they've had decades to do the right thing in regards to protecting their own users, and they have failed to do so.

Reading the new bill in that context puts things into perspective. The key parts of the bill, as described in the one-pager are as follows:

1. Establish minimum privacy and cybersecurity standards.
2. Issue steep fines (up to 4% of annual revenue), on the first offense for companies and 10-20 year criminal penalties for senior executives.
3. Create a national Do Not Track system that lets consumers stop third-party companies from tracking them on the web by sharing data, selling data, or targeting advertisements based on their personal information. It permits companies to charge consumers who want to use their products and services, but don’t want their information monetized.
4. Give consumers a way to review what personal information a company has about them, learn with whom it has been shared or sold, and to challenge inaccuracies in it.
5. Hire 175 more staff to police the largely unregulated market for private data.
6. Require companies to assess the algorithms that process consumer data to examine their impact on accuracy, fairness, bias, discrimination, privacy, and security.

A lot of the bill is really in giving the FTC more resources and power to go after companies for failing to protect the privacy of users. And, I think putting some level of pressure on companies to take these issues more seriously could really help.

I think there's a lot in the bill that is carefully thought out and worthwhile, but I still have a number of significant concerns. The headlines around this bill have focused on the fact that it includes potential jail time of 10 to 20 years for senior execs who sign off on annual "data protection reports" to the FTC, in which those reports "knowingly" misrepresent information (it also includes GDPR-esque fines of 4% of gross revenue, even for first time offenders). I do think there's value in creating real punishment for company execs that knowingly misrepresent information concerning the privacy of their users, but I do worry how much this might impact the willingness of good people -- especially potential chief privacy and chief information security officers -- to agree to take these jobs with large companies. While the "knowingly" part of the requirement is important, I can envision quite intense legal battles over the level of knowledge such execs had in signing off on these documents. Yes, this would get them to take those issues seriously and go over such documents carefully. But, I do worry that this could scare off many good people from taking these jobs.

Similarly, the fact that these massive fines apply to the very first offense could be seen as problematic as well. It's great to say that even one mistake is one too many, but is that realistic? It is not easy to seal off every possible vector of attack. There are always new attacks. And, as it stands right now, there are only a few companies who have the resources and ability to really harden their systems to this level -- and this bill could lock in those providers and leave out the ability of smaller companies to challenge them in the market (there is a limited safe harbor for smaller companies, but as soon as a company reaches a reasonable size, the rules apply to them).

I also do wonder about the "minimum privacy and cybersecurity standards" that the FTC will be authorized to detail. Again, on its face, this sounds like an okay idea, but there are a lot of devils in those details. Too often "standards" like this, if not properly constructed, could limit potential innovations or business models that wouldn't actually negatively impact people's privacy, but won't be allowed out of a fear for violating these standards.

While I am supportive of bringing back the concept of a Do Not Track system, I find the requirement for companies to "offer a paid version of their product or service, for which they can charge no more than they would have made by sharing the user's data" potentially a complete mess (the bill has a lot of conditions on this that might limit the problems, but it's not clear why this is necessary in the bill). Again, that's something that sounds nice in theory, but would require a pretty big shift for many companies -- which would mean a lot of new costs that it's unclear they can even attempt to recoup. It also has the potential of cutting off a number of new business models, as there are potential businesses where such a setup wouldn't even make any sense. Again, conceptually, this idea could make sense for companies, but requiring it could have significant consequences.

A final major concern: it does not appear that this bill would pre-empt state efforts, like California's giant mess of a privacy bill (and any other attempts by other states). That also seems like something any federal bill should include to avoid a patchwork of impossible to follow laws in every single state.

That's not to say there aren't parts of the bill that are worthwhile -- and the intent behind it is well meaning. Companies do need to clean up their act and recognize what a mess they've caused. I do like the idea of standardizing APIs to allow users to use other apps to access and process the information and data that companies hold on them. That could be tremendously useful in moving to a world where individuals can take back more control over their data. I also appreciate the specific point that the rules do not apply to media organizations, as we've already been dealing with the fallout from the GDPR where people are claiming the data protection rules there can prevent media organizations from even reporting on certain people.

But, in the end, I'd prefer that be done more by the companies themselves in recognizing that they're better off pushing control of the data out to the end users, rather than feeling the need to hoard it all themselves. I recognize that Wyden's view on this is basically "they had their chance, and they failed" and perhaps that's true. But I still worry about the unintended consequences from locking in some of these ideas.

At this point, the bill is still a "discussion draft" and it's not at all clear if it has any chance of moving forward. Hopefully, if it does, there can be significant changes made to the bill so that it is still designed to punish truly bad behavior (and incentive good behavior), but without making it difficult to impossible for good people to hold key positions, and without cutting off potentially useful innovations for end users. At this point, I'm not sure this bill does so, even if it's well-intentioned.

Filed Under: apis, cdpa, consumer data protection act, cybersecurity, data protection, ftc, privacy, ron wyden, transparency

Ron Wyden Wants Federal Government To Do More To Protect Personal Devices/Accounts Used By Senators And Staffers

from the small-fix-with-bigger-potential-repercussions dept

Ron Wyden is writing letters again. This time he wants to know why the federal government isn't protecting the personal devices and email accounts used by federal officials. Attacks by state-sponsored hackers are never going to go away, and Wyden feels this lack of protection will make personal devices easy targets. From Wyden's letter [PDF] to Senate majority leaders:

Press reports from January of this year indicate that Fancy Bear--the notorious Russian hacking group--targeted senior congressional staff in 2015 and 2016. My office has since discovered that Fancy Bear targeted personal email accounts, not official government accounts. And the Fancy Bear attacks may be the tip of a much larger iceberg. My office has also discovered that at least one major technology company has informed a number of Senators and Senate staff members that their personal email accounts were targeted by foreign government hackers.

Given the significance of this threat, I was alarmed to learn that SAA cybersecurity personnel apparently refused to help Senators and Senate staff after these attacks The SAA informed each Senator and staff member who asked for help that it may not offer cybersecurity assistance for personal accounts. The SAA confirmed to my office that it believes it may only use appropriated funds to protect official government devices and accounts.

This seems a little odd, but there's a good reason the SAA doesn't extend coverage to personal devices. As Pwn All The Things pointed out on Twitter, personal devices can be used for personal things, and we don't want our elected officials using tax dollars for personal reasons.

This is a good example of a rule constructed for laudable reasons -- the strong firewall to stop legislators using govt money for campaigning and personal things is there for a reason -- ending up with bad consequences on edge-cases like defending high-value accounts from hackers

To protect against hacking attempts, Wyden is introducing legislation that would eliminate the SAA silos. The bill would allow the SAA to "provide cybersecurity assistance" for personal devices on an opt-in basis. We'll have to see how this plays out when implemented. It may make it more difficult to discern if any federal funds were misused by Senators or their staff.

On the other hand, it will help secure devices some government employees mistakenly believe aren't prime targets for state-sponsored hacking. It takes a certain amount of obtuseness to reach this conclusion, considering how heavily some government officials rely on their personal devices for communications with other government officials. The old FOIA dodge is still a popular one, and the difficulty of separating official work from personal work -- especially during election years -- likely means personal devices are used far more frequently than their government-issued ones.

While it's good the government as a whole is continually working towards more robust security, the fact is the private sector offers plenty of options for government officials to better secure their personal devices. Personal responsibility is still underutilized at the federal level, which makes them no better (or worse) than much of the general public.

Filed Under: congress, cybersecurity, federal government, nation state attackers, ron wyden, senate

Ron Wyden Wants The DOJ To Provide Answers On Stingray Devices' Disruption Of Emergency Call Service

from the gotta-risk-lives-to-save-lives-or-whatever dept

The FBI has admitted -- albeit not that publicly -- that Stingray devices disrupt phone service. Spoofing a cell tower has negative effects on innocent phone users as the device plays man-in-the-middle while trying to locate the targeted device. An unsealed document from a criminal prosecution and assertions made in warrant affidavits alleging "minimal" disruption are all we have to go on, at least in terms of official statements.

Supposedly, Stingrays are supposed to allow 911 service to continue uninterrupted. But it's hard to square that with the fact every phone in the device's range is forced to connect to the Stingray first before being allowed to connect with a real cell tower. In some cases, the device might force every phone in range to drop to a 2G connection. This may still allow 911 calls to take place, but almost any other form of communication will be impossible as long as the Stingray is in use.

Ron Wyden's staff technologist, Chris Soghoian (formerly of the ACLU), will be fielding answers from the DOJ and FBI about 911 service disruptions, if those answers ever arrive. Wyden's office has sent a letter [PDF] demanding to know the extent of cell service disruption when Stingrays are deployed. And he'd also like to know if these agencies are being honest about the negative side effects when agents seek warrants.

1. The Communications Act of 1934 prohibits willful or malicious interference with licensed radio communications. How is a federal law enforcement agency's use of a cell-site simulator not authorized by a court order consistent with the prohibition on interference with radio communications in 47 U.S.C. 333?

2. Is it the position of DOJ that a search warrant authorizing a federal law enforcement agency to use a cell-site simulator overrides the statutory prohibition on interference in 47 U.S.C. 333? If yes, please explain Why.

3. Does DOJ believe that it has an obligation under the duty of candor to notify federal courts considering an application for the use of a cell-site simulator that federal law prohibits interference with cellular communications? If not, please explain why.

4. Is it the position of DOJ that it is lawful, with or without a court order, for a federal law enforcement agency to interfere with licensed radio communications such that it disrupts a surveillance target's emergency cellular communications with 9-1-1? If yes, please explain why.

We'll see if Wyden gets his answers. The DOJ still has yet to answer similar questions Wyden asked last year, and there's little reason to believe its response time to questions it doesn't want to answer has improved since 2017.

There is evidence cell site simulators do interfere with 911 service, even if the US government has yet to admit it. A document obtained by the ACLU from the Royal Canadian Mounted Police clearly states cell site simulators have negative effects on emergency calls.

The MDI [Mobile Device Identifier] will shut itself off if a mobile within its range dials 911. However, recent testing at HQ revealed that more than 50% of the GSM mobile telephones tested had not automatically completed their 911 calls after the MDI had shut itself off.

This memo says the RCMP should inform judges of this possible side effect when seeking warrants and use a 3-minutes-on, 2-minutes-off cycle to minimize cell service disruption and overcollection of cell data from non-targets. If the DOJ has directed the FBI to engage in practices like these, it has yet to make that information public. From what little has been gleaned from public statements and begrudging answers to legislators and Congressional committees, the FBI's use of Stingrays appears to only be constrained by a warrant requirement that is merely the DOJ's internal policy, rather than codified by law.

Filed Under: doj, emergency calls, imsi catcher, interference, ron wyden, stingray, surveillance