Judge Blocks Gov't From Upgrading Email System To Microsoft In Google Lawsuit

from the suing-the-government dept

Back in November, we were one of the first to report that Google had sued the US government after the Department of the Interior had put out a Request for Quotation (RFQ) for an upgraded email system that stated upfront that the solution had to be based on Microsoft. Google, who had been talking to the Interior Department about using its own solution, had received promises that the RFQ would not be biased towards Microsoft -- and thus were shocked when it wasn't just biased towards Microsoft, but restricted only to Microsoft.

In the first phase of the lawsuit, it appears that Google has made a compelling enough case that the judge has issued an injunction, preventing the DOI from moving forward with the email upgrade. The LA Times headline and opening graf is a bit hyperbolic concerning this "victory." Google certainly hasn't won the lawsuit, and it's hardly a "major victory" at this point, but it at least suggests that the judge finds Google's basic claims credible. DOI can try to rewrite its RFQ to get out of the lawsuit or it can protest the injunction and the lawsuit will continue.

Filed Under: email, interior department, us government
Companies: google, microsoft

US Gov't Strategy To Prevent Leaks Is Leaked

from the not-quite-getting-it-yet dept

There's something rather ironic that the US government's document on how to get various US government agencies to prevent future leaks (a la Wikileaks) was quickly leaked to the press. But, it's not really that surprising, is it?

Of course, the main thrust of the document isn't to question whether or not so much secrecy is really necessary, but to send out a memo to various government agencies suggesting they use psychiatrists and sociologists to sniff out workers who might be disgruntled (full memo embedded below). Among a variety of (pretty unsurprising) suggestions for keeping confidential information confidential, the checklist of things that organizations are supposed to do includes:

• Do you use psychiatrist and sociologist to measure:
  • Relative happiness as a means to gauge trustworthiness?
  • Despondence and grumpiness as a means to gauge waning trustworthiness?

I didn't realize that you needed to use such professional help to figure out if you had a disgruntled worker on your hands. Isn't it the role of managers themselves to have a sense as to whether or not their employees are disgruntled? Though, I'm somewhat amused by the idea that the US government thinks that a psychiatrist or sociologist can accurately pick out who's likely to leak documents.

Not that it's a bad thing to try to figure out if there are disgruntled workers or to make sure secure systems really are secure. I'm all for that. I just think it's a bit naive to think any of this will actually prevent future leaks. You just need one person to get the info out, and there's always someone and always a way to do so -- as demonstrated by the fact that this document itself "leaked" so quickly. It seems a better situation would be to focus on making sure that any damage from such leaks is minimal.

Filed Under: disgruntled workers, leaks, strategy, us government

Just Weeks After Cutting Off Wikileaks, Amazon Brags About How US Federal Gov't Is One Of Its Biggest AWS Customers?

from the must-be-a-coincidence,-huh? dept

While Senator Joe Lieberman took credit for pressuring Amazon to stop hosting Wikileaks content via its Amazon Web Services infrastructure, Amazon insisted that government pressure had nothing to do with it. Still, it seems rather odd that just weeks after booting Wikileaks, Amazon sent out a press release bragging about how the US federal government is one of its biggest customers (found via Slashdot). Now, obviously, lots of tech companies do plenty of business with the federal government, but the timing of the two events at least creates an impression that Amazon will kick you off its service if the federal government disapproves of what you've done (even if no legal charges have been filed against you). Again, no one is saying that Amazon has no right to deny service to whomever it wishes, but it does seem a bit odd from a PR standpoint, and raises questions about how much anyone should trust working with Amazon web services. I know it's making me reconsider my own use of the platform for various projects.

Filed Under: amazon web services, us government
Companies: amazon, wikileaks

US Government Seeks 'Willful Denial' Software That Will Block Wikileaks Data From Federal Employees

from the are-they-serious? dept

It's been both depressing and amusing to watch the federal government react to Wikileaks with some of the dumbest policy decisions possible. First, we saw the Library of Congress block access to Wikileaks' site, not realizing that the site was barely a part of how the documents were being distributed, while still frustrating Congressional Research Service analysts who needed to access the site as a part of their research. Then, we had reports of the Defense Department crudely blocking access to any website that had Wikileaks in the title, followed by the Air Force's decision to block access to news sites, such as the NY Times, that are discussing Wikileaks.

This is all downright bizarre. Basically, this is content that everyone else in the world can access and read about, except for government employees who don't look at it at home. The whole exercise seems like a complete waste of time and money by the US government, and it's about to get worse. According to some reports, the federal government is reaching out to security firms to see if they can build a system to block all access to Wikileaks content from within the federal government's computer system. One company asked about this notes that it's different than what they normally do, which is focused on keeping documents in a network (too late for that), rather than architecting a system to keep documents out.

At what point will the government finally admit that if a classified document is leaked and widely available, it's counterproductive to keep pretending that it's still classified. It doesn't help anyone, and it just makes the government look silly and in denial. I prefer my government to respond to reality, not pretend reality doesn't exist.

Filed Under: denial, federal government, firewall, us government, wikileaks
Companies: wikileaks

US Looking To Use Computer Hacking Law Against Assange

from the stretchety-stretch-stretch dept

It appears that the US government is realizing the fact that an espionage charge against Julian Assange over Wikileaks is unlikely to succeed and would probably freak out the press (at least those in the press who remember the details of the First Amendment). So, instead, it's moved on to trying to use the Computer Fraud and Abuse Act (CFAA), commonly known as our anti-hacking law.

Of course, as we noted a few months ago, this law has been twisted and abused regularly to bring charges against people by pretending it covers things it doesn't. The most famous, of course, was the Lori Drew case, where prosecutors tried to charge Lori Drew with computer hacking, because she was part of a trio of people who used MySpace to bully a young girl, who later committed suicide. How was that "hacking"? Well, the prosecutors claimed that she didn't obey MySpace's terms of service, and thus "illegally accessed" MySpace. Luckily, the judge eventually tossed that out.

So what about Julian Assange? How could he have possibly violated a US anti-hacking while not being in the US at all? Well, the feds are apparently scanning through the chat logs between Bradley Manning and Adrian Lamo to see if there's any evidence at all that Assange could be charged with conspiracy under the CFAA in somehow aiding Manning in leaking the secrets. You can read the CFAA here if you want to see the full act. The argument, then, is that if they can drum up enough proof that Assange somehow aided Manning, it becomes a conspiracy and Assange can be charged under that act as well. So far, about the best they've apparently come up with is that Manning hinted that he had a "relationship" with Assange -- but the details in the chat logs suggest they talked a few times and that's about the extent of the "relationship." Separately, Assange gave Manning (and potentially other sources) a more direct FTP account to upload materials. Once again, this seems like grasping at straws, and seems so trumped up that it will continue to do more to hurt America's reputation than anything leaked by Wikileaks.

The problem is that it seems pretty clear that any association between Assange and Manning was a loose one. Suggesting that working with a source, and offering them an easy way to give you information is a conspiracy to commit computer hacking would create a massive chilling effect on anyone in the press who regularly reports on secret information. Bob Woodward, Seymour Hersh and a variety of other famous investigative reporters have clearly been much more closely connected to their sources, but it would be ridiculous to charge them with "conspiracy." It's really sad that our government is wasting tax dollars trying to find trumped up charges for Assange.

Filed Under: bradley manning, hacking, julian assange, us government, wikileaks
Companies: wikileaks

US Response To Massive Decline In Foreign Travelers: Keep Crazy Policies, But Set Up Ad Campaign

from the uh,-yeah dept

Sometimes it feels like the US government likes to take incompetence to new levels. It should come as little surprise that foreign tourism to the US is way down. Basically ever since the Patriot Act, visiting the US has become a huge pain for foreign tourists, and with our lovely new "we see you naked or we touch your private parts" strategy for airline passengers (thank you, TSA), it appears that things are getting even worse. So, if you're the US government, how do you respond? Do you start thinking about modifying such policies to make visiting the US less unwelcoming? Do you start thinking about more effective, but less insulting security procedures? Do you start looking at why those foreign tourists are staying away in droves? The answer appears to be no, no and no.

Instead, you set up a "public/private partnership" to launch an expensive ad campaign and you fund part of it by charging those very tourists to enter the country.

Yes, the US government and the travel industry have teamed up to launch the new "Corporation for Travel Promotion," (CTP) which will seek to run a huge advertising campaign to foreigners, trying to convince them that once you get past the unfriendly gropers at our borders, the US really is quite nice. The US Travel Association, which is a part of this effort, does say that it would be a good idea to use the CTP to convince the government (which, um, we thought was a part of the CTP) to create a "more efficient and friendly entrance procedure," but notes that work will be "challenging." So, for now, it sounds like the main focus will be on advertising how cool the Golden Gate Bridge looks, if you can actually get into the country.

Filed Under: advertising campaign, foreign travellers, tsa, us government, visas

Not Being Able To Spy On Everyone Online Is A Feature, Not A Bug

from the tell-the-FBI dept

With the recent news coming out that the feds plan to introduce dangerous legislation early next year to mandate backdoors for wiretapping into every form of internet communications, plenty of people have expressed their horror at such a plan. It's not just the basic questions of due process and privacy, but the massive burdens lumped upon all sorts of companies, combined with the equally worrisome security holes opened up by such demands.

Julian Sanchez has a wonderful article over at the American Prospect discussing just how problematic this plan would be:

But the current proposal is far more radical, in part because the Internet is not much like a traditional phone network. To see why, consider Skype, a popular program that allows users to conduct secure text chats, phone conversations, video conferences, and file transfers. Skype is designed as a distributed peer-to-peer network, meaning there's no central hub or switching station through which calls are routed; only the login server used to register members as they sign on to the network is centralized. Calls are encrypted end-to-end, meaning that only the end users who are parties to a call hold the secret keys to secure the conversation against online snoops. There's no device Skype can install at their headquarters that would let them provide police with access to the unencrypted communications; to comply with such a mandate, they'd have to wholly redesign the network along a more centralized model, rendering it less flexible, adaptable, and reliable as well as less secure.

Skype is just one of the thousands of firms, large and small, that would be burdened with the obligation to design their systems for breach. We've already seen how this can cause security vulnerabilities on traditional phone networks: In 2005, it was discovered that unknown hackers had exploited wiretap software built into Vodaphone Greece's computer system for law-enforcement use to eavesdrop on the cellular phone conversations of high Cabinet officials and even the prime minister. Designing for surveillance means, more or less by definition, designing a less secure, more vulnerable infrastructure. It's for just this reason that similar proposals were wisely rejected during the Crypto Wars of the 1990s, a decision that helped give rise to a thriving online economy that's wholly dependent on strong encryption.

It's not just hackers who could exploit such vulnerabilities, of course. A network architecture designed for the convenience of American law enforcement also necessarily makes eavesdropping easy for the many regimes whose idea of a "national-security threat" includes political dissent or blasphemous speech. And there's always the threat of interception by insiders: An engineer at Google was recently fired for using his privileged access to snoop into the private accounts of several teenage users. One way to alleviate such concerns is for firms like Google to enable end-to-end encryption, so users can feel secure that even the company's own employees won't have the keys needed to read their communications. The government's proposal would deny them the ability to make that promise.

Sanchez also has a wonderful line towards the end. In discussing why law enforcement would obviously love this kind of access (while also highlighting its widespread past abuses of wiretapping ability, he notes:

But while governments may consider it a bug when network architecture renders such sweeping surveillance infeasible, citizens should probably regard it as a feature.

An important feature, too, and one that we shouldn't easily part with just because a government with a history of abusing surveillance rights doesn't want to do any legwork anymore.

Filed Under: internet, spying, surveillance, us government

Do US Visa Documents Have A Typo?

from the time-to-change-the-fraud-prevention dept

Our friends over at the always excellent Notcot were recently playing around with a microscope and noticed what certainly appears to be a typo on the US visa and border crossing card. The back of the card has very tiny etchings of every US president and every state flag -- but the etching of 6th US president John Quincy Adams appears to have a typo, calling him John Quincy Adames with an "e" added into the last name. Take a look:

That seems like a pretty big mistake. However, some are suggesting that it was done on purpose. In the comments to the Notcot post, two specific theories are presented: the first is that JQA changed his last name to distinguish himself from his father. Doing some quick searches around various bios of Adams, however, shows absolutely no support for this one. Even the White House's own page on JQA spells it Adams and makes no mention of such a change.

The other explanation makes a lot more sense. It's that this is a form of fraud/counterfeiting detection. Similar to how dictionaries would sometimes insert a fake word or phone books would insert fake people/numbers to try to "catch" if anyone was copying their work, perhaps the US government added the extra "e" on the assumption that counterfeiters would actually spell JQA's name correctly -- thus giving them a way to spot a fake. Of course, that's a pretty weak form of anti-counterfeiting, but in combination with some other techniques, perhaps it's useful. Either way, it's an amusing bit of trivia...

Filed Under: greencards, john quincy adames, john quincy adams, typo, us government, visa

Can The Government Really Walk The Line Of Regulating The Internet Without Screwing It Up?

from the questions-to-ask dept

Recently, when I wrote about new moves by the federal government to gain more regulatory control over the internet, I mentioned our discussion from a couple months ago of a presentation by Lawrence Strickling, the head of the National Telecommunications and Information Agency (a division of the Department of Commerce), who tried to make the case that the government has a role in regulating the internet. As I noted at the time, if you read his full speech (and not just some of the hysterical coverage about it), it sounded as if he was really noting that the US already regulates many aspects of the internet, and the government needs to figure out the proper policies for handling those aspects.

It appears that he's now building on that earlier speech. He recently gave another speech on the same topic, which he refers to as "Internet Policy 3.0." And, once again, I understand the fine line that he's trying to thread, but I worry about what it means in practice. He points out that the role of the government shouldn't be heavy-handed, but as a way of making sure that people continue to trust the internet. He points to Section 230 of the CDA as an example of "good legislation" that has been very important to the success of the internet, and talks about using that as a model of the type of legislation that the feds should have.

All of that sounds good -- and I'm sure his heart (and his mind) are in the right place on this... but the details still scare me to death. As in his earlier speech, he lists out areas where he thinks the government has a role to play. And, if you're unfamiliar with the deeper details in any of those areas, it might be hard to disagree. But, as you dig deeper on each one, it gets more and more troubling. Take one area that is near and dear to the hearts of many folks here: copyright. Here's what he has to say about copyright:

Copyright protection: How do we protect against illegal piracy of copyrighted works and intellectual property on the Internet while preserving the rights of users to access lawful content? NTIA and our sister agency at the Department of Commerce, the US Patent and Trademark Office, are beginning a comprehensive consultation process that will help the Administration develop a forward-looking set of policies to address online copyright infringement in a balanced, Internet-savvy manner.

Pretty non-descript and bland, and who would disagree with that idea? Well, if you've paid attention to the past history of copyright law, the above paragraph should scare you silly. Every single time that the US has developed new copyright policies, the process has totally been controlled by special interests whose goal have nothing to do with being balanced or internet-savvy -- but about better protecting their own business models and building the walls up higher around them. And, to date, neither the Commerce Department, nor the USPTO, have given the slightest indication that they're interested in changing that. In fact, Strickling's boss has a history of buying into bogus claims from Hollywood.

And that's the real fear on any of these things. The devil is very much in the details, and special interests have a really strong ability to influence the process and the details, so that any "balanced, internet-savvy" plan comes out as anything but that. For all of Strickling's best intentions, opening these things up to new laws really opens them up to abuse by folks who are world-class experts in abusing the system.

Oh, and it should be noted, of course that Strickling's "good example" of Section 230 of the CDA was sort of an accidental by-product of what was left over after the Supreme Court got around to throwing out pretty much all of the awful CDA. It's easy to look in hindsight and say "this is a good law" and "this is a bad law," but it's incredibly difficult in advance. If there were actually a system and process for reviewing laws to see if they ever actually did what was promised, perhaps it would be worthwhile to experiment. But that's not how the government works. Instead, politicians pass laws and just pretend they must do what they claim -- and then unintended consequences are ignored until the problems become big enough that a new bad law takes the old bad law's place.

Yes, that's a cynical view, but it's hard to argue with it when you look at the way the federal government works. So, as idealistic as Strickling may be, his ideas on Internet Policy 3.0 are incredibly scary, because of those unintended consequences that he can't predict.

Filed Under: lawrence strickling, policy 3.0, regulations, us government

US Government Working With Pharma Companies To Raise Drug Prices In Other Countries

from the health-comes-second... dept

A series of stories from Jamie Love at KEI highlight the troubling cozy relationship between pharmaceutical companies and the US government in trying to raise drug prices in other countries -- which very likely will come at the expense of the health of citizens in those countries. The first is about the USTR and its position that drugs in Taiwan are too cheap:

The United States has also continued to engage Taiwan on concerns raised by the pharmaceutical and medical device industries that Taiwan's procedures for medical product pricing and reimbursement fail to adequately recognize the value of innovative medical products for patients in Taiwan.

Read that again, because that's a pretty scary statement. Yes, Taiwan has worked hard to make sure that health care is affordable in that country, and the USTR is acting on behalf of corporate interests to tell them that's a mistake. Wow.

Then, over in India, it appears that the USPTO is putting on co-branded events with Pfizer about drugs, health care and patents. Along with this, Love points to growing concerns from folks in India about a project between George Washington University and various pharmaceutical companies to "train" Indian politicians and judges on the importance of patents in pharma. Except, of course, that's very much in dispute. Many studies have shown that patents on pharma do more harm than good -- especially in countries with big healthcare issues.

There are plenty of important issues to debate over health care and patents, but it seems quite troubling when the US seems to have pretty much let the pharmaceutical companies run the entire debate.

Filed Under: india, patents, pharmaceuticals, taiwan, us government, us pto, ustr