SEC And Chuck Grassley Still Trying To Stop Email Privacy Act That Got UNANIMOUS Support In The House

from the because-fuck-the-4th-amendment,-that's-why dept

Hey, remember last week, when lots of folks were super excited about the US House of Representatives unanimously voting in favor of the Email Privacy Act? They voted 419 to 0. That kinda thing doesn't happen all that often. I mean, sure it happens when condemning ISIS, but they couldn't even make it when trying to put sanctions on North Korea. Basically, something needs to be really, really screwed up to get a unanimous vote in the House. And the Email Privacy Act, which goes a long way (though not far enough) towards fixing ECPA (the Electronic Communications Privacy Act of 1986) that makes it way too easy for the government to snoop on your electronic communications, actually got that unanimous vote.

So it should be moving forward and well on its path to becoming law, right? Right?!? Well... about that. You see, as we'd mentioned in the past, the SEC has been the main voice of opposition to the Email Privacy Act, since it (along with the IRS), kinda like the fact that they can snoop through emails without a warrant. Never mind that it's probably unconstitutional, it makes their jobs so much easier. And, really, isn't that the important thing?

Apparently, Senator Chuck Grassley thinks so. And, hey, bad luck for, well, everyone, because Grassley just happens to be the guy in charge of moving the bill forward on the Senate side. And he's not having any of it right now, claiming that there are "concerns" about the bill:

“Members of this committee on both sides of the aisle have expressed concerns about the details of this reform, and whether it’s balanced to reflect issues raised by law enforcement,” said Sen. Charles Grassley, the chairman of the Senate Judiciary Committee, on Thursday.

Concerns? It didn't seem like anyone in the House was concerned about it because (I should remind you) it passed unanimously. And that's because it's really only making fairly common sense changes to the law to require a warrant (as required by the 4th Amendment) to snoop on emails.

And just what "law enforcement" issues have been raised? Sounds like it's our friends at the SEC yet again:

The Securities and Exchange Commission is still fighting a House-passed bill to require law enforcement to get a warrant before obtaining messages from email providers. “[The Email Privacy Act] would create a dangerous digital shelter for fraudsters,” SEC Enforcement Director Andrew Ceresney said in a statement to POLITICO. “The privacy interests the bill addresses can be fully achieved without blocking civil law enforcement agencies like the SEC from obtaining the evidence it needs to protect investors.”

No. Actually, it doesn't create a "digital shelter for fraudsters." That's SEC Enforcement Director Andrew Ceresney lying through his teeth. It just means that the 4th Amendment needs to be obeyed when obtaining emails that are hosted on cloud providers. Just like a warrant is needed to obtain someone's personal papers. It's not creating a digital shelter. It's harmonizing the rules for digital content so they match the rules for physical documents and communications. And, in doing so, protecting the privacy and the very concept of the 4th Amendment.

Either way, all that momentum in the House may be for nothing if the SEC and Grassley get their way.

Filed Under: chuck grassley, congress, ecpa, ecpa reform, email, email privacy act, house, irs, privacy, sec, senate

House Votes Unanimously In Favor Of Requiring A Warrant To Search Emails

from the yay! dept

The push to reform ECPA -- the Electronic Communications Privacy Act -- have been going on basically as long as this site has been in existence (i.e. nearly 20 years). There are lots of problems with ECPA, but the big one that everyone points to is that it considers any communication that's on a server more than 180 days to be "abandoned" and accessible without a warrant. That perhaps made some amount of sense back in 1986 when the law was written, because everything was client-server and you downloaded your email off the server. But in an age of cloud computing and webmail it makes no sense at all. Still, the IRS and the SEC really, really liked the ability to use ECPA to snoop on people's emails.

In the past few years, Congress has kept supporting reform, but it always dies when some part of the administration complains and tries to block it. And yet, each time it enters Congress, it gets more and more sponsors. And, finally, the full House has voted to pass the Email Privacy Act. It was no surprise that it passed. The bill had an astounding 315 cosponsors. Seriously: Still, it's impressive that the bill ended up passing unanimously, 419 votes to 0 (and 14 missing votes). On an issue like this, that's surprising. You figured there would be some Congressional rep from somewhere arguing that this would let terrorists and child predators off the hook or something.

The bill is certainly not perfect, and could be improved, but it's nice to see the House get the basics right. Now, we wait and see what happens in the Senate... Will the Senate ignore a unanimous House and let this bill just die, or will it finally do the right thing and protect email privacy?

Filed Under: 4th amendment, congress, ecpa, ecpa reform, email, house, kevin yoder, privacy, warrant

Microsoft Sues Government Over Its ECPA-Enabled Gag Orders

from the silent-service dept

Microsoft isn't the first company to sue the government over its gag orders. Google, Yahoo, Twitter, and a small ISP called Calyx Internet Access have all taken the government to court over its various demands for secrecy it ties to its National Security Letter requests.

But the more the merrier. Sooner or later, someone's going to have to side with the recipient. As Microsoft alleges in its announcement of the lawsuit, the secrecy problem is getting worse, instead of better -- despite the national discussion over domestic surveillance, expanded government power and the ongoing circumvention of due process.

It's not that Microsoft believes the government is never entitled to secrecy. It's that the demand for secrecy seems to be its default position.

To be clear, we appreciate that there are times when secrecy around a government warrant is needed. This is the case, for example, when disclosure of the government’s warrant would create a real risk of harm to another individual or when disclosure would allow people to destroy evidence and thwart an investigation. But based on the many secrecy orders we have received, we question whether these orders are grounded in specific facts that truly demand secrecy. To the contrary, it appears that the issuance of secrecy orders has become too routine.

The government is demanding information from Microsoft while telling it to shut up nearly 150 times a month.

Over the past 18 months, the U.S. government has required that we maintain secrecy regarding 2,576 legal demands, effectively silencing Microsoft from speaking to customers about warrants or other legal process seeking their data.

Worse, in a majority of these cases, Microsoft has been ordered to maintain its silence indefinitely.

Notably and even surprisingly, 1,752 of these secrecy orders, or 68 percent of the total, contained no fixed end date at all. This means that we effectively are prohibited forever from telling our customers that the government has obtained their data.

The lawsuit claims these gag orders violate multiple rights of multiple parties. Those whose data is being requested are having their Fourth Amendment rights violated by the undisclosed searches. Microsoft's First Amendment rights are being violated by the accompanying gag orders.

At the center of Microsoft's lawsuit is a terrible law: the ECPA.

Microsoft brings this case because its customers have a right to know when the government obtains a warrant to read their emails, and because Microsoft has a right to tell them. Yet the Electronic Communications Privacy Act (“ECPA”) allows courts to order Microsoft to keep its customers in the dark when the government seeks their email content or other private information, based solely on a “reason to believe” that disclosure might hinder an investigation. Nothing in the statute requires that the “reason to believe” be grounded in the facts of the particular investigation, and the statute contains no limit on the length of time such secrecy orders may be kept in place.

[...]

That antiquated law (passed decades before cloud computing existed) allows courts to impose prior restraints on speech about government conduct—the very core of expressive activity the First Amendment is intended to protect— even if other approaches could achieve the government’s objectives without burdening the right to speak freely. The statute sets no limits on the duration of secrecy orders, and it permits prior restraints any time a court has “reason to believe” adverse consequences would occur if the government were not allowed to operate in secret. Under the statute, the assessment of adverse consequences need not be based on the specific facts of the investigation, and the assessment is made only at the time the government applies for the secrecy order, with no obligation on the government to later justify continued restraints on speech even if circumstances change…

As the lawsuit points out, the outdated law isn't built to handle the reality of cloud computing. Unfortunately, law enforcement agencies like the FBI are perfectly willing to exploit the loopholes this mismatch provides. Rather than approach individuals under investigation and search their home or place of business (if that's where the communications are stored/originate) the government uses the ECPA to demand information from virtually unrelated parties like service providers, simply they provide cloud storage options.

The Fourth Amendment’s requirement that government engage only in “reasonable” searches necessarily includes a right for people to know when the government searches or seizes their property. See Wilson v. Arkansas, 514 U.S. 927, 934 (1995). For example, if the government comes into a person’s home to seize her letters from a desk drawer or computer hard drive, that person in almost all circumstances has the right to notice of the government’s intrusion. The same is true when the government executes a search of a business to seize emails from the business’s on-site server. But Section 2705(b) subjects Microsoft’s cloud customers to a different standard merely because of how they store their communications and data: the statute provides a mechanism for the government to search and seize customers’ private information without notice to the customer, based upon a constitutionally insufficient showing. In so doing, Section 2705(b) falls short of the intended reach of Fourth Amendment protections, which do not depend on the technological medium in which private “papers and effects” are stored.

It also points out how the government has used the law to treat physical searches and digital searches completely differently, thanks to the flaws in the legislation. While physical "sneak-and-peek" searches can be performed without notification of the target, the silence can only be maintained for 30-90 days. But if it goes after cloud backups, it can approach Microsoft and hit it with an indefinite demand for silence.

Considering how many ECPA reform false starts there have been over the years, Microsoft's demand -- if granted -- could render some of that effort moot. It could also help fill in some of the gaps created by the recent carve-outs that have allowed the bill to finally move out of committee.

For these reasons, Microsoft asks the Court to declare that Section 2705(b) is unconstitutional on its face.

To sum up using all the metaphors, this swing for the fences could kill several birds with one stone if the court finds in favor of Microsoft: ECPA will be hobbled badly and will no longer be the go-to justification for government gag orders and, if the gag orders themselves survive, they'll likely be limited to something less than "indefinitely" and be held to a higher level of scrutiny when they're issued.

Filed Under: ecpa, ecpa reform, email, gag orders, law enforcement, nsls
Companies: microsoft

Guy Who Pretends He Invented Email Whines At Every Journalist For Writing Obit Of Guy Who Actually Helped Create Email

from the give-it-up-shiva dept

Over the years, we've written a few times about Shiva Ayyadurai, a guy who's basically staked his entire life on the misleading to false claim that he "invented" email. Every couple of years he pops up again as he's able to fool some reporters into believing him. In 2012, he fooled the Washington Post and, astoundingly, the Smithsonian. In 2014, he was somehow able to get the Huffington Post to publish a multi-part series claiming he had "invented" email -- though after we called them out on it (and after they stood by it) -- those stories were eventually deleted. Ayyadurai also threatened to sue us for calling out his false claims, but there's been no lawsuit yet.

In those previous stories, we've explained why his claims are false in fairly great detail. Here's the quick version:

First off, no one denies that V.A. Shiva Ayyadurai -- an apparently very bright 14-year-old at the time -- wrote an email software program for the University of Medicine and Dentistry of New Jersey (UMDNJ) in 1978. By all accounts, it was a perfectly decent email system that allowed the UMDNJ staff to send electronic messages. Further, no one doubts that, in 1981, Ayyadurai registered the copyright on his program, which was called EMAIL. The problems are that (1) email was invented long before 1978, (2) the copyright is merely on the specific software code, not the idea of email, and (3) while Ayyadurai may have independently recreated the basics of email (and even added a nice feature), none of his work was even remotely related to what later became the standards of email. What's most sickening about this is that as part of this new PR campaign, Ayyadurai is ridiculously arguing that the reason no one believes him isn't because he's simply wrong, but because they can't stand to believe that "a dark-skinned immigrant kid, 14 years old," invented email, and that it was done in "one of the poorest cities in the US" rather than at a famous university.

Again, that might make for a nice story line if there were some factual basis behind it, but there isn't. The history of email is well-documented from multiple sources and it began way, way before 1978. And while early versions were somewhat crude, by 1978 they had basically everything that Ayyadurai claims to have invented (it is entirely believable that Ayyadurai, as a bright kid, independently came up with the same ideas, but he was hardly the first). There was a messaging system called MAILBOX at MIT in 1965. You can read all the details of it here, including source code. Ray Tomlinson is frequently credited with inventing the modern concept of email for the internet by establishing the @ symbol (in 1972) as a way of determining both the user and which computer to send the email to. By 1975, there were things like email folders (invented by Larry Roberts) and some other basic email apps. As is noted, by 1976 -- two years before Ayyadurai wrote his app -- email was 75% of all ARPANET traffic.

There's also the fact that even if Ayyadurai had done something different at that dental school (and there's no evidence he really did), that had no impact at all on the growth and success of email. No one else built out email systems because of what they saw Ayyadurai build. Email came and grew out of all of that other work (most of which pre-dated Ayyadurai). Hell, just look at RFC 733 from 1977 (before Ayyadurai started working at the school), which basically lays out all of the features of email.

Despite all of this, Ayyadurai refuses to give up his claims. Part of the way he's tried to get around this is to redefine email to include an increasingly long list of features, most of which are not at all necessary for email. The list changes over time and grows -- basically every time someone points out that all of the things he had on earlier lists were found in programs pre-dating Ayyadurai's own program. Ayyadurai also totally misrepresents what a copyright is, and insists that his copyright is just like a patent, because you couldn't patent software back then. That's basically not true. It is true that most software was not considered patentable back then (even though some was), but that still doesn't make the copyright the equivalent of a patent.

Throughout all of this, Ayyadurai and the weird collection of supporters he's built up -- bizarrely including Noam Chomsky and PR guru Larry Weber -- seemed to keep targeting Ray Tomlinson as some sort of evil mastermind behind the racist plot to take down Ayyadurai, because Tomlinson worked for Raytheon, and Weber, Chomsky and Ayyadurai could spin this bizarre and totally made up story of a big American defense contractor wanting to rewrite history to write out someone with "brown skin."

Tomlinson, as you probably have heard already, passed away this weekend, and received tremendous praise across the internet. Many referred to him as the "inventor of email" even though Tomlinson himself had long insisted that was not true either. Instead, he (unlike Ayyaudurai) long admitted that the growth and success of email involved many people working in pieces, building on each other's work successfully to build out the tool that we all use today. Still, Tomlinson actually does deserve tremendous credit for making email what it is today. The most notable claim -- and the one that everyone rightly talks about -- is his decision to make use of the @ symbol as a part of email addresses, in order to send email messages across networked computers, rather than just on a single machine (as had been done previously).

But, much more importantly, Tomlinson was actively engaged in setting the standards for email, such as in RFC 561 in 1973 (five years before Ayyadurai did anything), in which he and others laid out the standards for email headers.

Given all this, you'd hope that Ayyadurai could let Tomlinson's passing go in peace, and let people celebrate all of the work he did to actually bring email to the world. But, nope. That's not what's happening. Instead, Ayyadurai has gone on a Twitter rampage, tweeting at basically every journalist who has written about Tomlinson, and calling them liars. This is only a small snippet of about 3 hours worth of his tweets.

Most of those are pointing to his "correction" posted to his website, claiming that anyone claiming Tomlinson invented email is wrong. He repeats the false claims about how it only qualifies as email based on his totally arbitrary list of features and also that people who say he's wrong are simply backing up Raytheon trying to deny him his rightful due because he's "not white." And, amazingly, he's actually convinced some publications to write about his claim, with very little fact checking. Meanwhile, when some point out that he's lying, Ayyadurai yells at them that they're repeating "racist lies," despite the fact that all of the evidence is well-documented.

Once again, to Shiva Ayyadurai: you were almost certainly a very bright kid, who created a nice software program as a teenager at the school where you were employed. That's great. And you should be proud of your accomplishments. But you did not invent email. You had nothing to do with the invention of email. And to continue to claim otherwise makes you look petty and silly -- especially at a time when everyone is celebrating the very real accomplishment of Ray Tomlinson.

Filed Under: copyright, email, patents, ray tomlinson, shiva ayyadurai

2002 Legal Rationale For Warrantless Surveillance: Because The President Can Do It, Shut Up

from the how-is-john-yoo-not-in-jail? dept

Oh, John Yoo. The former top Bush administration lawyer -- who is already well-known for writing that administration's (totally bullshit) "legal defense" for torture -- has also been an outspoken advocate for NSA surveillance as well. Soon after the Snowden revelations, Yoo defended the NSA arguing that the 4th Amendment shouldn't apply to the NSA because it takes too long. Then, he said that judges shouldn't be allowed to determine if the NSA violated the 4th Amendment because they're too out of touch with the American public. It's long been known that Yoo also was deeply involved in creating the legal justifications for that very warrantless surveillance program he's been defending, and now, finally, years later, the Office of the Director of National Intelligence has released the May 17, 2002 letter that Yoo sent to the FISA Court chief judge Colleen Kollar-Kotelly. You can read it here.

As the ODNI release notes, Judge Kollar-Kotelly was allowed to read the letter, justifying the NSA's warrantless surveillance on Americans, but "was not authorized to retain a copy or take notes" because nothing says transparency democracy like secret interpretations of the law where no one's allowed to know the details, and the people overseeing it are only allowed to glance at the justifications. It was the "re-evaluation" of this John Yoo rationalization that created the now infamous hospital room showdown in March of 2004, when some in the administration realized that Yoo was basically full of shit.

Anyway, now the Yoo memo (with plenty of redactions, of course!) has been released, and we can see just how absolutely ridiculous the whole thing was. In short, Yoo argues that even though, historically, the NSA was not allowed to do warrantless surveillance on Americans and the Foreign Intelligence Surveillance Act (FISA) made it clear that domestic surveillance needed to first be approved with warrants to the FISA Court (which is barely a court anyway), there was nothing that said that had to be the case, and the President was basically free to turn the NSA loose to spy on Americans without any FISA approval. First, he notes that the NSA is not technically or legally limited in surveilling Americans, even if it historically avoided doing so: In short, that says because Congress didn't explicitly limit the NSA in the same manner as the CIA, that must mean it's okay for the NSA to spy on Americans. This basically ignores the history and rationale for the NSA, which was entirely secret for much of its early history anyway, and created and run out of the executive branch with little Congressional oversight. Yoo then admits that the driving executive order that enables much of the NSA's activities -- the infamous Executive Order 12333 -- does explicitly say that the NSA can only conduct foreign signals intelligence surveillance, but that doesn't matter, because future Presidents aren't bound by previous Presidents' executive orders. He also argues that if the NSA is spying on Americans in order to seek "significant foreign intelligence," then it's perfectly fine as well. He then admits, generously, that even though there's no actual legal restriction (in his mind) on the NSA spying on Americans, that it could "be in tension with FISA" since FISA requires a warrant for domestic surveillance. But fear not, evil legal genius John Yoo has a bullshit way around that as well. He goes through a detailed description of the limits of getting a warrant approved by FISA and bemoans the fact that it wouldn't be possible to intercept all phone calls from a certain country under FISA.

And here's where he gets really tricky. He says that FISA is not necessarily a limitation on what kind of surveillance can be done, but merely a safe harbor such that if you follow it you're automatically presumed safe under the 4th Amendment. However, he insists that FISA cannot limit the President's constitutional powers, and thus the President can still order warrantless domestic surveillance outside of FISA, and the only issue is that it's outside of the FISA "safe harbors" -- so it may not be automatically presumed in compliance with the 4th Amendment: From there, he goes on for a while insisting that the President has the Constitutional power to order warrantless surveillance basically whenever he wants, with the only limitation being the 4th Amendment (which we'll get to). And then he pulls a neat little trick, insisting that the President doesn't require a warrant for conducting surveillance for national security related purposes (pointing to some caselaw involving questions around due process in espionage cases), and notes that, even better, FISA itself means that "surveillance conducted for national security purposes is not subject to the same Fourth Amendment standards that apply in domestic criminal cases."

Did you see the neat trick he played there? First, he showed that the President can ignore FISA and Executive Order 12333, and then used FISA (which he already said the President could ignore) to argue that the 4th Amendment standards don't really apply either. You want to know why lawyers get a bad name for bullshit arguments? Look at John Yoo -- and then remember that his bullshit arguments weren't just around a single case, but to justify spying on all Americans without a warrant (we'll leave aside the fact that he did the same thing for torture as well).

From there, he actually argues that a court reading FISA to restrict the President would create a constitutional conflict: This is a pretty fascinating rewriting of history. The whole point of the Foreign Intelligence Surveillance Act was to put limits and oversight on the collection of foreign intelligence information. And here Yoo argues that Congress intended no such thing as the very purpose of the law. That's kind of astounding.

From there, Yoo then tries to argue that warrantless wiretapping of basically everyone in America also does not violate the 4th Amendment. First, he argues that the 4th Amendment does not apply to non-US persons. Next, he said that communications that leave the US electronically are also no longer subject to the 4th Amendment due to the "border search exception" -- an issue that we've discussed plenty of times for people who have had their laptops searched as they enter the country. This, apparently, is part of Yoo's 4th Amendment loophole. Any communications involving Americans that happens to slip outside of US borders loses any 4th Amendment protections. The fact that it's digital, not physical, makes no difference according to John Yoo's extremely distorted moral compass. But, he admits that there might be some concerns about the border search theory with regards to the contents of email and phone calls, so he has a trick: how about we just say the 4th Amendment doesn't apply to the metadata, and we'll call it even.

Then he uses the infamous Smith v. Maryland case, that established the Third Party Doctrine to argue further that there's no 4th Amendment issue with sucking up all metadata. We've heard this argument many times in court by now. Because this one 1979 ruling, which was about whether or not law enforcement could get the phone records of a single phone from a person that they were tracking for criminal behavior, that means that everyone has given up any expectation of privacy in any metadata they have on any communications record -- including email. This also suggests Yoo has no clue how email works. The reason that the phone records were considered legit was because the phone company had to track all of your phone calls for billing reasons, and thus had a "legitimate business purpose" in keeping track of all your phone record metadata. That's not how email works, but Yoo basically pretends it does: My ISP doesn't get access to who I email. Because that's not how email works.

Next up, Yoo argues that because the Fourth Amendment was really designed to deal with "curbing law enforcement abuses," it really shouldn't apply to support for "military operations." And since the response to 9/11 is really about military operations, the 4th Amendment shouldn't apply to spying on all Americans because it's to support that purpose: Finally, he argues that even if this program were subject to the 4th Amendment, which he doesn't think it should be, that's still okay, because snooping on every American's communications is still "reasonable" under the 4th Amendment... because TERRORISTS!!!!!!! In short, Yoo basically wipes aside anything that protects Americans from mass surveillance, despite the fact that the 4th Amendment was specifically designed to stop "general warrants" that allowed for mass surveillance, and despite the fact that FISA was passed to stop government abuse of surveillance powers. To Yoo, there's an excuse for basically any kind of government intrusion on our private lives, and even if the laws and Constitution do apply, no problem, you just shout "terrorism" and all is allowed.

This is a really sickening letter. At the very least, it should have been made public at the time it was written so that it could have been debated (and trashed as ridiculous) at the time it was made. Instead, it was done in secret, given to a judge who could only read it and not keep it or take notes, and then wasn't revealed publicly for almost 14 years. This is not how a democracy is supposed to function.

Filed Under: 4th amendment, colleen kollar-kotelly, email, fisa, john yoo, legal rationale, metadata, nsa, surveillance, warrantless surveillance, warrantless wiretapping

Congress Might Actually Be Moving Forward On Fixing Outdated Email Privacy Law!

from the didn't-see-that-coming dept

We've been talking about and asking for ECPA reform for many, many years, and it might finally be moving forward. ECPA is the Electronic Communications Privacy Act, which details how the government can get access to your electronic communications. The law was written in the early 1980s, and as you've probably noticed, we live in a very different world these days as it pertains to electronic communications. One key example: the law says that messages left on a server for more than 180 days are considered abandoned and can be searched without a warrant. That may have made some sense (though, not really) in a client-server era, where everyone downloaded their messages leading to them being deleted from a server, but it makes no sense at all in an era of cloud computing.

The main foes against updating ECPA have been government agencies that have investigatory powers, but not the ability to get a warrant -- mainly the SEC and the IRS, with the SEC being the real stumbling block. The SEC really liked the fact that it could snoop through emails without a warrant. So, even with massive support in Congress, ECPA reform never went anywhere.

So it was a bit surprising to folks this week to see Rep. Bob Goodlatte announce that the Judiciary Committee will now markup the ECPA reform bill, meaning that the bill is moving forward again. It's not entirely clear why it's happening now, but at the very least, it sounds like the SEC's constant protests may no longer be an obstacle. Hopefully it does move forward, and whatever results from the process leads to much stronger privacy protections on electronic communications, such as actually requiring a warrant, like the 4th Amendment says should happen.

Filed Under: bob goodlatte, ecpa, ecpa reform, electronic communications, email, irs, judiciary committee, markup, sec, surveillance

Former NYPD Boss Ray Kelly's Emails 'Inadvertently' Wiped Despite Court Order To Preserve Them

from the press-'delete'-to-retire dept

No surprises here, although the contempt for government authorities that aren't the NYPD is a bit audacious.

Most of former NYPD Commissioner Raymond Kelly’s emails on his desktop computer were deleted at the end of his tenure despite an order they be preserved for a high-stakes class-action suit alleging a summons quota system within the department.

The NYPD -- and its top officials -- have never been fans of transparency or accountability. The only shocking aspect is that the deletion was done in direct disobedience of a court order. The plan to secure Kelly's legacy by destroying his emails was likely in place long before his retirement. Back in 2013, it was made clear by Michael Bloomberg that there would be no effort made to archive the mayor's communications. Four government agencies were also on the "assured destruction" list, the NYPD being one of them.

By the time Kelly and Bloomberg left office, their emails were already slated for deletion. That makes the following statement both accurate and deceiving.

“The majority of former Commissioner Kelly’s locally stored emails were inadvertently deleted at the conclusion of his tenure,” city attorney Curt Beck wrote to Manhattan Federal Judge Robert Sweet.

"Inadvertently" is just another word for "automatically." Since no one was given the task of ensuring Kelly's emails wouldn't be deleted, the destruction went ahead as planned. But the wording suggests someone just hit the wrong key and nuked Kelly's emails.

And, as is far too often the case, those charged with preserving these communications were the last to know they were gone.

The city only recently learned of the mistakenly destroyed data, according to documents filed Wednesday.

It might be more believable if the city's story didn't keep changing. First, it claimed the order to preserve the emails wasn't "disseminated widely," leading to staffers "mistakenly" deleting communications when Kelly left office. A few hours later, the city "clarified" its original statement by claiming the deletion only affected emails "stored locally," which vanished when Kelly was given a new computer in 2013 -- and his old one wiped for reuse.

In the latter explanation, the city claimed the only emails affected were those "three years or older" or "otherwise selected for archiving." (This auto-delete would seem to completely undermine the "archive" function, not to mention the definition of the word itself.) The city also said it could search the inboxes of other NYPD/city officials for copies of Kelly's emails. Neither statement is very reassuring, considering the preservation order took effect in 2010 when the lawsuit was filed and the city has yet to produce a single email.

The city says this "accidental" deletion is "not a big deal." (Yes, that's a direct quote.) The double standard here is astounding. If the NYPD was pursuing a case against a criminal defendant, the deletion of communications would be used against the person charged and could result in additional penalties. The federal government -- thanks to law meant to prevent corporations from destroying evidence -- goes after people for far less overt actions. Sarbanes-Oxley makes the deletion of anything a possibly criminal act -- including periodic maintenance like deleting cookies/browser history. The law basically forbids any conceivable criminal defendant from deleting anything from their devices and computers, as evidence must not only be preserved for ongoing investigations, but also for "foreseeable" investigations

Public entities have a duty to preserve communications responsive to public records requests and must implement clearly-stated deletion policies that err on the side of retention. The wiping of emails the moment a controversial official leaves office should be suspect, even without the existence of a preservation order demanding the retention of these documents. The court may pursue sanctions against the city, but that won't help the plaintiffs much -- not if evidence of ticket/arrest quotas (the central issue of the lawsuit) was contained in the "inadvertently" destroyed emails.

Filed Under: deleted, email, evidence, nypd, ray kelly, spoliation

Clinging To Relevance, Yahoo Prevents Ad Block Users From Checking Yahoo Mail

from the ingenious-strategy dept

Yahoo's been struggling for some time under the leadership of Marissa Mayer to become as relevant in the advertising and content space as contemporaries like Google and Facebook. By and large these efforts have not been going particularly well, with the mood inside the company supposedly "grim and contentious," employees frustrated with a lack of direction, heavy often-senseless micromanagement, and a "lack of a coherent strategy." A growing movement from both inside and outside of Yahoo to replace Mayer has gained momentum.

So as the company struggles for relevance this week in the face of users, employees and investors, somebody at the company apparently thought it would be a great idea to annoy a huge swath of the company's userbase. According to a growing number of Ad Block users, Yahooers this week were met with a message scolding them for using ad blocking technology and preventing them from accessing their mail through the website:When I asked the company to confirm that this was indeed a new, ingenious business strategy, I was told it was part of a "test" for the company:

"At Yahoo, we are continually developing and testing new product experiences. This is a test we're running for a small number of Yahoo Mail users in the U.S."

Really? You're barely clinging to relevance and you think it's a great idea to begin alienating the remaining customers that haven't fled to gmail? As we've noted many, many times, there are numerous answers to dealing with ad blocking, from designing less annoying ads, to developing new business models, to giving users more control. Instead, some websites have tried to dictate to consumers what they should do with their own browsers, and in some instances punished site visitors for even talking about ad blocking whatsoever. In Yahoo's case, the decision had the expected result. It started to drive users away:

"please disable ad blocker to continue using yahoo mail" how about no. do you want me to stop using yahoo mail?? cause this is a good start

— Timmay (@RunLikeDeer) November 19, 2015

So @YahooMail has blocked my inbox for using an ad blocker. It was a good run, I guess. Goodbye! Hello Apple Mail, as much as I hate it.

— Andrei Herasimchuk (@Trenti) November 19, 2015

Perhaps we're all missing some subtle nuance of the plan, and Mayer somehow hopes to make Yahoo more relevant -- via the power of annoyance?

Filed Under: ad block, ad blocking, email, yahoo mail
Companies: yahoo

Documents: The Domestic Email Collection Program The NSA 'Killed' In 2011 Was Actually Just Offshored

from the the-underwater-dragnet dept

New documents obtained by Charlie Savage of the New York Times (as the result of a FOIA lawsuit) show that the NSA may have killed off its bulk collection of US persons' emails back in 2011, but it quickly found another way to obtain these -- a way that circumvented restrictions on domestic collections.

While that particular secret program stopped, newly disclosed documents show that the N.S.A. had found a way to create a functional equivalent. The shift has permitted the agency to continue analyzing social links revealed by Americans’ email patterns, but without collecting the data in bulk from American telecommunications companies — and with less oversight by the Foreign Intelligence Surveillance Court.

The new document is an Inspector General's report detailing the NSA's failure to follow the restrictions laid down by FISC Judge John Bates in his October 3, 2011 opinion. Bates felt the collection of US persons' email content in this fashion amounted to an illegal wiretap. This would be the same collection the NSA defended (before it was given more power to collect domestic data without a warrant by the 2008 FISA Amendments Act) in the FISA court by claiming an email address was the same thing as a "facility," because email addresses "facilitate" communications.

So, the reassurances -- offered in response to the Snowden leaks -- that the program had been shut down are essentially meaningless. The NSA halted a particular collection method, but did not halt the collection of domestic emails.

The report explained that there were two other legal ways to get such data. One was the collection of bulk data that had been gathered in other countries, where the N.S.A.’s activities are largely not subject to regulation by the Foreign Intelligence Surveillance Act and oversight by the intelligence court. Because of the way the Internet operates, domestic data is often found on fiber optic cables abroad.

As Marcy Wheeler points out, the killing of one domestic email collection and initiation of another meant some NSA personnel were very busy during the 2011 holiday season.

Given the length of the redacted date (it is one character longer than “9 December 2011”), we can say with some confidence that Keith Alexander approved the end and destruction of the dragnet between November 10 and 30 — during the same period the government was considering appealing Bates’ ruling, close to the day — November 22 — NSA submitted a motion arguing that Section 1809(a)(2)’s wiretapping rules don’t apply to it, and the day, a week later, it told John Bates it could not segregate the pre-October 31 dragnet data from post October 31 dragnet data.

Think how busy a time this already was for the legal and tech people, given the scramble to keep upstream 702 approved! And yet, at precisely the same time, they decided they should nuke the dragnet, and nuke it immediately, before the existing dragnet order expired, creating another headache for the legal and tech people. My apologies to the people who missed Thanksgiving dinner in 2011 dealing with both these headaches at once.

Not only did NSA nuke the dragnet, but they did it quickly. As I said, it appears Alexander approved nuking it November 10 or later. By December 9, it was gone.

As she goes on to detail, the program the Inspector General was looking for was indeed gone. But the collection itself wasn't. As far as the IG could tell, the NSA was mostly in compliance. The IG's report, however, notes its powers to assess the collection, storage and access to email data and content are very limited. As Wheeler puts it, the NSA "ate" its homework before the IG had a chance to assess its compliance.

As to the the intake side,those folks started destroying the dragnet before the IG could come by and check their before status:

"However, S3 had completed its purge before we had the opportunity to observe. As a result we were able to review the [data acquisition database] purge procedures only for reasonableness; we were not able to do the before and after comparisons that we did for the TD systems and databases disclosed to us."

Poof! All gone, before the IG can even come over and take a look at what they actually had.

Importantly, the IG stresses that his team doesn’t have a way of proving the dragnet isn’t hidden somewhere in NSA’s servers.

"It is important to note that we lack the necessary system accesses and technical resources to search NSA’s networks to independently verify that only the disclosed repositories stored PR/TT metadata."

The Inspector General's office appears to have been steered to its conclusion by the NSA, which dumped the data from the places it expected the IG to look ("disclosed repositories") and utilized a new collection method that wasn't subject to FISA court restrictions or nearly as much IG oversight.

So, the NSA's statements about shutting down the email program in 2011 are technically correct. It was shut down. The NSA, however, simply chose to siphon as much domestic data from its overseas collections as possible to ensure it never really had to end its warrantless collection of US persons' emails.

Filed Under: bulk collection, email, internet, mass surveillance, metadata, nsa, surveillance

Chipotle Exposes Private Data By Sending HR E-mails Via Unowned Domain, Doesn't See The Problem

from the utterly-oblivious dept

Chipotle has been making headlines lately for all the wrong reasons. While justifiably lauded for its efforts at embracing more sustainable agriculture, the restaurant is currently in the aftermath of a massive E. Coli outbreak in Washington and Oregon that resulted in dozens of illnesses and hospitalizations. And while the CDC's ongoing investigation of that outbreak is grabbing most of the public's attention, the company's quietly been caught up in another, less noticed snafu involving a total lack of fundamental, security common sense.

Apparently, Chipotle’s human resources department has been replying to new job applicants using the "chipotlehr.com" domain. The problem? This is a domain that the company neither owns nor controls, meaning that anybody could nab it for themselves and, with minimal effort, begin harvesting applicant data while posing as Chipotle. While the messages sent to applicants from this domain urge them not to respond to the e-mail, the fact that an unowned domain is being used for communications still remains obviously problematic:Noticing this potentially major problem, a security researcher named Michael Kohlman (applying to apparently maintain unemployment benefits while between gigs) grabbed the domain for $30. He then reached out to Chipotle to explain the potential liability of the company's sloppy security and offer the company the domain, for free. Chipotle's response? Utter and total denial that there was any problem whatsoever:

"Kohlman has since offered to freely give over the domain to the restaurant chain. But Chipotle expressed zero interest in acquiring the free domain. In fact, Chipotle’s spokesman Chris Arnold says the company doesn’t see this as a big deal at all.

"The chipotlehr.com domain is not a functional address and never has been,” Arnold wrote in an emailed statement. “It never had any operational significance, and never served to solicit or accept any kind of response. So there has never been a security risk of any kind associated with this. That address is being changed to careers.chipotle.com (a domain that we do own), but this has never been functional and is really a non-issue.”

That's a $3.5 billion company showing it has zero understanding of security. At all. The fact that it lacked "operational significance" is totally irrelevant. All a hacker would need to do is register the domain, begin replying to recipients, and direct them to even a crude facsimile of a real Chipotle website. From there, it would have been trivial to farm applicants for all manner of personal data, including addresses, phone numbers, and social security numbers. The proper response from Chipotle to somebody highlighting this and offering the domain for free? Thank you.

Filed Under: email, hr, security
Companies: chipotle