Sony Fires Off Letter To Press Outlets Demanding They Cease Publication Of And Destroy Any 'Stolen Information'

from the that-one-time-when-a-major-corporation-shot-itself-in-the-face dept

Sony may have no idea how to how to run a secure enterprise, but it doesn't really take a whole lot of expertise or technical know-how to see that this particular gambit could only backfire.

In a sharply worded letter sent to news organizations, including The New York Times, David Boies, a lawyer for Sony, characterized the documents posted online as “stolen information” and demanded that they be avoided, and destroyed if they had already been downloaded or otherwise acquired.

The studio “does not consent to your possession, review, copying, dissemination, publication, uploading, downloading or making any use” of the information, Mr. Boies wrote in a three-page letter sent Sunday morning to the legal departments of media organizations.

Somebody approved this -- someone higher up than David Boies. And that someone should probably step down and concentrate on staining his yacht deck or seeking to be nominated in the next Congressional election, or whatever it is studio execs do when they've outlived their usefulness.

The letter's wording [pdf link] makes it sound as though the press outlets are doing something illegal (mainly through repetitive use of the word "stolen") but is careful never to make that actual claim. It tries to bluster its way towards legitimacy by inserting a list of "in case of 'stolen' information" requests (worded to look like legal demands) into the letter.

As soon as you suspect that you may have possession of any of the Stolen Information*, we ask that you

(1) notify us using the contact information provided below;

(2) take all reasonable actions to prevent your company and any of your employees, independent contractors, agents, consultants, or anyone who may have access to your files from examining, copying, disseminating, distributing, publishing, downloading,uploading, or making any other use of the Stolen Information;

(3) arrange for and supervise the destruction of all copies of the Stolen Information in your possession or under your control, particularly information protected under US. and foreign legal doctrines protecting attorney-client privileged communications, attorney work product, and related privileges and protections, as well as private financial and other confidential information and communications of current and former personnel and others, confidential personnel data, intellectual property, trade secrets andother business secrets and related communications; and

(4) confirm that such destruction has been completed.**

In addition, if you have provided the Stolen Information to anyone outside of your company, we ask that you provide them with a copy of this letter, and request the destruction of the Stolen Information by the recipient.

[*"Stolen Information" being much more sensitive than your garden variety, lower-case "stolen information," obvs.]
[**"Recycle Bin had little pieces of paper in it, but now appears to be empty."]

I imagine the contact information provided is swiftly being bombarded with ridicule, fake tips, more ridicule, more fake tips and pictures of empty Recycle Bins.

The only threat in the document (other than the overall tone) is this:

If you do not comply with this request, and the Stolen Information is used or disseminated by you in any manner, SPE will have no choice but to hold you responsible for any damage or loss arising from such use or dissemination by you, including any damages or loss to SPE or others, and including, but not limited to, any loss of value of intellectual property and trade secrets resulting from your actions.

OK. Good luck with that. The Supreme Court has already held that this sort of dissemination is protected by the First Amendment. (h/t to Marcia Hofmann)

In a 6-3 opinion delivered by Justice John Paul Stevens, the Court held that the First Amendment protects the disclosure of illegally intercepted communications by parties who did not participate in the illegal interception.

The only mitigating factor is the relative worth of the "stolen information" to the public interest. Much of what's been covered likely isn't and much of what's contained in the files that hasn't been disseminated by press outlets definitely isn't. But there are some revelations that are definitely matters of public interest, not the least of which is the MPAA's plan to throw money at elected officials in exchange for some Google-hassling.

Sony appears to be in full panic mode, but it's tough to sympathize with a corporation that has been hacked 56 times in 12 years but still keeps passwords in a folder labeled "Passwords." This latest move won't earn it anything more than an internetload of derision.

Filed Under: david boies, emails, first amendment, free speech, journalism, sony emails, sony hack, sony pictures hack, stolen information, threats
Companies: sony, sony pictures

Sony Jabs Hornets Nest, Allegedly Engages In DDoS Attacks Against Sites Hosting Leaked Documents

from the Sony-Pictures-tells-astonished-reporter-studio-is-'bigger-than-logic' dept

To be sure, there is a large amount of schadenfreude contained within the hacking of Sony Pictures. To have your dirty laundry aired for the world to see is excruciatingly painful, but Sony Corporation's past actions have drawn a target on its back on multiple occasions.

Rayne, a contributor to Marcy Wheeler's emptywheel blog, notes that Sony has been hacked 56 times in twelve years. And it has learned nothing. Passwords for Sony Pictures accounts were stashed away in a folder labeled "Passwords." The password for this folder? "Password."

So, when Sony fights back, as it is now, it's far too late. It had several chances to shore up its defenses, but it never made a serious effort to fix its security holes. Now, nearly everything has been exposed. Celebrities' personal data. Staffers' borderline racist opinions on Barack Obama's movie preferences. Its plan to join the MPAA in paying off states' attorneys general to go after Google.

Sony has issued hundreds of DMCA notices in response to the leaked documents. It has seeded bogus torrents to thwart further distribution. Now, it's allegedly decided to take an even more aggressive approach to the continuing leaks.

The company is using hundreds of computers in Asia to execute what’s known as a denial of service attack on sites where its pilfered data is available, according to two people with direct knowledge of the matter.

Sony is using Amazon Web Services, the Internet retailer’s cloud computing unit, which operates data centers in Tokyo and Singapore, to carry out the counterattack, one of the sources said.

Or not. Or possibly not at this moment. Re/code's updated post contains a denial from Amazon.

“The activity being reported is not currently happening on AWS (Amazon Web Service),” Amazon said in an emailed statement to Re/code on Thursday. Amazon declined to comment further on whether the activity happened prior to Thursday.

“AWS employs a number of automated detection and mitigation techniques to prevent the misuse of our services,” according to Amazon’s statement. “In cases where the misuse is not detected and stopped by the automated measures, we take manual action as soon as we become aware of any misuse.”

Re/code's sources say "yes." Others say this isn't happening.

CloudFlare, which offers denial-of-service protection and network monitoring, said it has not seen anything that would suggest Sony had conducted a counter-attack. The company said it would continue monitoring the situation.

If Sony is indeed engaged in DDoS attacks, it's participating in the sort of behavior it's been quick to decry in the past. Sony Pictures may be relishing the chance to turn hackers' tools against them, but its history strongly suggests it really isn't in the position to be provoking further attacks. To pursue this option is pure hubris. It's hypocrisy and stupidity rolled into one. It may think it will escape this latest hack bowed but not broken, but whatever pride it has left at this point is delusional. It has opened everything up to criticism by failing to take proper precautions and destroyed its employees' trust that their employer would make the minimum of effort to keep their internal conversations internal.

Filed Under: cfaa, ddos, emails, hack back, sony emails, sony hack, sony picture emails
Companies: sony, sony pictures

Leaked Emails Reveal MPAA Plans To Pay Elected Officials To Attack Google

from the holy-fuck dept

Okay, it's no secret that the MPAA hates Google. It doesn't take a psychology expert to figure that out. But in the last few days, some of the leaks from the Sony Pictures hack have revealed the depths of that hatred, raising serious questions about how the MPAA abuses the legal process in corrupt and dangerous ways. The most serious charge -- unfortunately completely buried by this report at The Verge -- is that it appears the MPAA and the major Hollywood studios directly funded various state Attorneys General in their efforts to attack and shame Google. Think about that for a second.

There's a lot of background here that's important (beyond just the MPAA really hates Google). First, as you know, the MPAA has certainly not given up on its SOPA desire to get certain websites completely blocked. The leaked emails reveal a lot more about that (which we'll get to). Second, a year ago, the MPAA hired a pitbull of an anti-piracy lawyer in naming Steve Fabrizio its General Counsel. Fabrizio has spent the last decade and a half or so deeply involved in litigating a bunch of anti-piracy battles at both the RIAA and the MPAA/RIAA's favorite big law firm, Jenner & Block. This is not a guy you hire if you're looking to innovate. This is a guy you hire if you want to get into knock-down, dirty legal fights.

Third, there is the role of state Attorneys General. A recent NY Times article detailed how lobbyists have figured out ways to effectively "lobby" state Attorneys General to do their bidding. Frequently, this is around getting the state AGs to drop investigations (and potential lawsuits) against companies. The article is somewhat eye-opening, as it's hard to distinguish much of what's discussed from straight up bribery. There is talk of lavish events, travel and dinners all paid for by corporate lobbyists for state AGs, often followed soon after with dropped, or reduced investigations. In one case, an AG told staff not to start an investigation into a public company without first getting his approval. Campaign funding is a big part of it as well, as these lobbyists dump lots of money into AG campaigns. And it's no secret that the state Attorney General position is often seen as a stepping stone to a Governorship or US Senate job.

We've discussed in the past that state Attorneys General are often the biggest grandstanders, as their main goal in certain investigations seems to be about generating headlines for themselves, rather than any real legal basis. More than four years ago, we wrote about Topix CEO Chris Tolles' experience being hounded by state Attorneys' General so they could get a bunch of headlines out of something in which everyone admitted Topix wasn't actually doing anything illegal. Along those lines, we've noted that popular tech companies have increasingly been a target for state AGs -- because they're almost sure to generate headlines. We've also noted that state AGs have been pushing for changes to federal laws, like Section 230 of the CDA, to allow them to further go after big tech companies for things like actions of their users.

Not surprisingly, Google has been a popular target for some state AGs. In the past, we've written about state Attorneys General from Nebraska and Oklahoma blaming Google for videos made by users, and about Texas' Attorney General going after Google for supposed antitrust violations (based on the same claims that the FTC later dropped entirely). But the state Attorney General with the biggest chip on his shoulder for Google has absolutely been Mississippi Attorney General Jim Hood, who seemed to think that it was Google's fault that he could find counterfeit goods via search. A few months later, he was back blaming Google for infringement online as well.

This was no accident. What's come out of the Sony Pictures Leak is not just that the MPAA was buddying up to state Attorneys General, but that the MPAA was funding some of this activity and actively supporting the investigation. The leaked emails reveal that rather than seeing that NY Times article about corporate/AG corruption as a warning sign, the MPAA viewed it as a playbook. But not for preventing investigations but for encouraging and funding them. This appears to go way beyond that NY Times article. This isn't campaign donations or inviting AGs to speak at lavish events and paying for the travel. This is flat out paying AGs to investigate Google (even on issues unrelated to copyright infringement) and then promising to get extra press attention to those articles.

Here's the Verge's summary of a key email (which the Verge doesn't even seem to realize why it's so damning):

May 8, 2014: Fabrizio to group. "We’ve had success to date in motivating the AGs; however as they approach the CID phase, the AGs will need greater levels of legal support." He outlines two options, ranging from $585,000 to $1.175 million, which includes legal support for AGs (through Jenner) and optional investigation and analysis of ("ammunition / evidence against") Goliath. Both options include at least $85,000 for communication (e.g. "Respond to / rebut Goliath's public advocacy, amplify negative Goliath news, [and] seed media stories based on investigation and AG actions.").

"Goliath" is the MPAA's rather transparent "codename" for Google. CID stands for a "civil investigative demand" -- which is a form of an administrative subpoena, demanding information from a company, related to an investigation.

What seems to come out from these emails is that the MPAA, in coordination with the major Hollywood studios, agreed to willfully pay tons of money indirectly to state AGs (and Hood in particular) to get them to investigate Google (using the time and labor of the MPAA's favorite law firm -- and the one that Fabrizio just left). That goes way beyond anything discussed in that NY Times articles, and certainly smacks of serious illegality. It's difficult to see how this isn't bribing a public official to attack a company they dislike.

Not only that, but it shows that the MPAA and the studios were aware of Hood's plans well before they happened, suggesting that he or his office has been coordinating with Hollywood on their plans and that the specific CIDs are actually written by the MPAA's lawyers themselves:

A report from the previous February suggests that the Goliath group drafted civil investigative demands (similar to a subpoena) to be issued by the attorneys general. "Some subset of AGs (3-5, but Hood alone if necessary) should move toward issuing CIDs before mid-May," the email says.

And, more recent emails (from just in October) show that they know that another CID is apparently coming and that the MPAA intends to use that CID for negotiating leverage against Google. This follows a claim that Google was pissed off at the MPAA for mocking its recent search algorithm changes to further push down sites that may link to infringing materials (it's not like we didn't warn everyone that the MPAA wouldn't be satisfied with Google's changes). Either way, the MPAA's Fabrizio brushes off concerns that Google has, telling the studios not to worry, that Google should be more willing to talk after Hood sends out his next CID:

After a dispute over Google’s most recent anti-piracy measures in October, Fabrizio suggested further action may be yet to come. "We believe Google is overreacting — and dramatically so. Their reaction seems tactical (or childish)," the email reads. "Following the issuance of the CID [civil investigative demand] by [Mississippi attorney general Jim] Hood (which may create yet another uproar by Google), we may be in a position for more serious discussions with Google."

While the Verge report is focused on the "sexy" topic of the MPAA having an "anti-Google' (er... "Goliath") working group, the real story here is that it appears that this infatuation with taking down Google has extended to funding state politicians in their investigations and attacks on Google, even when it's on totally unrelated issues (the initial CID was about counterfeit drugs -- which is an issue that the MPAA likes to mock Google over by totally misrepresenting some actual, but historical, bad behavior).

And beyond that, the MPAA is showing that part of its plan is to fund "media stories based on" the Attorneys General investigations. Remember, so much AG activity these days is driven by what's going to get them into the headlines. Setting aside nearly $100,000 from the MPAA to get a state AG some headlines for an investigation paid for by the MPAA, using administrative subpoenas written by the MPAA... all designed to attack a company they don't like (which actually has done pretty much exactly what they'd been asking for in downranking sites that lead to infringing works), is really stunning.

I get that it's natural to dislike a company or organization that has undermined your business model. It happens. But there are different ways to respond to it. One is to innovate and compete. Another is to use the legal process to throw hurdles in their path. This is the distinction between "market entrepreneurs" and "political entrepreneurs" that Andy Kessler has described. What the MPAA appears to have done in the last few months, however, certainly suggests that the organization, with the help of the major studios, went beyond just lobbying and political pressure, to actually funding elected officials to try to attack a company they didn't like. And, at the very least, this also has to raise serious questions about Mississippi Attorney General Jim Hood and who he takes orders from. Is he really "protecting" the people of Mississippi? Or is he focused on gobbling up Hollywood's money and promotion?

Filed Under: corruption, emails, hack, jim hood, lobbying, state attorneys general, steve fabrizio
Companies: google, mpaa, sony

New York State Keeps Government Emails Out Of The Public's Hands With Its 90-Day Retention Limit

from the shredders-and-burn-barrels-have-nothing-on-automation dept

New York Governor Andrew Cuomo's office continues to do everything it can to prevent its emails from being accessed by FOIL (Freedom of Information Law) requests. As Justin Elliott of ProPublica reported earlier this year, Cuomo's office has been making use of personal email accounts to skirt FOIL requests.

Adopting a tactic that has been used by officials ranging from Sarah Palin to staffers of New Jersey Gov. Chris Christie, aides to New York Gov. Andrew Cuomo are sending emails from private accounts to conduct official business.

I know because I got one myself. And three other people who interact with the governor's office on policy or media matters told me they have too. None of the others wanted to be named.

This isn't all Cuomo's office is doing, though. It's also set its email retention bar incredibly low. With personal email accounts already removing a certain percentage of communications from the "responsive document" set, the governor's office has moved towards eradicating access to the rest, using an unusually short retention schedule. ProPublica again has the story.

Last year, the state started deleting any emails more than 90 days old that users hadn't specifically saved — a much more aggressive stance than many other states. The policy shift was first reported by the Albany Times Union.

A previously unpublished memo outlining the policy raises new questions about the state's stated rationale for its deletions policy. What's more, the rules on which emails must be retained are bewilderingly complex – they fill 118 pages – leading to further concern that emails may not be saved at all.

The state's policy is supposedly predicated on storage limitations. But this was put into place as part of a move to Microsoft's Office365, which offers 50 Gb of storage per email user. And, as ProPublica points out, the state's version includes unlimited email archiving.

Despite the reality of the storage situation (i.e, that it's not going to ever be a problem), the state still automatically deletes emails when they hit the expiration date. When asked why the state does this when it's obvious it has plenty of email storage space, it delivered this nonsensical response.

The Office of Information and Technology Services declined to comment on the record. An official in the office said even though the state can store large quantities of email, it can still be difficult to manage.

"Just because you have a big house doesn't mean you have to shove stuff in it," the official said.

Yeah, but if this "big house" was actually purchased for you by the public to store stuff it might need later, the purchasers expect you to make full use of the storage space. What it doesn't expect is for you to throw out a large percentage of its belongings (government emails are public records) every 90 days. Policies vary from state to state, with most email being held for two years minimum. Certain categories are held onto for a longer period of time, but rarely, if ever, are government emails given a shorter "sell by" date than the state of New York.

Not everything disappears at 90 days. Some are supposed to be held onto for far longer, but as far as ProPublica can tell, there's no one in place to ensure the numerous and complex retention rules are followed.

There is no internal or external watchdog to make sure the rules are being followed, [John] Kaehny [president, Reinvent Albany] said.

The state also doesn't have a standardized system for preserving emails that do have to be saved, according to the Office of Information Technology Services official. State workers can save their emails by printing them out, pasting them into Microsoft Word documents or placing them in a special folder in the email program itself.

"Everyone does it differently, and some people are still learning how to do it," the official said.

Email related to FOIL requests and litigation is supposed to be preserved indefinitely. But with de facto 90-day destruction in place, journalists and others seeking public records would need to know what they're searching for before the corresponding emails have even been composed. Government misconduct is usually discovered months or years down the road. By that time, most responsive emails will have long since been destroyed, especially when there's no one making sure possibly incriminating communications are retained.

What's being touted as a solution to an email management problem looks an awful lot like an easy way to minimize the number of responsive documents that might be returned to a citizens' rights group or an investigative journalist. Ninety days isn't acceptable as a warranty period, much less a time frame for the retention of public records.

Filed Under: andrew cuomo, deleting emails, emails, foil, freedom of information, new york, transparency

CIA Spying On The Senate Went Much Further Than Originally Reported

from the because-of-course-it-did dept

We already covered how the CIA has admitted to and apologized for its spying on the Senate, but the CIA's official "unclassified" statement on the matter shows that what the CIA did was even worse than the initial allegations. Here's the basic summary, according to the CIA's Inspector General:

Agency Access to Files on the SSCI RDINet: Five Agency employees, two attorneys and three information technology (IT) staff members, improperly accessed or caused access to the SSCI Majority staff shared drives on the RDINet.

Agency Crimes Report on Alleged Misconduct by SSCI Staff: The Agency filed a crimes report with the DOJ, as required by Executive Order 12333 and the 1995 Crimes Reporting Memorandum between the DOJ and the Intelligence Community, reporting that SSCI staff members may have improperly accessed Agency information on the RDINet. However, the factual basis for the referral was not supported, as the author of the referral had been provided inaccurate information on which the letter was based. After review, the DOJ declined to open a criminal investigation of the matter alleged in the crimes report.

Office of Security Review of SSCI Staff Activity: Subsequent to directive by the D/CIA to halt the Agency review of SSCI staff access to the RDINet, and unaware of the D/CIA’s direction, the Office of Security conducted a limited investigation of SSCI activities on the RDINet. That effort included a keyword search of all and a review of some of the emails of SSCI Majority staff members on the RDINet system.

Lack of Candor: The three IT staff members demonstrated a lack of candor about their activities during interviews by the OIG.

So, the first bit we already knew. That's what Senator Feinstein initially revealed -- and Brennan pretended to deny, while actually admitting to the facts about them accessing the Senate Intelligence Committee's private network where they were storing documents for their investigation into the CIA's torture program.

We also knew that the CIA had bogusly reported the Senate staffers to the DOJ, claiming they had "improperly accessed" CIA information. However, now the CIA is admitting that "the factual basis for the referral was not supported." In other words, for all of Brennan's blustering about how awful the Senate staffers were and how they were breaking the law, it appears that the CIA knew they were making it up. That's really bad.

But it's the next item where things get really dicey. After all of this came out and Brennan told the CIA folks to knock it off, CIA people spied on the emails of the Senate staffers. Let's repeat that. After Feinstein had already made this public and called the CIA out on its spying of intelligence committee staff members and after Brennan told them to knock if off, the CIA went and directly spied on emails. The AP is further reporting that "the CIA used classified "hacking tools" and created a fake user account in an effort to retrieve documents the CIA believed the Senate staffers had improperly accessed."

This is a major problem, and something of a Constitutional issue, given the separation of powers. No wonder Mark Udall is demanding Brennan's resignation.

Oh, and then we find out that the CIA staffers involved "demonstrated a lack of candor" about all this during the internal investigation by the CIA? Sure, it's an intelligence agency that's built on lying, but it certainly looks like the culture of professionally lying all the time is pretty deep there. Over at Foreign Policy, Shane Harris has gone through the many statements Brennan made vehemently denying the spying. It appears that all of them were false and in some cases, blatant lies.

And, remember, this is only what the CIA has deemed worthy of revealing publicly. The full Inspector General report may be even more devastating.

Filed Under: cia, dianne feinstein, emails, john brennan, senate, senate intelligence committee, separation of powers, spying, torture report

DC Circuit Court Tells District Officials They Can No Longer Hide From FOIA Requests By Using Personal Email Accounts

from the seriously,-stop-being-assholes-about-this dept

With the FOIA process increasingly being routed through courtrooms, it's refreshing to see a court stand up and tell public officials to stop trying to find ways to be less transparent. The DC circuit court recently issued a ruling that shuts down a potential opacity loophole for public officials: the use of personal email accounts.

City officials who conduct public business on personal email accounts must turn their personal emails over in response to a Freedom of Information Act request, according to a recent, first-of-its-kind ruling in D.C. Superior Court.

The July 9 order by Judge Stewart Nash brings the District into line with the majority of states that have addressed the issue, signaling an emerging trend in favor of government transparency—if not an end to efforts to work around disclosure laws.

The district's attorneys tried to argue that the neighborhood advisory commission's emails (at least those routed in and out of Commissioner Dianne Barnes' personal account) were exempt from FOIA requests because the account used wasn't a district-owned account, but the judge wasn't buying it.

"This argument requires the Court to ignore Ms. Barnes’s position as Commissioner of the ANC," the judge wrote. "To the extent that Ms. Barnes is acting in her capacity as Commissioner of the ANC, then communications made or received by her would be communications of the ANC, irrespective of whether such communications were associated with her personal e-mail account."

Public officials (like former New York City mayor Mike Bloomberg) have tried to keep certain communications out of the hands of the public by using personal devices and email accounts. To a certain extent, this has worked. But many states have established policies in order to close this loophole, basically stating that it doesn't matter where the communication originates but what the subject matter is.

As that view has been challenged, states have increasingly found that the content, not the ownership of the device or account, is the determining factor of whether a communication about public business is subject to FOIA disclosure laws, according to the peer-reviewed journal Communication Law and Policy.

Which is as it should be. The Freedom of Information law was created to help the public hold their representatives and public servants accountable, as well as to provide insight to the how and why of government activity. Routing around this by using personal devices cuts the public out of the loop. A government that often argues "nothing to hide" means "nothing to fear" certainly seems to be doing a lot of hiding, leading directly to people questioning what exactly it has to fear. Considering these are people in seats of power, these deliberate attempts to hide public communications is, at the very least, misconduct, if not actual cowardice.

Judge Nash's earlier verbal order for the district to turn over the requested emails was ignored. Now, it's in writing. Without a doubt, the district will challenge this ruling before it hands over anything, forcing a member of the public to spend even more money and time suing the government into compliance with its own statutes and laws.

Filed Under: emails, foia, freedom of information, government officials, personal email accounts, stewart nash, transparency

IRS To Public: You Need To Hold Onto Your Records For 2-7 Years; We'll Just Trash Ours Whenever We Feel Like It

from the hire-an-accountant-and-marvel-at-our-lack-of-accountability dept

How long should I keep my records?

Note: Keep copies of your filed tax returns. They help in preparing future tax returns and making computations if you file an amended return.

1. You owe additional tax and situations (2), (3), and (4), below, do not apply to you; keep records for 3 years.
2. You do not report income that you should report, and it is more than 25% of the gross income shown on your return; keep records for 6 years.
3. You file a fraudulent return; keep records indefinitely.
4. You do not file a return; keep records indefinitely.
5. You file a claim for credit or refund* after you file your return; keep records for 3 years from the date you filed your original return or 2 years from the date you paid the tax, whichever is later.
6. You file a claim for a loss from worthless securities or bad debt deduction; keep records for 7 years.

Keep all employment tax records for at least 4 years after the date that the tax becomes due or is paid, whichever is later.

Source: IRS

How long should the IRS hold onto emails that are considered part of public records?

Answer: until the hard drive is recycled.

Ex-IRS official Lois Lerner's crashed hard drive has been recycled, making it likely the lost emails of the lightening rod in the tea party targeting controversy will never be found, according to multiple sources.

"We've been informed that the hard drive has been thrown away," Sen. Orrin Hatch of Utah, the top Republican on the Finance Committee, said in a brief hallway interview.

Citizens, the burden of proof lies on you when the IRS starts asking questions. You retain these records or bear the consequences. When the IRS loses two years of email, it simply rehashes what happens, shrugs its shoulders and waits for the NSA's Glomar on Lois Lerner's email metadata.

On one hand, at the point it was thrown away, those currently being investigated by Congress probably had no idea the emails contained would be requested two years later. On the other hand, the agency has the specific duty to retain this information to remain in compliance with federal public records regulations. Scrapping a hard drive doesn't sound like the move of an agency interested in maintaining public records.

Lerner's crashed hard drive was subpoenaed by Darrell Issa and computer forensics experts were fairly certain they could recover the data from the drive. But the drive no longer exists and it appears the IRS never made an effort to recover anything IRS-related from the drive.

Lerner, however, seemed greatly concerned about the recovery of certain items unrelated to the public records she was supposed to be maintaining. Here's a screenshot of an email discussing the crash, posted by John Hinderaker at Power Line.


If you can't see this screenshot, it says the following:

It was nice to meet you this morning -- although I would have preferred it was under different circumstances. I'm taking you up on your offer to try and recapture my lost personal files. My computer skills are pretty basic, so nothing fancy -- but there were some documents in the files that are irreplaceable. Whatever you can do to help, is greatly appreciated…

As Hinderaker points out, Lerner seems dismayed to have lost some personal files, but is completely unconcerned that years of emails may have been destroyed as well.

It is remarkable that Lerner does not say: "Oh no! My hard drive crashed, and the IRS's only copy of two years' worth of my highly important work has been lost!" No: she is concerned about "my lost personal files," because "there were some documents in the files that are irreplaceable." That is a clearly stated and entirely reasonable concern, but it has nothing to do with losing the agency's only record of two years of work.

As more details come out, the IRS is looking worse and worse. But these additional details are pushing the perception more into the "expected bureaucratic incompetence" area, rather than towards "large-scale conspiracy to destroy evidence."

Still, the agency's long-standing practice of taping over previous backups and pitifully small amounts of email storage doesn't exactly evoke confidence in the IRS's ability to maintain public records. That whatever effort was actually made to recover data from Lerner's crashed computer seems to have revolved around "personal" files makes this situation even worse. The IRS requires hard copy backups of any email that could conceivably be part of the "public record," but it appears that no one involved followed that rule. The rash of coincidental crashes only adds to the negative perception.

The IRS -- and the government -- demands so much from its citizens with pages and pages of federal regulations but it can't even be bothered to follow the few rules it sets for itself. Pathetic.

Filed Under: emails, hard drive, irs, lois lerner, public, records

IRS Now Says It Has Lost Emails From Six More Accounts Tied To The Investigation Of Its Targeting Of Tax-Exempt Groups

from the evil-or-just-stupid? dept

The IRS recently blamed a "computer crash" for the disappearance of two years of email correspondence involving Lois Lerner, the IRS official at the center of the controversy surrounding the agency's apparent targeting of certain non-profit groups (Tea Party, Occupy, open source).

Apparently, this computer crash also destroyed any backups of the email between Lerner's office and outside government agencies, along with the hard copy backups IRS employees are required to maintain as part of its public records obligations. The latter part of that hasn't been specifically denied, but it's assumed no one's rounding up email printouts at the moment. As is the new Standard Operating Procedure for Grandstanding, a Congressman has demanded the NSA hand over the metadata on the missing Lerner emails.

Now, it appears that Lois Lerner's computer crash was only part of a much larger series of well-timed computer crashes.

The Internal Revenue Service says it can't produce e-mails from six more employees involved in the targeting of conservative groups, according to two Republicans investigating the scandal.

The IRS recently informed Ways and Means chairman Dave Camp and subcommittee chairman Charles Boustany that computer crashes resulted in additional lost e-mails, including from Nikole Flax, the chief of staff to former IRS commissioner Steven Miller, who was fired in the wake of the targeting scandal.

The question is still: conspiracy or colossal screwup?

Certainly the fact that emails and accounts directly related to the investigation are missing data from the crucial 2009-2011 period does make it look like the agency's hiding something. But the possibility that this is can be chalked up to regular government ineptitude is never too far away.

As was noted earlier (in the IRS's own documentation no less), the agency uses Microsoft Outlook and Exchange, which would suggest that further backups exist, as does (again) the IRS's own statements. John Hinderaker at Power Line quotes the IRS on its backup processes.

For disaster recovery purposes, the IRS does a daily back-up of its email servers. … Prior to May 2013, these backups were retained on tape for six months, and then for cost efficiency, the back-up tapes were released for re-use. In May of last year, the IRS changed its policy and began storing rather than recycling its backup tapes.

This means that older backups no longer exist, at least anything "taped over" prior to the change of policy. One wonders why the agency was allowed to recycle backups when much of what's being backed up is subject to public records laws. But to make the situation even worse, the IRS greatly restricted the number of emails each employee could retain.

Currently, the average individual employee's email box limit is 500 megabytes, which translates to approximately 6,000 emails. … Prior to July 2011, the limit was lower, 150 megabytes or roughly 1,800 emails.

As Hinderaker points out, someone in Lerner's position could run through that allotment in just a few days, meaning she would most likely begin archiving them to her own computer, something that could actually destroy emails when it crashed.

But this doesn't excuse the missing email, although it does help explain it. As the IRS's own policies note, archiving email to local storage is not an adequate solution and does not comply with public records regulations. So, Lerner and the six others affected should have had hard copy printouts of every email that could possibly be considered a relevant public record. Apparently, they don't and it's highly unlikely that many IRS officials take this Luddic requirement seriously.

Even with this additional information, the coverup theory isn't completely dispelled. One computer crash nuking vital emails is unfortunate. Six computers all taking out relevant email from a specific time period goes far past coincidental. The fact that the IRS hid this from the investigatory committee for months before finally "revealing" it on page 15 of a 27-page letter lends more credence to those who feel there's been a concerted effort to keep information buried. It also should be noted that the IRS itself has not stepped up and explained how something like this could happen (other than saying "computer crash"). Anything pertaining to the IRS's regrettable backup "solutions" and absurdly tiny email storage has been uncovered by the research of others. So, until the agency has anything further to add, the scale remains perfectly balanced between "malice" and "stupidity."

Filed Under: congress, dave camp, destruction, emails, evidence, irs, lois lerner, records

Eric Holder Admits That, If It Wanted, NSA Could Collect Internet Searches & Emails Just Like Phone Metadata

from the no-constitutional-issue-at-all dept

During a recent House Judiciary Committee hearing concerning oversight, Rep. Zoe Lofgren decided to quiz Attorney General Eric Holder about the federal government's surveillance efforts, starting off with a rather simple question. She notes that the bulk phone record collection program is considered to be legal by its supporters, based on Section 215 of the Patriot Act, which allows for the collection of "business records." So, she wonders, is there any legal distinction between phone records and, say, internet searches or emails? In other words, does the DOJ believe that it would be perfectly legal for the US government to scoop up all your search records and emails without a warrant? Holder clearly does not want to answer the question, and first tries to answer a different question, concerning the bulk phone records program, and how the administration is supposedly committed to ending it. But eventually he's forced to admit that there's no legal distinction: This is important. As you may recall, some of the attempts to deal with the phone record collection, including President Obama's, focus only on ending the specific phone record collection program, not the underlying law (or the interpretation of that law). This isn't to say that there are ongoing programs to do bulk warrantless collection of those other types of information, but it is worth recognizing that the government believes there would be no Constitutional issue if it decided to set up such a program.

All along, this has been the problem with Section 215. When it first was discussed, it was often called the "library" provision, as the example that people talked about was using Section 215 to collect the records of what books someone checked out of the library. However, as the phone collection program showed, it's been turned into something much, much broader. Fixing this interpretation is going to take a lot more than just ending one program. It requires changing what is allowed by Section 215.

Filed Under: 4th amendment, business records, emails, eric holder, internet searches, nsa, section 215, surveillance, warrants, zoe lofgren

The IRS And SEC Want To Snoop Through Your Email Without A Warrant; Don't Let Them

from the speak-up,-fix-ecpa dept

We've talked a lot about ECPA reform -- which is the incredibly outdated "electronic communications privacy act" which actually makes sure that you have less privacy than other forms of communication. This isn't necessarily on purpose, but because the law was written in the mid-1980s when email itself was a relatively new concept. It includes some bizarre distinctions between opened and unopened emails and if a message has been "left on a server" for more than 180 days (at which point it's considered "abandoned" and not subject to a warrant). Obviously it never anticipated the kind of internet we have today. It also goes against basic 4th Amendment principles and treats electronic messages differently from physical messages.

There actually is a fair bit of support in both Congress and the White House to fix this... if we can get enough public support behind it, which includes getting more people to sign this petition. As with SOPA, there's a strong suggestion that if this petition tips the scales at 100,000, we can get the White House to come out in favor of ECPA reform.

What's standing in the way? Well, a bunch of government agencies, honestly. There are the obvious ones like the DOJ and DHS. That's to be expected. They always want to make it easier to snoop through emails and written communications. But apparently some of the strongest voices trying to block ECPA reform within the government are coming from the SEC and the IRS, because they too see plenty of advantages in trying to snoop through emails without having to take the trouble of getting a warrant.

As I write this, I'm participating in a Reddit AMA (Ask Me Anything) with Chris Calabrese from the ACLU, Mark Stanley from the Center for Democracy and Technology and Julian Sanchez from the Cato Institute. This coincides with a day of action involving a bunch of companies and organizations trying to get more people to speak out on the importance of ECPA reform. And, finally, the folks at TechFreedom have put together a great infographic, which we've also embedded below.

Filed Under: ecpa, ecpa reform, emails, irs, messaging, privacy, sec, warrants