President Obama Hints At Asking Silicon Valley To Magically Block Terrorists From Using Tech Products

from the not-good dept

As you probably know, last night President Obama gave a big address from the Oval Office about what he plans to do about ISIS, along with dealing with the threat of lone wolf and other attacks at home. Buried deep within (in fact, I missed it the first time through) was a nod towards the idea of pushing Silicon Valley to magically undermine encryption. Here's the entirety of what he said on the subject:

I will urge high tech and law enforcement leaders to make it harder to use technology to escape from justice.

That seems like a simple sentence, but it's loaded with meaning, and most of it's not good. As we've noted over and over again, the last refuge of those looking to undermine encryption is to bring up the idea of "if only Silicon Valley techies and law enforcement could get together, surely they could come up with some magic golden key. But that's clueless, because what they're asking for is impossible. This isn't something that's "difficult" -- it's impossible. You can't make a backdoored encryption system that doesn't make everyone vulnerable and less safe.

And, yes, while you can say he doesn't specifically say "encryption" here, the use of the phrase "technology to escape from justice" clearly implies encryption. Of course, as we've noted time and time again, the hand-wringing over encryption is totally overblown. Every time we look at terrorist attacks, they seem to do plenty of planning out in the open. And, even when encryption is used, law enforcement and the intelligence community have admitted that either the people often mess up, making them trackable, or they leave other trails.

Besides, what changes does President Obama think technology needs to stop a husband and wife from plotting at home to shoot up an office holiday party?

The whole thing is ridiculous -- and perhaps the only redeeming thing is that he didn't say he was going to ask Congress for a law on this, but rather just put pressure on US tech companies. Unfortunately, as we've seen in the past, sometimes that pressure can be intense and almost impossible to refuse. The President's statement today just undermined a whole bunch of the US tech industry's claims towards keeping information private. He just handed a gift to foreign companies.

Filed Under: encryption, going dark, gun control, isis, president obama, terrorists

Saudi Arabia Says It Will Sue Twitter Users Who Compare It To ISIS; Apparently Skips The NY Times

from the can-a-whole-country-do-a-streisand-effect dept

Just about a week ago, the NY Times had a giant article comparing Saudi Arabia to ISIS. It was a rather powerful article that highlights the similarities and connections between the two, while really highlighting the incredibly hypocritical attitude of many Western politicians who freely embrace the Saudi government while claiming that ISIS is barbaric.

Then, just a few days later, Saudi Arabia's Justice Ministry announced that it would sue someone for calling Saudi Arabia "ISIS-like." Of course, it's not the NY Times that the Saudi government is going after, but a Twitter user, who compared a Saudi death sentence for a Palestinian poet to the way ISIS carries out its own "justice" system. The Twitter user in question has not been named. It seems like the strategy here is to scare people away from comparing Saudi Arabia to ISIS, but there's a decent chance that it goes in the other direction. Such a plan is so ridiculous that it seems only likely to draw many more comparisons.

And, really, if your goal is to distance yourself from a group of crazy nutjobs who appear to have a somewhat arbitrary sense of justice and thrive on using the death penalty as a weapon, perhaps announcing plans to go after individuals criticizing you on Twitter isn't the best way to further the distinction.

Filed Under: free speech, isis, saudi arabia, threats

The Anonymous Assault On ISIS Is Hurting More Than It's Helping

from the well-he-sounded-like-a-terrorist dept

In the aftermath of the Paris attacks, portions of Anonymous decided to "launch multiple operations" against the jackass collective that is ISIS/Daesh. Dubbed #OpISIS, the group's self-declared "biggest operation ever" has predominately involved posting what the group claims are ISIS affiliated Twitter accounts to Pastebin. These "ISIS affiliated" users are then reported to Twitter using a "Twatter Reporter" script being circulated among some members of the collective. In a video, Anonymous crows that the group has been responsible for bringing 20,000 ISIS-related social media accounts offline:Except there's a major problem with the latest Anonymous campaign. A large number of the accounts they're suspending have absolutely nothing to do with ISIS. A review of the banned accounts by Ars Technica found that large number of the accounts were banned simply for using Arabic, with many ordinary Palestinian, Chechan and Kurdish users caught in the crossfire. Similarly, some of the banned accounts were trying to troll the religious cult. And there's indications that many in the group aren't even sure who they're supposed to be targeting:

"Meanwhile, some of the people coming to the IRC chat channel associated with the operation don't seem to really understand what's going on. One person logging into the channel asked, "Who's ISIS?" The people managing the channel also demanded that others only speak English in the chat and not "clutter up the channel with only mandarin or Spanish or something."

Twitter insiders meanwhile have commented off the record that the list Anonymous has compiled is a bit of a joke:

"A spokesperson for Twitter, who asked not to be quoted by name, told the Daily Dot that the lists generated by Anonymous are not being used by the company, saying research has found them to be “wildly inaccurate.”

“Users flag content for us through our standard reporting channels, we review their reports manually, and take action if the content violates our rules,” the spokesperson said, adding: “We don't review anonymous lists posted online, but third party reviews have found them to be wildly inaccurate and full of academics and journalists."

And while the group's behavior has been held up by Presidential candidates like Ben Carson as a "model" of how to deal with terrorist groups, this kind of indiscriminate, misinformed hysteria (like oh, trying to ban all Syrian refugees based on false media reports) arguably aids ISIS more than it hurts it. Well aware of this fact, some splinter Anonymous groups (like GhostSec) have started more quietly forwarding their findings to the U.S. government. Other members of Anonymous find cooperating with the government intolerable for obvious reasons:

"It seems rather foolish to me to be aiding our mortal enemies, who lock up and even torture Anons — in a fight against an evil that they themselves actually created. If the USA and Europe were willing to release our Anon POW's, and agree to stop attacking us - in exchange for our rather ample assistance against ISIS, well - that might be different. Until then, I say let NATO and the USA fight their own monsters. At least the resources they will need to dedicated to hunting ISIS can not be used to hunt Anons."

So as usual, the headlessness that helps keep Anonymous alive as an ideal often winds up being its own worst enemy when it comes to coordination and quality control. That's not to say that Anonymous members can't contribute intel, disrupt some online ISIS capabilities, or act as an occasional propaganda counterweight. The group is, after all, helping things out by rick rolling pro ISIS hashtags:

Our upcoming action: spamming verified ISIS hashtags with rickrolls. Will release the list as soon as it's compiled.

— #OpParis (@OpParisOfficial) November 18, 2015

But beyond that, given the lack of any centralized jihadhist mainframe to be DDoS'd, #OpISIS is limited in what it can actually accomplish. Effective international espionage requires a lot more tactical coordination than the leaderless, mythological meme appears capable of, and the kind of societal problems that are driving angry, disenfranchised young people to join the cult of ISIS go much deeper than the hacktivist amoeba's tendrils reach.

Filed Under: anonymous, isis

Did You Hear About How ISIS Has A Sophisticated Training Manual For Encryption? Yeah, It Was Actually A Pamphlet For Journalists And Activists

from the fud-fud-fuddy-fud-fud dept

Did you hear that story about how ISIS is so sophisticated with encryption that they have a special "opsec" manual on computer security protocols? You might have, because last week it was all over the internet. Yahoo kicked it off with a story, claiming it was the secret manual ISIS "uses to teach its soldiers about encryption." Wired followed up with its own story, as did The Telegraph. The "manual" was "discovered" by analysts at the Combating Terrorism Center, based out of the US Military Academy at West Point. Thankfully, Buzzfeed has the details, noting that the guide, created by a cybersecurity firm in Kuwait, named Cyberkov, is actually a guide for journalists and activists to protect their communications from oppressive governments. And there's nothing particularly secret about it, as apparently it's basically just repurposed stuff from the EFF's website:

“Our guide is based on publicly available tools, instructions and best practices. The guidelines in our manual are sourced from the EFF [Electronic Frontier Foundation] and other sources of privacy organizations,” wrote CyberKov CEO Abdullah AlAli to BuzzFeed News in an email. He said his organization had no idea its guide had been repurposed by ISIS. He was surprised to see it cited in articles, many of which have been updated since they were originally posted to note the document’s origin, and “even more shocked to see the Combating Terrorism Center at West Point simply Google-Translated it and claimed it as ISIS’s.”

Now, it does appear that some folks in ISIS may have sent around versions of the guide, but it sort of undermines the idea that they had created their own special set of guidelines to avoid being tracked, when all they're doing is picking up publicly available information on security best practices.

Filed Under: activists, encryption, isis, journalists, privacy, tech manual, tor

France Responds To Paris Attacks By Rushing Through Internet Censorship Law

from the always-good-to-legislating-while-freaking-out,-huh? dept

The attacks in Paris were a horrible and tragic event -- and you can understand why people are angry and scared about it. But, as always, when politicians are angry and scared following a high-profile tragedy, they tend to legislate in dangerous ways. It appears that France is no exception. It has pushed through some kneejerk legislation that includes a plan to censor the internet. Specifically the Minister of the Interior will be given the power to block any website that is deemed to be "promoting terrorism or inciting terrorist acts." Of course, this seems ridiculous on many levels.

First, there are the basic concerns about free speech. Yes, I know this is France and it doesn't value free speech in the same way as the US, but it's still rather distressing just how quickly and easily the French government seems willing to adopt censorship measures. Second, what good does this actually do? If ISIS sympathizers are expressing their views publicly, doesn't that make it easier to track them and to find out what they're doing and saying? Isn't that what law enforcement should want? Focusing on censorship rather than tracking simply drives those conversations and efforts underground where they can still be used to influence people, but where it's much harder for government and law enforcement ot keep track of what's being said. It also only confirms to ISIS supporters that what they're saying must be so important and valuable if the government won't even let them say it. It's difficult to see how it does any good, and instead it opens up the possibility of widespread government censorship and the abuse of such a power.

Filed Under: censorship, france, free speech, internet, isis, paris attacks, terorrism

Dumb Idea... Or The Dumbest Idea? Seize Terrorists' Copyrights And Then Censor Them With The DMCA

from the no-no-no-no-no-no-no-no-no-no-no-no dept

At this point, we all know that the DMCA is a tool that is widely abused for censorship purposes. We have written post upon post upon post upon post upon post upon post upon post upon post upon post upon post upon post upon post upon post upon post upon post upon post detailing this (and those were just from the first page of my search results).

Most people, once aware of this, would recognize that perhaps there's a problem with the DMCA and that it should be fixed. However, some people seem to look at that and say "hey, that's an awesome censorship tool, perhaps we should expand it to other content I don't like." That's why we see people talk about expanding it to cover revenge porn or mean people online.

Or, apparently, terrorism. Yes, terrorism. Paul Rosenzweig, who (believe it or not) really once was a high ranking official in the Department of Homeland Security thinks one way to fight ISIS is to seize their copyrights and then use the DMCA to censor them. He's not joking. Or, at least I think he's not. There's a small chance that it's really a parody, but Rosenzweig has a history of truly nutty ideas behind him, so I'm pretty sure he's serious.

That model might, with a small legislative change, be adapted to the removal of ISIS terrorist speech.  All that would be required was a modification of the law to assign the copyright in all terrorist speech to a non-terrorist organization with an interest in monitoring and removing terrorist content.  Here are the essential components of such a plan:

• Identification of terrorist organizations to whom the law would apply;
• A definition of unprotected content associated with that terrorist organization;
• An extinguishing of copyright in such unprotected content; and
• Transfer of that copyright to a third party.

I love that "all that would be required" because what he's really saying is that "all that would be required" is we upend basically all concepts regarding free speech and copyright just to silence some people I really don't like. No biggie.

At this point, you should probably already be banging your head on a nearby hard surface, but it gets worse. He actually then worries about how much work it would be for the government to take all these copyrights and issue all those darn takedowns, so instead he suggests handing the copyrights to a third party, which he suggests could be set up similarly to the Red Cross (?!?) and saddling them with the task of issuing takedowns. Perhaps we can name them the Silencing Cross or something along those lines.

He insists that the First Amendment isn't really a problem here because terrorist speech can be seen as "material support" of terrorism and the Supreme Court has already wiped that away.

The most salient case on point is Holder v. Humanitarian Law Project, 561  U.S. 1 (2010), a Supreme Court case that construed the USA PATRIOT Act's prohibition on providing “material support” to foreign terrorist organizations (18 U.S.C. § 2339B). The case is one of the very rare instances of First Amendment jurisprudence in which a restriction on political speech has been approved, and the only one of recent vintage.

The Humanitarian Law Project (“HLP”) had sought to provide assistance to the Kurdistan Workers’ Party in Turkey and Sri Lanka's Liberation Tigers of Tamil Eelam.  According to HLP, their goal was to teach these two violent organizations how to peacefully resolve conflicts. Congress had, previously, prohibited all material aid to designated organizations that involved “training”, “expert advice or assistance,” “service,” and “personnel.”  HLP argued that its assistance was protected political speech.  The government countered with the argument that a categorical prohibition on speech in the form of assistance was required because even non-terrorist assistance would "legitimate" the terrorist organization, and free up its resources for terrorist activities.  The Court approved the limitation on speech because it was narrowly drawn to cover only “speech to, under the direction of, or in coordination with foreign groups that the speaker knows to be terrorist organizations” and served a national interest of the highest order – combatting terrorism.

It would follow, in the wake of Humanitarian Law Project, that just as speech “to” or “under the direction of” or “in coordination” with a foreign terrorist organization may be limited, so too may the content actually published “by” the terrorist organization.

I'm not so sure that First Amendment scholars would agree with him that the shift from speech "to" to speech "by" is that simple, but that's really besides the point.

Let's go back to basics here. Congress only has limited power over creating copyright law. Here it is:

To promote the Progress of Science and useful Arts, by securing for limited Times to Authors and Inventors the exclusive Right to their respective Writings and Discoveries.

I've read that a few times now and I really am struggling to find the part that says "and to censor terrorists."

I mean, I guess the single redeeming idea in Rosenzweig's proposal here is that it's a pretty blatant admission that copyright law is about censorship much of the time. The ISIS-insanity-freakout among political types is really kinda crazy to watch in action. First they wanted to use net neutrality to censor ISIS and now they want to use copyright law? What will they think of next? Defamation law is always popular. Perhaps we can amend Section 230 to silence terrorists. Or, I know, why don't we use the ITC. Or trade agreements. Oh wait, that's basically the MPAA's playbook to censor speech... and now surveillance state apologists can make use of it too!

Meanwhile, hey, maybe instead of trying to censor the folks at ISIS, you watch what they're saying and use that for surveillance purposes. I know, I know, crazy thought. But at the very same time we're having this debate, these very same people are arguing that we need less encryption so law enforcement and the intelligence community can see what ISIS is saying. Yet here's a way to see what they're saying and the focus is on "how do we silence such speech and make it harder to track!"

But, really, Paul, congrats -- we thought we'd heard the dumbest idea in a long time with Joe Barton's "use net neutrality to censor ISIS," but you've topped it. This is the dumbest idea we've heard in a long, long time.

Filed Under: censorship, copyright, dmca, first amendment, isis, paul rosenzweig

After Endless Demonization Of Encryption, Police Find Paris Attackers Coordinated Via Unencrypted SMS

from the anonymous-sources-say dept

In the wake of the tragic events in Paris last week encryption has continued to be a useful bogeyman for those with a voracious appetite for surveillance expansion. Like clockwork, numerous reports were quickly circulated suggesting that the terrorists used incredibly sophisticated encryption techniques, despite no evidence by investigators that this was the case. These reports varied in the amount of hallucination involved, the New York Times even having to pull one such report offline. Other claims the attackers had used encrypted Playstation 4 communications also wound up being bunk.

Yet, pushed by their sources in the government, the media quickly became a sound wall of noise suggesting that encryption was hampering the government's ability to stop these kinds of attacks. NBC was particularly breathless this week over the idea that ISIS was now running a 24 hour help desk aimed at helping its less technically proficient members understand encryption (even cults help each other use technology, who knew?). All of the reports had one central, underlying drum beat implication: Edward Snowden and encryption have made us less safe, and if you disagree the blood is on your hands.

Yet, amazingly enough, as actual investigative details emerge, it appears that most of the communications between the attackers was conducted via unencrypted vanilla SMS:

"...News emerging from Paris — as well as evidence from a Belgian ISIS raid in January — suggests that the ISIS terror networks involved were communicating in the clear, and that the data on their smartphones was not encrypted.

European media outlets are reporting that the location of a raid conducted on a suspected safe house Wednesday morning was extracted from a cellphone, apparently belonging to one of the attackers, found in the trash outside the Bataclan concert hall massacre. Le Monde reported that investigators were able to access the data on the phone, including a detailed map of the concert hall and an SMS messaging saying “we’re off; we’re starting.” Police were also able to trace the phone’s movements.

The reports note that Abdelhamid Abaaoud, the "mastermind" of both the Paris attacks and a thwarted Belgium attack ten months ago, failed to use any encryption whatsoever (read: existing capabilities stopped the Belgium attacks and could have stopped the Paris attacks, but didn't). That's of course not to say batshit religious cults like ISIS don't use encryption, and won't do so going forward. Everybody uses encryption. But the point remains that to use a tragedy to vilify encryption, push for surveillance expansion, and pass backdoor laws that will make everybody less safe -- is nearly as gruesome as the attacks themselves.

Filed Under: clear text, encryption, going dark, isis, overreaction, paris attacks, sms, surveillance, terrorism

Rep. Barton Demands The FCC Filter ISIS From The Internet

from the act-first-think-later dept

There's been a universe of responses to the recent tragedy in Paris, and unfortunately the lion's share of them are incomprehensibly stupid, adding a compounded feeling of inevitable dread to the already heart-breaking ordeal. From punishing all Syrian refugees for the attacks to blaming Edward Snowden and encryption, there's once again far more knee-jerk inanity being generated than reasoned commentary. Joining the fray this week was Rep. Joe Barton, who simply can't seem to understand why we can't start filtering this whole "terrorism" part of the Internet.

Barton was speaking this week at yet another House hearing designed primarily to shame the FCC for standing up to ISPs on net neutrality. These show pony hearings have been going on for much of the year now, and their overarching end goal is to strip the agency's authority and funding under the auspices of reform. Ironic then, that Barton took some time out to urge the FCC to start regulating Internet speech:

"They are really trying to use the Internet and all the social media to intimidate and beat us psychologically," Barton said during a House committee hearing Tuesday. "Isn't there something we can do to shut those Internet sites down?"

Well one, we're beating ourselves psychologically by responding to tragedy by being aggressively stupid. Two, as we've noted time and time and time again, Internet filters just don't work. They're easily bypassed by even the most mentally-stunted toddler, and they open the door to atrocious savaging of free speech rights. When they do "work," they generally result in the filtering of legitimate content. Barton seems to realize this in his statements, but plows forward undeterred:

"Barton conceded that censoring the Web sites might be difficult -- "I know they pop up like weeds" -- but plowed ahead with his proposal, suggesting that the Federal Communications Commission attempt to shut down the sites. "They're using the Internet in an extremely offensive and inappropriate way against us," he continued.

But the real problem isn't the fact that when you censor content it pops right back up it's the censoring of content in the first place. You'd think that an elected official would be at least marginally familiar with the First Amendment that says, you know, that the government can't censor speech. And yet here he is directly advocating outright internet censorship.

Again it's important to understand that Barton, who creatively dubs net neutrality "net nonsense," was attending a hearing with the unspoken intent of gutting FCC authority. And, ironically, it was the FCC that had to remind Barton that regulating website and social media is too far outside of its wheelhouse. Still, it's amusing that Barton believes imposing consumer protections to defend free speech is a horrible, unchecked abuse of the FCC's authority, but dramatically expanding FCC power to restrict free speech somehow makes perfect sense.

Filed Under: censorship, fcc, isis, joe barton, net neutrality

Is There Any Evidence In The World That Would Convince Intelligence Community That More Surveillance Isn't The Answer?

from the just-wondering dept

We've already discussed how the usual surveillance state defenders quickly rushed into action following the Paris attacks to demand more surveillance -- and also noted that the two attacks in Paris in the past year happened despite that country expanding its own surveillance laws twice in the past year (once right before the Charlie Hebdo attack and once soon after). And all of that raises a simple question in my mind:

If the intelligence community and its supporters will call for greater surveillance and less encryption even after the surveillance capabilities have been shown not to work at all -- is there any evidence at all that will convince them that maybe this is not the right idea? It's a strange kind of argument that repeatedly points to its own failures... and follows it up with "well, that proves we need more of that!"

Such an argument, by itself, seems self-refuting, because there is no other side. If things are working okay, call for more surveillance. If the surveillance doesn't work, just call for more surveillance. It's the default answer to anything, and thus these calls should be ignored. The fact that the surveillance community wants more power is not news and it's not surprising. It's not because of the Paris attacks -- they're always asking for this and they've mostly gotten it. And it didn't work.

A sober analysis would suggest that perhaps it's time to try something different. But that's not how these things tend to go apparently.

Filed Under: bulk collection, evidence, isis, mass surveillance, nsa, privacy, surveillance, surveillance state

France Already Expanded Surveillance Twice In The Past Year -- Perhaps Expanding It Again Is Not The Answer?

from the maybe-it's-time-to-think-a-little-differently? dept

I've been having this discussion on Twitter and a few other places over the past few days, so it seemed only right to put it into a blog post. For all the ridiculous talk with politicians grandstanding and using the attacks in Paris last week as an excuse to expand surveillance powers, it seems worth noting that France actually expanded its surveillance state powers twice in the last year -- and the first time it didn't stop the Charlie Hebdo attacks, and the second time obviously failed to stop the attacks last week. Already, before all of this, French intelligence had powers that were so similar to the NSA's that it was obvious that there had been some coordination. Then, late last year (actually on Christmas Eve), France quietly enacted a new surveillance law relating to data retention and requiring internet companies to cough up info on users.

That went into effect just shortly before the Charlie Hebdo attacks. And, of course, with that new law failing to prevent those attacks, the French government did the kneejerk thing and expanded its surveillance powers even more, claiming it needed to do so to protect against the next attack. That law, which allowed authorities to monitor communications of suspected terrorrists without a judge's approval, went into effect in July, with supporters, including Prime Minister Manuel Valls declaring: "France now has a secure framework against terrorism." Yeah, how did that work out?

Maybe, instead of calling for greater and greater surveillance, we should take a step back and think if there isn't a better approach that doesn't involve continually tossing civil liberties in the trash, for no clear benefit.

Filed Under: france, isis, kneejerk reactions, paris attacks, privacy, reactions, surveillance