Many Digital Divide 'Solutions' Make Privacy And Trust A Luxury Option

from the First-do-no-harm dept

We've noted a few times how privacy is slowly but surely becoming a luxury good. Take low-cost cellular phones, for example. They may now be available for dirt cheap, but the devices are among the very first to treat consumer privacy and security as effectively unworthy of consideration at that price point. So at the same time we're patting ourselves on the back for "bridging the digital divide," we're creating a new paradigm whereby privacy and security are something placed out of reach for those who can't afford it.

A similar scenario is playing out on the borrowed school laptop front. Lower income students who need to borrow a school laptop to do their homework routinely find that bargain comes with some monumental trade offs; namely zero expectation of privacy. Many of the laptops being used by lower-income students come with Securly, student-monitoring software that lets teachers see a student’s laptop screen in real time and even close tabs if they discover a student is "off-task."

But again, it creates a dichotomy between students with the money for a laptop (innately trusted) and lower income students who are inherently tracked and surveilled:

"Hootman says she and other parents wouldn’t have chosen school-issued devices if they knew the extent of the monitoring. (“I’m lucky that’s an option for us,” she says.) She also worried that when monitoring software automatically closes tabs or otherwise penalizes multitasking, it makes it harder for students to cultivate their own ability to focus and build discipline."

Teachers and school administrators may be well intentioned, but they're not thinking particularly large picture. But the creation of this bifurcated treatment of privacy wasn't lost on the Center for Democracy and Technology, which issued a report last month that found, unsurprisingly, wealthier kids that can afford their own devices are subject to less surveillance and are inherently trusted more overall. Sometimes just by nature of the laptop surveillance systems, but also thanks to school district concerns about liability:

"LEAs (local education agencies) with wealthier student populations reported that their students are more likely to have access to personal devices, which are subject to less monitoring than school-issued devices...LEAs feel compelled to monitor student activity to satisfy perceived legal requirements and protect student safety."

So in trying to "help" kids, by not thinking broadly enough you're teaching them that they're inherently inferior and less deserving of overall trust. Combine that with the overarching problem that less expensive computer and phone hardware is often inherently less private and secure, and it's not particularly hard to see how efforts to "bridge the digital divide" could make some aspects of it worse if they're not particularly well thought out.

Filed Under: digital divide, luxury, privacy, school laptops, schools, security, students, surveillance, tracking

The Surveillance And Privacy Concerns Of The Infrastructure Bill's Impaired Driving Sensors

from the good-intentions... dept

There is no doubt that many folks trying to come up with ways to reduce impaired driving and making the roads safer have the best of intentions. And yet, hidden within those intentions can linger some pretty dangerous consequences. For reasons that are not entirely clear to me, the giant infrastructure bill (that will apparently be negotiated forever) includes a mandate that automakers would eventually need to build in technology that monitors whether or not drivers are impaired. It's buried deep in the bill (see page 1066), but the key bit is:

to ensure the prevention of alcohol-impaired driving fatalities, advanced drunk and impaired driving prevention technology must be standard equipment in all new passenger motor vehicles

The details note that the new technology should "passively monitor the performance of a driver of a motor vehicle to accurately identify whether that driver may be impaired." This isn't the kind of keylock breathalyzer test things that some people have been required to install to operate a car. This is "passive" monitoring. That means sensors and cameras. And, as Julian Sanchez highlights, that raises a ton of surveillance and privacy concerns:

This amounts to mandating a sophisticated set of sensors be installed in a space where many Americans spend huge amounts of time. (And not just commuting—many people live in vehicles, whether out of choice or necessity, at least part of the time.) A narrowly-tailored sensor that only detects blood alcohol content, if designed to immediately discard any readings below the legal threshold, might not sound worryingly invasive. But the mandate extends to monitoring for other forms of "impairment," which can require more intrusive types of sensors. One such system being developed by Nissan includes a "camera atop the instrument cluster" which "looks for facial cues signaling the driver is inebriated" while "the vehicle itself looks for driving patterns suggesting an impaired driver." In other words, one form this mandatory technology is likely to take involves pre-installed video surveillance with facial recognition capabilities. (Law enforcement, no doubt, will eagerly think of many other applications for a ubiquitous system of cameras installed in private spaces—cameras which, by design, the vehicle owner will necessarily be unable to deactivate.)

It's possible that there are versions of anti–impaired driving technology that could address these practical and privacy concerns. But that only underscores how little sense it makes for Congress to delegate authority for a regulatory mandate at a point when the technology being mandated remains largely hypothetical. Even in the absence of a mandate, there's likely to be some market for these technologies: Some drivers would embrace as a safety feature a system that warns them if they've imbibed more than they realize, or are starting to swerve on the road. They'd doubtless also be popular in contexts where the owner of a vehicle is entrusting it to another driver: Rental cars, corporate cars, commercial cab or trucking fleets. This is not, in other words, technology that will go undeveloped and untested unless it is made universally mandatory.

That makes it seem wildly premature to empower an executive branch official to mandate what is, essentially, surveillance technology in all automobiles when the precise form of the technology remains uncertain, and it's impossible to concretely debate the merits of specific systems. This sort of delegation lets legislators take credit for Doing Something to promote automotive safety and reduce the unacceptable annual death toll that results from drunk and impaired driving, without having to defend or be held accountable for any of the details of what Something entails. The bill doesn't, after all, say "we're requiring a camera that you can't shut off be installed in everyone's automobile"—that's just one possible way to "passively monitor the performance of a driver." They can reap the accolades now, and insist "that's not what we intended" if the result is a mandatory surveillance network, or cars that stop working because you've used too much hand sanitizer or a pinhole aperture in the dash got blocked.

But, let's take this even further. Sanchez notes in a parenthetical aside that law enforcement will come up with "many other applications" of this technology, but that deserves to be called out, because knowing what we know about how law enforcement embraces and "extends" every bit of surveillance technology they can get their hands on, this isn't some pie in the sky hypothetical. We all know exactly how this will play out.

Police are going to demand access to the facial recognition and other data collected by these systems, and they'll claim they need to have access to it for "public safety" reasons. Others are also likely to seek access to it as well. It's going to be an insurance goldmine.

And that's leaving aside the question of whether or not the technology will even work. The "passive" nature of it raises questions about how the system will know whether it's the driver or passengers who may be impaired. The potential to use facial recognition may raise questions about people who have facial tics or other features that the system might deem to be a sign of impairment. And, as Sanchez also notes, there's simply no clear reason why this technology needs to be government mandated and standard in every new vehicle.

Yes, preventing impaired driving is a worthy goal. But it shouldn't come at the cost of installing massive new surveillance infrastructure in every new car.

Filed Under: driving, drunk driving, facial recognition, impaired driving, infrastructure, law enforcement, privacy, sensors, surveillance

Clearview Celebrates 10 Billion Scraped Images Collected, Claims It Can Now Recognize Blurred, Masked Faces

from the getting-bigger-and-getting-worse dept

Clearview's not going to let several months of bad press derail its plans to generate even more negative press. The facial recognition tech company that relies on billions of scraped images from the web to create its product is currently being sued in multiple states, has had its claims about investigative effectiveness repeatedly debunked and, most recently, served (then rescinded) a subpoena to transparency advocacy group Open the Government demanding information on all its Clearview-related FOIA requests as well as its communications with journalists.

I don't know what Clearview is doing now. Maybe it thinks it can still win hearts and minds by not only continuing to exist but also by getting progressively worse in terms of integrity and corporate responsibility. Whatever it is that Clearview's doing to salvage its reputation looks to be, at best, counterproductive. I mean, the only way Clearview could get worse is by getting bigger, which is exactly what it's done, according to this report by Will Knight for Wired.

The company’s cofounder and CEO, Hoan Ton-That, tells WIRED that Clearview has now collected more than 10 billion images from across the web—more than three times as many as has been previously reported.

Ton-That says the larger pool of photos means users, most often law enforcement, are more likely to find a match when searching for someone. He also claims the larger data set makes the company’s tool more accurate.

That's one way of looking at it. Another way of looking at it -- and by "it," I mean Clearview's unaudited, untested facial recognition AI -- is that adding more hay increases the odds of someone grabbing some hay and thinking it's actually a needle.

Yet another way of looking at this is that Clearview's mass scraping of every bit of publicly accessible web data it can may be legal, but it certainly isn't morally acceptable. While people do largely understand that their public posts to sites can be accessed by nearly anyone, they certainly don't expect someone to collect their photos and data in bulk, package it up, and sell it to government agencies. And, in some states, this sort of activity may actually be illegal, hence the lawsuits being brought by government officials.

On top of the 10 billion images Clearview swears it will only sell to responsible adult government employees, the company is now claiming it can do some real CSI-type stuff with its tech.

Ton-That says it is developing new ways for police to find a person, including “deblur” and “mask removal” tools. The first takes a blurred image and sharpens it using machine learning to envision what a clearer picture would look like; the second tries to envision the covered part of a person’s face using machine learning models that fill in missing details of an image using a best guess based on statistical patterns found in other images.

If you feel selling government agencies a more efficient way to generate false positives and false negatives is the way to future profitability, this would be the route to take. Without a doubt, tech advances will eventually make this more accurate, but rolling out unproven machine learning on top of unproven AI is only going to compound errors. Then there's the bias problem, which has been a problem for all facial recognition software. That includes those that have been independently tested and examined by the National Institute of Standards and Technology (NIST). Notably, Clearview has yet to subject its AI to outside testing.

Finally, there's this statement from Clearview CEO Ton-That:

The company says it is not currently pitching the technology outside of the US or to private industry. “We're focusing on the United States, because we want to get it right here,” Ton-That says. “We never want this to be abused in any way.”

Whether or not this statement about its current potential customer list is true remains to be seen. Clearview has already pitched its product to private companies and foreign governments. And it appears to have exited one foreign market solely because its product was declared illegal following a government investigation.

And claiming that the company does not want its product "abused in any way" directly contradicts the stuff it says to entities it wants to sell its product to. Emails from the company's marketing staff encouraged potential law enforcement customers (as well as the occasional billionaire) to "experiment" with the software by running searches on friends, family members, and others who never consented to be part of multiple Clearview test drives.

Is Clearview the worst AI product out there? In terms of accuracy, who knows? It hasn't been independently reviewed. In terms of everything else, there's really nothing out there that competes with it. The company's nonchalant conversion of the open web into a surveillance tool sets it apart from the competition. Its latest "advances" aren't going to do anything to rehabilitate its reputation.

Filed Under: facial recognition, surveillance
Companies: clearview

Google, Amazon, And Microsoft Are Using Third Party Companies To Sell Surveillance Tech To ICE, CBP

from the same-as-it-ever-was dept

A few years ago, tech companies stood up to the US government, issuing statements objecting to immigration policies instituted by the Trump Administration and, in some cases, threatening to pull contracts with ICE (Immigration and Customs Enforcement) and the CBP (Customs and Border Protection).

It wasn't much of a stand, however. And whatever statements were issued by companies like Google, Microsoft, and Amazon were mainly prompted by hundreds of employees who wished to work for companies that didn't aid and abet in civil liberties violations, and ongoing mistreatment of immigrants and their families.

Whatever statements came out of the front end of these companies haven't been matched by the backend. According to a new report by Caroline Haskins for Business Insider, Google, Microsoft, and Amazon are still selling plenty of tech and software to ICE and CBP. They're just getting better at hiding it. (Alt link)

Amazon, Google, and Microsoft have repeatedly used a common tactic to sidestep public scrutiny and work with US immigration agencies, despite employee backlash and some company policies against doing such work.

This tactic, in which the companies use third parties or act as subcontractors to sell their technology, has helped these tech giants quietly secure dozens of cloud contracts with Immigration and Customs Enforcement and Customs and Border Protection, Insider has found.

The products provided range from innocuous bundling of office software to analytics and APIs that are integral parts of surveillance systems. The use of third party resellers keeps these companies' names from appearing in federal contracts, as well as allows them to sidestep internal protests and internal policies. Google, for instance, assured irate employees it would not assist the federal government with border surveillance. But use of third party contractors allows it to bypass the promises it made.

So much for taking a stand:

From 2015 to 2021, Amazon used third parties to sell its cloud services at least 16 times to ICE and CBP. Google used third parties to sell various cloud and professional tools at least 28 times to these agencies. Microsoft used third parties to sell its cloud services and software more than 200 times to immigration agencies from 2002 to 2021, in addition to selling to ICE and CBP directly more than 100 times.

Having briefly implied the status quo of selling to ICE and CBP was unacceptable, these companies quietly maintained the status quo by selling products via companies with far less-recognizable names like Panamerica Computers, Inc., Four Points Technology, LLC, and Systems Engineering Solutions.

And, while this reselling may not have been happening directly under these companies' noses, it's unlikely they were completely unaware the middlemen were securing contracts with these agencies to do the sorts of things company officials claimed they would no longer do. At best, there was an indifferent blindness. Contracts were signed with these companies and paper trails should have alerted them that their third-party partners were delivering tech to federal agencies. Employees spoken to by Haskins confirmed it's all but impossible to remain unaware of what third party partners are doing with tech and software because of this.

These companies haven't denied their indirect involvement in CBP and ICE border surveillance activities. But they also haven't denied any knowledge of this use of their products. "No comment" across the board.

The surveillance business is still booming, and ICE wants more of it. It has $300 million to spend on a new system it calls RAVEn (Repository for Analytics in a Virtualized Environment) -- one that will allow it to mine hundreds of thousands of documents for data in order to find people who aren't authorized to work in the United States. All three companies are likely to get a piece of that $300 million, at least indirectly.

People who attended the April industry-day event told Insider that companies like Amazon, Google, and Microsoft would probably use intermediaries rather than bid on the contracts directly.

Google "typically will not pursue as a prime on non-cloud opportunities because of the potential conflicts of interest with ALL the other companies they work with," a person who attended the industry day told Insider. "Google will only sub and they will be non-exclusive."

"AWS, MSFT and Google typically sell through their reseller partners," another person who attended the industry day told Insider.

Showing solidarity with employees doesn't mean much if you're willing to let intermediaries do the dirty work for you. The end result is identical. The only difference is it keeps Amazon's, Google's, and Microsoft's names out of the news whenever a new form of pervasive surveillance starts making the wrong kind of headlines.

Filed Under: cbp, ice, shell companies, surveillance
Companies: amazon, google, microsoft

Belgian Government Wants To Add Encryption Backdoors To Its Already-Terrible Data Retention Law

from the it-can-always-get-worse dept

Earlier this year, a data retention law passed by the Belgian government was overturned by the country's Constitutional Court. The law mandated retention of metadata on all calls and texts by residents for one year, just in case the government ever decided it wanted access to it. Acting on guidance from the EU Court on laws mandating indiscriminate data retention elsewhere in the Union, the Constitutional Court struck the law down, finding it was neither justified nor legal under CJEU precedent or under Belgium's own Constitution.

[T]he Constitutional Court finds that the Data Retention Act aims at broader objectives than safeguarding national security, combating serious crime and preventing serious threats to public security and that the interference is thus not limited to what is strictly necessary. In addition, the Constitutional Court points out that such requirement to retain traffic and location data should be the exception, not the rule, must set out clear and precise rules regarding the scope and application of such measure, whereby certain minimum requirements should be implemented, and should ensure that the interference is limited to what is strictly necessary.

That prompted an immediate rewrite and a hasty propulsion of the law through the legislative process. This ruling was handed down in April. By May 10th, the government had another legislative proposal ready to go. Then it expanded it, adding encrypted messaging services to the list of entities obliged to collect and retain communications metadata.

But the demands go even further than metadata. Either incapable or unwilling to understand how end-to-end encryption works, legislators want a form of encryption that can be stripped away whenever the government wants access to communications. This is from an open letter sent to the Belgian government by 81 organizations and cybersecurity experts.

The Draft law on the collection and storage of identification, traffic and location data in the electronic communications sector and their access by the authorities, or “the Data Retention Legislation,” would require operators of encrypted systems to enable law enforcement to be able to access on request content produced by specific users after a specified date in the future. That is, they would have to be able to “turn off” encryption for specific users.

If you can't see where this is going, you might be a Belgian legislator.

There is no way to simply “turn off” encryption; providers would need to create a new delivery system and send targeted users into that separate delivery system. Not only would this require significant technical changes, but it would thereby break the promises of confidentiality and privacy of end-to-end encrypted communications services.

It's a backdoor. Backdoors don't work. Or rather, they do, but then the encryption doesn't work. Legislators and those pressuring legislators to mandate encryption backdoors don't like to use that term, so they dance around it. In the US, they call it technical assistance or whatever the opposite of "warrant-proof encryption" is. In Belgium, they stuff it into a bill that originally targeted phone service providers and call it "data retention."

It's unclear how the legislature thinks this version will be found constitutional by the courts, unless it's relying on the addition of some minimal targeting requirements to change it from a bulk data collection the government can access at any time to a slightly smaller bulk data collection the government can access at any time -- one that now includes metadata collected by encrypted communications platforms which will have to backdoor their own encryption to comply with demands for data.

If this is allowed to become law, everyone's communications will be less secure, not just those belonging to people the state wants to surveil or lock up.

Undermining encryption by introducing backdoors to encrypted communications would leave Belgium exposed to attacks, including its journalists, doctors, lawyers, public sector employees, and other citizens, as well as businesses and institutions, including governments.

If that's an acceptable tradeoff for the government, the bill will become law. But it will have to survive another legal challenge once it goes live. And from what's seen here, it looks like more of the stuff that was already struck down by the court, only with bonus encryption backdoors. If Belgian legislators aren't willing to protect their constituents, hopefully the courts will pick up the slack.

Filed Under: backdoors, belgium, data retention, encryption, surveillance

Investigation: CBP Targeted Journalists, Illegally Shared Info With Mexico, And Attempted To Cover It All Up

from the bad-apples-floating-to-the-top-of-the-barrel dept

A couple of years ago, documents surfaced that showed the CBP was placing journalists, activists, and immigration lawyers on some form of a watchlist, which would allow agents and officers to subject these targets to additional scrutiny when they crossed the border. There were obvious civil liberties implications, ones the CBP seemed largely unconcerned about.

The targeting appeared to be related to the "migrant caravan" that reached the border late in 2018 and performed a mass "incursion" on January 1, 2019. The CBP claimed it had only targeted those people because they had been involved in "violence" near the border late in 2018. It refused to explain what it meant by the word "involved" or how that was enough to ignore First Amendment protections. Nor did it explain why it was deliberately targeting US citizens not suspected to have been involved in any criminal activity. It also did not explain why it shared information on these targets with the government of Mexico, which then assisted in spying on this group of lawyers, journalists, and activists.

The DHS Inspector General opened an investigation [PDF] of these actions. And it has arrived at the conclusion that this all looks pretty bad, but wasn't actually illegal. Read into that what you will.

We did not find that CBP placed lookouts to retaliate against U.S. citizens for performing lawful work related to the migrant caravan. To the contrary, witnesses told us, and contemporaneous emails and documents corroborated, CBP placed lookouts to gain information about suspected illegal activity and then generally sought information consistent with that purpose during the resulting interviews. Although we determined CBP’s lookouts on a number of journalists present at an illegal border crossing were unnecessary, we found no evidence that CBP placed these lookouts to harass the journalists.

But that lead paragraph is misleading. The only thing that still works in context of the rest of the report is "found no evidence."

What this report details is stuff that looks like targeted harassment of individuals -- some of them journalists -- by CBP personnel. And yet, the IG is unwilling -- despite apparent lies from interviewed personnel and deliberate destruction of communications -- to call this what it is: a violation of people's rights for reasons the CBP is unwilling to discuss and actively worked to cover up.

It appears one person was more involved in targeting journalists than anyone else during this time period. This person has also been cleared of wrongdoing by this investigation.

Although we found no evidence in emails or interviews that the EOC [Emergency Operations Center] official who placed these lookouts (EOC Official 1) did so to harass the journalists or for any other ulterior reasons, his subsequent actions, or lack thereof, demonstrate he did not need to place the lookouts.

However, it's hard to believe this official did not order up these lookouts to "harass" journalists or "for any other ulterior reason." There was a stated purpose for these lookouts but this official never bothered to check back in after nominating the targeted journalists for additional harassment by CBP officers.

In one incident, Mexican police identified five American journalists after CBP officials alerted them that CBP officials observed members of the media helping migrants climb a border fence. EOC Official 1 then placed lookouts on the five journalists. The lookouts did not mention the illegal crossing but instructed interviewing officers where to find information about the journalists.

Although EOC Official 1 told us the purpose of these lookouts was to determine whether the journalists had information about the incident, his actions show he actually had no interest in that information. Over the following weeks, all five journalists came back to the United States, and CBP referred them to secondary inspection. Interview records reflect that none of the five journalists were asked about the illegal crossing. In fact, the journalists returned to the United States at various places and times and were therefore interviewed by several different officers. None of the officers asked about the illegal crossing.

It really, really looks like this official just thought it would be fun to subject journalists to secondary screenings.

EOC Official 1 placed more caravan-related lookouts than anyone else and was in regular contact with the TTRT throughout Operation Secure Line. If he wanted to know whether the journalists had information about this incident or other illegal border crossings, he knew how to contact the TTRT. Additionally, EOC Official 1 removed one of the lookouts after the journalist’s third interview, even though according to the interview record, CBP never asked the journalist about the illegal border crossing. If EOC Official 1 no longer needed information about the illegal border crossing at that point, then he also did not need the information when he placed the lookout 9 days earlier.

That wasn't the only case of inappropriate or unjustified targeting. There were more cases, something the system used by the CBP (TECS) appears to allow even though the policy and CBP statements claim that it doesn't.

CBP may place lookouts “only if illegal activity is suspected. The system will not allow a user to indicate that a ‘non-suspect’ is on ‘lookout.’” This last sentence has two possible interpretations. It could mean officials may place lookouts only on people who are suspects of illegal activity, and not on non-suspects; or it could be a description of how the TECS system works.

The footnote to this paragraph makes it clear this is not how the TECS system works:

While the TECS Directive says CBP may place lookouts only when illegal activity is suspected, it allows CBP to create “TECS records” or “TECS subject records” even when there is no suspicion of illegal activity.

This means a lot of lookouts had no direct connection to suspected criminal activity.

Nearly half of the caravan-related lookouts (25 out of 51) were on people for whom there was no evidence of direct involvement in illegal activity. Instead, those lookouts were based solely on the individuals’ associations with other people who were suspected of illegal activity.

Some links were stronger than others. Some "associations," however, were nearly nonexistent.

In one instance, a CBP official placed lookouts on two attorneys who previously crossed the border with someone who was believed to be an administrator of a caravan-related online chat group on WhatsApp. In another example, after a suspected migrant caravan organizer was seen riding in a vehicle, the EOC placed lookouts not only on the owner of that vehicle but also on someone who crossed the border with the vehicle owner one time, 9 months earlier, well before the migrant caravan started traveling towards the United States.

Almost anything can trigger a lookout. And one official (EOC Official 1) was more trigger-happy than most. This official -- who nominated the most journalists -- also refused to remove people from the lookout list when it became obvious they weren't connected to criminal activity and did not need to be subjected to additional screening when crossing borders. What this person did do, apparently, was lie to IG investigators.

EOC Official 1, who was primarily responsible for placing caravan-related lookouts at the EOC, also told us that many U.S. citizens did not need to be interviewed multiple times. Accordingly, EOC Official 1 claimed he went into TECS and removed caravan-related lookouts after individuals were interviewed, but review of TECS data revealed that EOC Official 1 did not remove any of his lookouts on U.S. citizens following their first border crossings. When presented with this information, he maintained that he tried to remove many lookouts and speculated that a technical glitch may have prevented that from happening, but we confirmed that no such glitch occurred. Instead, the evidence demonstrates that EOC Official 1 did not try to remove 18 of his 20 lookouts that resulted in secondary inspections.

Basically, this one official -- who the IG says did not target journalists for "improper" reasons -- targeted a bunch of journalists until it became too much of an embarrassment to ignore.

In fact, EOC Official 1 did not reevaluate or remove his lookouts when he finished his EOC detail at the end of January 2019. Instead, he and his supervisor transferred at least 31 caravan-related lookouts to other EOC personnel without giving any notice or instruction. One official who inherited several of those lookouts stated he did not even learn he was assigned to those lookouts until CBP officers contacted him as they were about to interview the individuals. He recalled that one of the first times this happened, he reached out to EOC Official 1, who originally placed the lookout. EOC Official 1 told him the lookout was no longer necessary, even though he had transferred it to him just days earlier. Still, after this discovery, the EOC did not systematically review the remaining lookouts. Instead, the lookouts remained in place for 2 more weeks, until a media story calling attention to the lookouts spurred the EOC to review and remove 18 caravan-related lookouts it determined were no longer necessary.

In the end, there's no complete absolution for this official. But neither is there any recommendation to discipline this person for using the lookout process as a form of harassment, something the IG report asks readers to infer from paragraphs like these:

Based on our review of all available evidence, we were unable to determine why CBP did not remove unnecessary caravan-related lookouts. We found no direct evidence that CBP kept lookouts active to harass, intimidate, or retaliate against caravan associates. However, EOC Official 1’s vague explanation for not removing lookouts, and the EOC’s disinterest in the repeat interviews, suggest it may not have been entirely accidental. Regardless of whether the EOC intended to punish or dissuade U.S. citizens from traveling between Mexico and the United States, subjecting them to repeated unnecessary inspections can have that effect, as the individual who was referred to secondary inspection four times explained.

Outside of this particularly problematic official, there were other signs the CBP used the lookout list as a way to make things difficult for people officers didn't like.

We found that, in December 2018, a CBP official asked Mexico to deny entry to 14 U.S. citizens affiliated with the migrant caravan, including one individual who was subsequently denied entry into Mexico. CBP may restrict Americans’ rights to travel internationally in certain circumstances, but CBP could not articulate any genuine basis for sending this request and in fact later admitted that the reasons provided to Mexico were not true.

And if the IG didn't find any communications indicating these nominations were done for improper reasons, it's probably because any communications pertaining to possibly illegal targeting were never memorialized, so to speak.

We found that on eight other occasions, CBP officials improperly sent Mexico the names and sensitive information of dozens of additional U.S. citizens, and some of those individuals were later denied entry into Mexico. However, because these CBP officials did not comply with CBP policies on sharing information with foreign entities and did not retain communication records, we cannot determine whether the officials asked Mexico to deny entry to those Americans.

It's harassment.

FOB Official 1 could not offer any reasons to us for asking Mexico to deny entry to the 24 individuals listed in his email. He could not recall anything about most of the 24 individuals, other than he did not think they were involved in illegal activity. In fact, FOB Official 1 initially denied that he ever asked Mexico to reject any individuals and insisted he did not remember this email until we showed it to him. FOB Official 1’s concerns about the 24 individuals could not have been particularly serious, because when we interviewed him, he could not recall what the concerns were or why they prompted him to ask Mexico to deny entry to those individuals, even though he said this was the first and only time he ever sent such a request.

And it was covered up.

Also, in January 2019 another FOB official (FOB Official 3) used his official CBP email account to send unencrypted SPII of six U.S. citizens to a Mexican intelligence official’s Yahoo email address. FOB Official 3 told us he sent the email so the Mexican official could provide information to help prevent a “very serious” threat from occurring. Yet, FOB Official 3’s email does not request any information from the Mexican official, and instead of mentioning a future threat, the email says the six individuals may have been involved in a past event. We were unable to clarify this inconsistency or determine the true reason FOB Official 3 sent this email, because he admitted deleting contemporaneous WhatsApp messages with this Mexican official.

More on the coverup, including the use of WhatsApp as a tool for opacity.

The CBP officials’ inability to recall key details about their communications with Mexican officials, or in some cases, whether they even shared information about U.S. citizens with Mexican officials, raises questions about whether there were other instances of Mexican and CBP officials’ sharing information about American caravan associates. Complete WhatsApp records would have shown whether CBP officials shared U.S. citizens’ SPII with Mexico on other occasions.

The fact that none of these officials retained their WhatsApp messages, and the various ways in which that happened, highlights the challenges of satisfactorily upholding recordkeeping responsibilities when CBP employees use WhatsApp. This is particularly troubling given the widespread use of WhatsApp during Operation Secure Line. Numerous CBP officials, across various offices, regularly used WhatsApp to communicate both with individuals and in various WhatsApp groups, some of which contained up to hundreds of U.S. and Mexican officials. Yet, these officials did not consistently retain their WhatsApp messages or copy or forward them to their official CBP accounts.

At the end of all of this, there are recommendations to clarify policy and better document lookout nominations and interviews. Nowhere in the report are there recommendations to punish anyone involved in this or forbid the use of self-destructing communications to preemptively erase evidence of misconduct or rights violations. So, unless the CBP is willing to step up and discipline those involved in this targeting, it will happen again and again and again. And since we can count on the CBP to take a hands-off approach to internal oversight, we can expect history to repeat itself.

Filed Under: 1st amendment, activists, cbp, immigration, journalists, lawyers, retaliation, surveillance, watchlist

Clearview Suffers Brief Bout Of Better Judgment, Drops Subpoena Demanding Activists' Communications With Journalists

from the keep-on-sucking dept

Just a few days ago, Clearview -- the company that scrapes the web to build a facial recognition database it sells to law enforcement, government agencies around the world, and a number of private parties -- decided to make itself even less likable.

It decided to subpoena transparency activists Open The Government, demanding copies of all FOIA requests it had made requesting info about Clearview. It also, more disturbingly, demanded copies of OTG's communications with journalists, clearly indicating it felt First Amendment protections were something it should enjoy, but shouldn't be extended to its critics.

It really wasn't a step Clearview needed to take… for several reasons. First of all, Clearview's reputation is pure dog shit at the moment. It's unlikely to improve unless the company pulls the plug on its product and disbands. A move like this only earns it more (deserved) disdain and hatred. What it's not going to do -- even if successful -- is deter future criticism of the business and its scraped-together facial recognition product.

Second, OTG was not a party to the lawsuit. Clearview has no right to demand these documents from a non-party, especially communications between it and journalists… journalists who are also not a party to the lawsuit Clearview is facing.

Third, if Clearview wanted copies of OTG's FOIA requests, all it had to do is visit OTG's MuckRock page and download all of its publicly accessible requests and responses.

There's some good news, though. Shortly after having shot itself in the face, Clearview had second thoughts about the self-inflicted wound it had just sustained. Here's Alexandra Levine for Politico.

Facial recognition company Clearview AI is dropping the subpoenas it served recently to some of the groups that first exposed its work with law enforcement — legal demands that sought the organizations’ correspondence with journalists and other records.

The best move would have been to never issue the subpoenas at all, especially given the First Amendment implications of attempting to pry loose communications between activists and journalists. This withdrawal is a distant second on the list of "Smart Things to Do."

And here's the rationale for the decision, straight from the mouth of Clearview's founder:

Clearview CEO Hoan Ton-That told POLITICO that “on further reflection about the scope of the subpoenas, and my strong view of freedom of the press, we have decided to withdraw the subpoenas served on Open the Government and its associates.”

I imagine that "reflection" showed a badly maimed face mouthing the word "why" after taking the full impact of an unforced error. This should have been the first response to the suggestion of subpoenaing non-parties and demanding copies of their conversations with journalists. It should have been offered by Clearview's legal team. And if those bright minds failed to comprehend the collateral damage this move would inflict on the First Amendment (not to mention the fact that Clearview would be sitting at ground zero when its own bomb went off), the genius who came up with the idea of treating millions of internet users as fodder for unproven facial recognition tech should have been able to see doing this was a terrible idea.

Then again, it may just be impossible for Clearview and its principals (note the spelling -- "principles" are different and not possessed by Clearview) to get a firm grasp on the obvious if it can't easily be scraped from content created by people with far more common sense than its founder and legal reps.

Filed Under: activism, facial recognition, foia, intimidation, journalism, subpoena, surveillance, transparency
Companies: clearview, open the government

Appeals Court Says State Secrets Privilege Means NSA Can Avoid Wikimedia Foundation's Unlawful Surveillance Allegations

from the create-enough-state-secrets-and-you-can-get-away-with-anything dept

The Snowden leaks exposing NSA dragnet surveillance prompted a lot of litigation. Cast a wide enough net and you're bound to snag it on some people's rights. The Wikimedia Foundation was one of several parties who sued over the NSA's seemingly unconstitutional collection efforts, targeting the agency's "upstream" harvesting of all data and communications straight from internet backbones.

To keep the case in court, Wikimedia had to plausibly allege its data and communications had been scooped up by the NSA. Fortunately, Ed Snowden had provided some pretty solid evidence for the Foundation. A leaked NSA presentation showed Wikipedia was included in the agency's HTTP dragnet:

Well, that leaked presentation, which included the Wikipedia logo as part of the traffic the NSA could snag from internet backbones wasn't enough to impress the district court, which dismissed the lawsuit. It was revived by the appeals court a couple of years later, which said it had alleged enough plausible harm and possible targeting to pursue its First and Fourth Amendment claims.

It went back down to the lower court, which did the same thing it did the first time around. The suit was again dismissed, this time because the district court felt the Foundation didn't bring enough factual allegations to the table. But then, how could it? The NSA basically said facts could not be introduced or argued.

On remand, the district court ordered jurisdictional discovery. But when Wikimedia sought evidence related to Upstream, the NSA invoked the state secrets privilege.

That's from the Fourth Circuit's second pass [PDF] at the Wikimedia lawsuit. This time around the Appeals Court says it disagrees the lawsuit should have been dismissed for lack of standing, but that determination makes no difference when the government says the subject matter is too sensitive to be sued over.

After a discussion of what may or may not be inferred from the limited amount of information disclosed or discussed publicly about this NSA collection, the Appeals Court says no one will be discussing it any further, at least not in this Circuit.

Wikimedia argued the government can't use the state secret privilege to evade its obligations to hand over information about dragnet surveillance, citing FISA and appellate precedent.

Relying heavily on Fazaga, Wikimedia claims that the third condition unambiguously encompasses the circumstances at hand: Wikimedia is an aggrieved person that made a motion before the district court under Federal Rule of Civil Procedure 37(a) to compel discovery of “materials relating to electronic surveillance.” Id. at § 1806(f). Wikimedia thus reads § 1806(f) as a free-floating right to obtain information related to the government’s electronic surveillance pursuant to any (and all) federal statutes or rules.

The Fourth Circuit says Wikimedia's interpretation is wrong.

Reading the third condition in context reveals that Wikimedia’s gloss makes for a shiny but ill-fitting shoe. Both parties agree that § 1806(f) may apply regardless of who initiated the suit. But we agree with the government that § 1806(f) describes procedures for determining the admissibility of electronic surveillance information only when the government seeks to use such evidence in a particular proceeding—whether civil or criminal. Thus, even assuming that Wikimedia is an aggrieved person, we conclude that it can’t use § 1806(f) to force the government to introduce electronic surveillance information into this case,

Even if the court were to agree with Wikimedia's interpretation, it wouldn't change anything. Determining that the NSA engaged in unlawful surveillance of Wikimedia would only require suppression of evidence collected unlawfully. That's not what Wikimedia is seeking here. It's asking the court to review evidence of NSA collection activities to determine whether or not Wikimedia can continue its lawsuit over alleged unlawful surveillance.

This may be a Congressional problem, albeit one created in an attempt to solve a problem, the Court points out:

Congress provided for judicial review of executive branch surveillance, but it did so to “strike[] a fair and just balance between protection of national security and protection of personal liberties.” The government’s reading of § 1806(f) fits that schema exactly. In that provision, Congress permits the government to use electronic surveillance evidence in court against a litigant while withholding materials related to that surveillance from that individual in the interests of national security. But in the same breath, Congress also allows an aggrieved person to challenge the government’s use of such evidence and have a court evaluate the lawfulness of the government’s actions.

Far from giving the government exclusive control over challenges to surveillance, we think this reading of § 1806(f) acknowledges the court’s role in preserving the compromise Congress made between individual rights and national security.

But the compromise requires more from plaintiffs like Wikimedia, the court continues. And it goes farther than shutting down legal challenges of FISA-approved surveillance. Sometimes, the government just gets to win.

[T]his problem isn’t unique to FISA. Every state secrets case presents the possibility that a plaintiff will be denied—in the interests of national security—a remedy available by law.

And no one gets to ask questions about secret surveillance techniques because they're secret, says the Fourth Circuit, closing the loop on the state secrets discussion and terminating Wikimedia's lawsuit for the second time.

Wikimedia claims that the NSA is acquiring all communications on a chokepoint cable that it is monitoring. There’s simply no conceivable defense to this assertion that wouldn’t also reveal the very information that the government is trying to protect: how Upstream surveillance works and where it’s conducted. Indeed, “the whole object of [Wikimedia’s] suit and of the discovery” is to inquire into “the methods and operations of the [NSA]”—“a fact that is a state secret.”

[...]

The district court thus correctly held that, in the face of the state secrets privilege, Wikimedia can’t continue to litigate the Wikimedia Allegation to support standing.

This probably isn't supposed to come across as a judicial shrug, but it sure feels like it.

To sum up, evidence of the Wikimedia Allegation establishes a genuine issue of material fact as to standing, but the state secrets privilege prevents further litigation of that issue.

The house wins. And it didn't even have to show its cards. Wikimedia may actually be able to allege an injury that gives it standing, but it can't do that without the government discussing its surveillance programs, which it won't. And the court can't make it do it.

Filed Under: 4th amendment, 4th circuit, ed snowden, nsa, state secrets, surveillance, upstream collection
Companies: wikimedia

DOJ Now Investigating Florida Sheriff's Office For Using A Federal Grant To Fund Its 'Predictive Policing' Harassment Programs

from the claw-it-back dept

The Pasco County (FL) Sheriff's Office believes in "intelligence-led policing." This is its formal slang for harassing residents until (in the office's own words) "they sue or move." The Sheriff's Office turns anyone with a criminal background into a suspect-for-life. Deputies visit residences and residents on the "intelligence-led" shit list multiple times a month, demanding answers to questions they have no business asking. When residents fail to comply, nuisance (in every sense of the word) citations are issued for things like uncut grass or missing mailbox numbers.

It doesn't really matter whether the Sheriff's Office believes its own PR bullshit. It is fully engaged in harassing as many residents as possible. That's why it's allowed its so-called predictive policing program to infiltrate local schools, subjecting minors (and their families) to the same harassment previously limited to adults with criminal records. Almost anything can trigger unwelcome interactions with the office's deputies, including slipping grades, missed school days, or simply being the victim of, or witness to domestic violence.

Local schools are apparently fine with this. They've been sharing student records with the Sheriff's Office. And the Sheriff's Office has been sharing this info with officers. Both of these actions appear to violate federal and local student privacy laws. Not that the Sheriff's Office cares. It says it has done nothing wrong -- only availed itself of records shared with it (unlawfully) by schools.

The exposure of these programs by the Tampa Bay Times has led to multiple investigations and accusations of lawbreaking. One of these investigations involves the federal government, which makes it clear it's not just the locals that find the Sheriff's Office's programs abhorrent. The Department of Education opened an investigation in April to determine whether the in-school "intelligence-led policing" violated federal student privacy laws.

There's a new federal investigation underway. The Department of Justice wants to know what the fuck is going on in Pasco County, Florida. (h/t WarOnPrivacy)

The U.S. Department of Justice is conducting an “intensive review” of the Pasco Sheriff’s Office’s latest intelligence program, federal officials said this week.

The Justice Department sent a letter to the Sheriff’s Office on Aug. 6 — two weeks after the Tampa Bay Times reported that the Sheriff’s Office had promised increased police scrutiny for people whose criminal histories included violent crimes and drug offenses.

The Justice Department’s letter raised concerns about the methodology used to identify targets, communications with the community and the “insufficient” coordination with relevant law enforcement agencies.

The DOJ's interest no doubt has something to do with the Tampa Bay Times' incredible reporting. But it also wants to know why it gave the Sheriff's Office $700,000 if it was just going to use it to violate the terms of the Bureau of Justice Assistance grant.

This is from the DOJ's letter [PDF] to the Pasco County Sheriff's Office:

Agencies that receive SPI funding are expected to engage members of their communities as allies in reducing violence, ensure transparency in their crime reduction approaches whenever feasible, and establish innovative and effective working relationships with citizens and community leaders to gain support for their proposed policing initiatives. Trust, and building trust, is at the core of SPI funding.

But:

PCSO recently circulated the attached letter to individuals regarding a PCSO-run program (the “PCSO program”), which claimed to be “in cooperation with the Department of Justice’s Strategies for Policing Innovation Initiative.” However, the letter does not adequately depict the dedicated training and technical resources under SPI provided by the Department, nor does it adequately describe the requirements for greater community engagement required for SPI’s success.

And:

We also have concerns regarding the methodology used to identify individuals for inclusion in the PCSO program; the name of the program; communications about the program; the lack of involvement and communication with the greater community about the program; and the insufficient coordination with relevant law enforcement stakeholder groups. These shortcomings have the unfortunate consequence of eroding trust in the community, rather than building trust. Given this, and given the goals of SPI, BJA will undertake an immediate assessment of the activities funded under this grant award.

Brace for some federal damnation. Also, brace for opening up the Pasco County coffers to… um… cough up the $700,000 misused by the Sheriff's Office to (and I will quote here) "erode trust in the community."

The Sheriff's Office has responded [PDF]. And it claims it is completely baffled that the DOJ would think its BS predictive policing/targeted harassment program would undermine trust in the community it's supposed to be serving. Instead, it says it followed the instructions given to it by the Trump DOJ.

The Pasco Sheriff's Office (PSO) is in receipt of your correspondence dated August 6, 2021 re- garding the Smart Policing Initiative grant awarded to PSO in 2018. After careful review of the letter, we are left confused as to the origins of the concerns and intentions expressed by the Bureau of Justice Assistance (BJA). Over the last two years, PSO has been working hand-in-hand with the subject matter experts (SMES)' assigned by BIA to implement this grant. In fulfilling the conditions of the grant, PSO actively collaborates with the BJA-assigned SMEs as well as the University of South Florida (USF) in research partnership and follows all guidance and directives they provide. The written feedback provided by these SMEs included phrases such as “excellent job!” and “the messaging was delivered well,” and referenced the “fantastic partnerships” PSO established with the SPI project. Yet for reasons unknown to PSO, your letter directly contradicts the guidance we have been provided over the last two years.

No doubt the current DOJ (headed by Merrick Garland) takes a different view of community-oriented policing than the DOJ led by Jeff Sessions and Bill Barr did. If there's any confusion, it's due to the DOJ reining in its focus on civil rights violations under Donald Trump and its reemergence post Trump as an agency that will at least engage in investigations of problematic law enforcement agencies, even if it's not that great at delivering sustainable results.

Too bad. Meet the new boss, not quite the same as the old boss. Flow my tears, the sheriff who didn't want to comprehend the new paradigm said:

We were excited to work with BJA on this innovative, research-driven initiative, and we are extremely disappointed by this abrupt change in direction.

That's weird. I thought law enforcement officers are trained experts on reacting to fast-moving situations. But maybe that only refers to the indiscriminate deployment of excessive and/or deadly force. Maybe the only ways cops can embrace change is with chokeholds and bullets.

Sure, it doesn't help that the DOJ sent contradictory messages to the Pasco County Sheriff's Office. But as Pasco County Sheriff Chris Nocco surely is aware (being that his position is an elected position), the rules can change when the regime changes. The previous administration may have felt the public was the problem and shows of force by armed government employees was the solution. But the current administration doesn't feel that way. And it has every right to ask why the Pasco County Sheriff's Office spent nearly a million dollars in federal money alienating the community and harassing their kids.

Filed Under: doe, doj, florida, pasco county, pasco county sheriff's office, predictive policing, privacy, schools, surveillance

Apple Patches Up Devices In Response To The Exposure Of Yet Another NSO Group Exploit

from the soon-they-will-make-a-board-with-a-nail-so-big-it-will-destroy-them-all dept

Israeli digital arms merchant NSO Group continues to sell its malware to a wide variety of governments. The governments it sells to, which includes a bunch of notorious human rights abusers, continue to use these exploits to target dissidents, activists, journalists, religious leaders, and political opponents. And the manufacturers of the devices exploited by governments to harm people these governments don't like (NSO says "criminals and terrorists," long-term customers say "eh, whoever") continue to patch things up so these exploits no longer work.

The circle of life continues. No sooner had longtime critic/investigator of NSO Group's exploits and activities -- Citizen Lab -- reported the Bahrain government was using "zero click" exploits to intercept communications and take control of targeted devices then a patch has arrived. Apple, whose devices were compromised using an exploit Citizen Lab has dubbed FORCEDENTRY, has responded to the somewhat surprising and altogether disturbing news that NSO has developed yet another exploit that requires no target interaction at all to deploy.

Apple released a patch Monday against two security vulnerabilities, one of which the Israeli surveillance company NSO Group has exploited, according to researchers.

The updated iOS software patches against a zero-click exploit that uses iMessage to launch malicious code, which in turn allows NSO Group clients to infiltrate targets — including the phone of a Saudi activist in March, researchers at Citizen Lab said.

The backdoor being closed involves a pretty clever trick of the trade. Since links require clicks and images don't, the exploit utilizes a tainted gif to crash Apple's image rendering library, which is then used to launch a second exploit that gives NSO customers control of these devices, allowing them to browse internal storage and eavesdrop on communications.

It's not the first time NSO has developed a zero-click exploit that affects iOS devices. It's just the latest exposed by Citizen Lab's incredible investigation efforts. Thanks to Citizen Lab, more Apple device users around the world are better protected against malicious hackers… working for a company that sells exploits to government agencies. And whatever can be nominally exploited for good (the terrorists and criminals NSO continues to claim its customers target, despite an ever-growing mountain of evidence that says otherwise) can be exploited by governments and malicious hackers who don't even have sketchy "national security" justifications to raise in the defense of their actions.

The arms race continues. It appears marketers of exploits will continue to do what they've always done: maintain over-the-air superiority for as long as possible. And while it may seem this is just part of the counterterrorism game, NSO Group's tacit approval of the targeting of dissidents, journalists, and others who have angered local governments (but have never committed any terrorist or criminal acts) shows it's not willing to stop profiting from the misery of people being hunted and harmed by repressive regimes.

Filed Under: ios, iphone, malware, patches, surveillance
Companies: apple, nso group