DOJ Asks Tenth Circuit Appeals Court To Firmly Establish A Right To Record Police Officers

from the an-unlikely-challenger-appears! dept

Earlier this year, the Tenth Circuit Court of Appeals decided there was no right to record police officers. In a case involving a man who had his tablet seized and searched by Denver, Colorado police officers when they discovered he was recording them, the Appeals Court sided with the cops, awarding them qualified immunity. The judges did this despite the officers being specifically instructed that there was a presumed right to record police officers via training that had been in place for years prior to this incident.

The plaintiff attempted to have this case reheard by the Supreme Court, which might have resulted in the firm establishment of a right to record nationwide. Unfortunately, the nation's top court decided this wasn't worth its attention and took a pass on this case, apparently feeling the patchwork establishment of this right in a handful of judicial circuits is more than enough protection for the general public.

The Tenth Circuit is hearing another case involving the recording of police officers. It again involves officers in Colorado. In this case, an officer blocked Colorado resident Abade Irizarry from filming cops performing a roadside sobriety test. The Tenth previously dodged establishing precedent in the case it handled in April. This time it might feel a bit more pressure to actually weigh in on this issue. The DOJ (yes, that one!) has filed a brief in Irizarry's case asking the court to establish this right.

In a brief submitted to the U.S. Court of Appeals for the 10th Circuit on Wednesday, the department's Civil Rights Division advocated for the appellate court to settle the question once and for all as cases continue to arise implicating the right to record. The government indicated it has a stake in the outcome, given its authority to investigate patterns of police misconduct.

"The U.S. Department of Justice frequently relies on photos and videos of police misconduct — including photos and videos taken by members of the public — when investigating and prosecuting police officers" for constitutional violations, wrote attorneys Natasha N. Babazadeh and Nicolas Y. Riley.

The brief [PDF] specifically cites the George Floyd case, which might have vanished into the ether had it not been for recordings captured by citizens who witnessed the murder committed by Minneapolis police officer Derek Chauvin. It also points to the killing of Walter Scott by South Carolina police officer Michael Slager, who stated Scott had reached for his taser, necessitating his shooting. Bystander video showed what actually happened, which was Officer Slager shooting Scott in the back as he fled and then dropping his taser near Scott's body.

The DOJ says that it has long considered the recording of officers to be protected by the First Amendment, something it has repeatedly stated in investigations of local law enforcement agencies which have (among other frequent rights violations) detained, hassled, or otherwise deterred citizens from recording them.

As the brief points out, the lower court somehow managed to award qualified immunity to the officer despite there being plenty of case law that strongly suggested recording the police is protected by the First Amendment.

To reach that conclusion, the court cited Tenth Circuit precedents recognizing that the First Amendment protects news-gathering activities; out-of-circuit case law holding that such protections are not limited to professional journalists or established media companies; and the widely accepted proposition that the First Amendment protects the free discussion of government affairs, including sharing information about government misconduct. Nevertheless, despite holding that the First Amendment protects such a right, the court concluded that the right had not been clearly established in May 2019, when the incident that gave rise to this case occurred.

To that point, the DOJ urges the court to handle the important open questions first, rather than move straight to the qualified immunity defense, which short-circuits any judicial discussion of the relevant constitutional issue.

This Court should hold that the First Amendment protects the right to record police officers performing their duties in public (subject to reasonable time, place, and manner restrictions, as noted above) before resolving the qualified immunity question.

And, like the other case the Tenth Circuit Court mishandled in April, the cop involved in this incident had prior training informing him that citizens had a presumed right to record police officers.

Officer Yehia’s own police department explicitly instructs officers not to interfere with “the lawful efforts of the news media to photograph, tape, record and televise adult subjects in a public place.”

I hope the Tenth Circuit sees where it went wrong with the previous decision and decides to join the six circuits who've already established this right. There's always a chance the judges might decide it isn't any of the DOJ's business and go the other way out of spite, but this isn't an issue that's just going to go away if it's ignored long enough. And the longer the Tenth Circuit sides with cops, the more lawsuits its refusal to establish this right is going to generate.

Filed Under: 10th circuit, doj, recording police

Daily Deal: The 2021 All-in-One Computer Science Bundle

from the good-deals-on-cool-stuff dept

The 2021 All-in-One Computer Science Bundle has 11 courses to teach you the essentials of computer science. You'll learn about Java, C++, Ruby on Rails, Python, and more. It's on sale for $35. Use the code CMSAVE70 to get an additional 70% off this and other elearning offers through out the store.

Note: The Techdirt Deals Store is powered and curated by StackCommerce. A portion of all sales from Techdirt Deals helps support Techdirt. The products featured do not reflect endorsements by our editorial team.

Filed Under: daily deal

Biden's Broadband Push Is Good, But Crappy Maps And Lobbying Can Still Screw Things Up

from the do-not-pass-go,-do-not-collect-$200 dept

So to be very clear: the Biden infrastructure bill has a lot of good things for broadband in it. More specifically, billions in grant money that can be used by states to shore up both "middle mile" and "last mile" broadband access across huge swaths of the country. It's the biggest lump sum ever doled out by the government for broadband, and it will have a huge positive impact on the nation's broadband gaps. Especially in perpetually marginalized areas. That can't be understated.

That said, this isn't the first time we've tried to throw a big chunk of cash at the U.S. broadband problem, and there are numerous ways this could still go south.

The plan relies on many states to build entirely new systems to distribute and spend that money. Given rampant state corruption in broadband policymaking, there's an unlimited number of ways that entrenched regional monopolies (Comcast, Charter, AT&T, Verizon, CenturyLink (Lumen), Frontier) could inject themselves into the process to ensure more money goes to them for dubious deployment promises, and less goes to smaller competitors or faster, better services.

ISP lobbyists already stripped a lot of language they didn't like out of the original proposal, including clear support for community broadband and tougher speed standards. Now their lobbying folks are busy lobbying the NTIA, which has been tasked with crafting additional standards and funding guidelines in six short months:

"Meanwhile, internet service providers (ISPs) are expected to aggressively lobby the National Telecommunications and Information Administration (NTIA) as it crafts new internet rules under the infrastructure bill’s $65 billion broadband expansion plan. The relatively tiny agency has six months to develop a proposal that will require recipients of federal broadband funding to provide a low-cost broadband option and encourage states to explore alternatives to dominant ISPs such as coops, nonprofits and municipalities."

U.S. broadband has a 30 year history of ISPs taking billions of dollars for networks they then half deploy, usually with little or no penalty. Whether that happens again here depends entirely on how tough the NTIA and FCC are going to be with regional monopolies, historically neither agencies' strong suit. And again, more than half the states in the country are literally little more than rubber stamps for the interests of giants like AT&T, so diligence will be required to ensure the money is going toward productive, pro-competitive solutions.

The other major obstacle is the country's broadband maps, which still don't accurately track broadband speed, pricing, and availability despite decades of complaints on this subject. While Congress, the FCC, and NTIA have all taken some helpful steps toward better mapping, actual implementation of those reforms are still several million dollars and several years away. That's too late for states, many of which are currently working on spending $10 billion to shore up access, with $42 billion from the infrastructure bill still on the way. In other words, we're trying to fix a problem we still haven't accurately measured the scope of:

"For now, though, many states don’t know where to put that first round of cash. They have only a murky picture of where their internet dead spots are, thanks to the federal government’s reliance on broadband mapping methods that dramatically overstate existing coverage."

Here too, telecom lobbyists, eager to obfuscate the obvious end result of monopolization, limited competition, and regulatory capture, have routinely blocked reform (and will continue to do so). So there's a lot of money being thrown at a system that historically doesn't measure the problem it's tasked with fixing very well, often can't even acknowledge why the problem exists in the first place (again: regional monopolization, corruption, regulatory capture), and doesn't like to challenge wealthy and politically powerful telecom corporations tethered to our intelligence and law enforcement apparatus.

That's not to say a change from the US telecom status quo is impossible; there's a lot of good folks working very hard to do this the right way. But it is to say that doing any of this correctly is going to require some uncharacteristic aggression, competence, and integrity we haven't seen in the last forty years of telecom policy.

Filed Under: broadband, competition, fcc, infrastructure, infrastructure bill, joe biden, lobbying

Indonesian Court Gives The Government Permission To Pull The Plug On The Internet Whenever It Feels Threatened

from the just-going-to-steer-clear-of-that-whole-'checks-and-balances'-things dept

The government of Indonesia is taking greater direct control of the internet. Over the past several months, it has implemented a new law that places a ton of burdens on platforms and service providers that deal extensively with content created by third parties.

The new law -- referred to as MR5 -- is pretty much the inverse of Section 230 immunity that sites in the United States enjoy. Intermediary liability is the name of the game in Indonesia. Providers are ordered to take down content that could cause "community anxiety" and instructed to keep a look out for any ways people might be sharing such forbidden content.

This means providers are not only expected to police their services and platforms for content they can see but also head off circumvention efforts, like the use of VPNs. On top of that, providers are expected to engage in continuous monitoring of content and create filters that will block content the government finds upsetting, including gambling, blasphemy (but only against state-approved deities), and the always meaningless catchall, "fake news."

The law has been made even worse as the EFF reports. Providers and platforms are already expected to police content. A recent ruling by an Indonesian court says it's perfectly legal for the government to pull the plug on the internet at its discretion.

Indonesia’s Constitutional Court dealt another blow to the free expression and online privacy rights of the country’s 191 million internet users, ruling that the government can lawfully block internet access during periods of social unrest. The October decision is the latest chapter in Indonesia’s crackdown on tech platforms, and its continuing efforts to force compliance with draconian rules controlling content and access to users’ data. The court’s long-awaited ruling came in a 2019 lawsuit brought by Indonesia NGO SAFEnet and others challenging Article 40.2b of the Electronic Information and Transactions (EIT) Law, after the government restricted Internet access during independence protests and demonstrations in Papua. The group had hoped for a ruling reining in government blocking, which interferes with Indonesians’ rights to voice their opinions and speak out against oppression.

Now, even if local companies comply with the dozens of demands foisted upon them by MR5, they can still expect to see their services shut down if the government feels too much forbidden content is in circulation or if it feels threatened by the content created by presumably unhappy residents. A directive like this is created for a single purpose: to prevent organization of protests criticizing the government. At any point, the government can decide there's enough "social unrest" to justify shutting down the most popular means of communication.

And all of it dovetails nicely into the long list of restrictions and mandates that are already in force. The government will have minimal problem pulling the plug since all service providers are required to register with the government and store user data locally. Foreign platforms and service providers are required to store data locally as well and create local offices, which will make it much more difficult for them to remain live should the government decide an internet blackout is warranted.

This is a consolidation of power aided and abetted by the court system in Indonesia. This will insulate current rulers from efforts to remove them from power. Without the internet, activists, dissidents, and opposition parties are cut off from each other, preventing them from reaching the critical mass needed to depose the people who have stripped away their freedoms. Under the guise of protecting the public from questionable content, the Indonesian government has given itself enough power to ensure its directives aren't questioned, much less disobeyed.

Filed Under: indonesia, internet, internet shutdown, mr5

NordicTrack Patches Out 'God Mode' In Treadmills That Allowed Users To Watch Anything On Its Display

from the mine-mine-mine! dept

If you are a console gamer of a certain age, you will remember the bullshit Sony pulled when it patched its PS3 systems to remove useful features it had used as selling points for the console to begin with. Essentially, the PS3 had a feature that allowed you to install another operating system on it. This was used by hobbyists, companies, and the US Military alike to creatively use PS3s for purposes other than that for which they were built, such as research supercomputers and creating homebrew PS3 games. Sony later decided that those features could also be used for piracy or other nefarious actions and so patched it out. Sell the console with a feature, remove it later after the purchase... and then get sued in a class action, as it turned out.

The story of NordicTrack's treadmill isn't exactly like that, but it's pretty damned close. The company's treadmill has a large display mounted on it. That display was designed to be used with a subscription to iFit, which is the parent company of NordicTrack. There are all sorts of useful features when you view subscribed content on the display while exercising, such as difficulty and incline changes that follow along with the subscribed workout content. But the console also has a way to bypass the user-facing portion of the console and get into the underlying OS, which means users like JD Howard could then setup their own internet browser, through which they could put any web content on the display while they worked out.

To get into his X32i, all Howard needed to do was tap the touchscreen 10 times, wait seven seconds, then tap 10 more times. Doing so unlocked the machine—letting Howard into the underlying Android operating system. This privilege mode, a sort of God mode, gave Howard complete control over the treadmill: he could sideload apps and, using a built-in browser, access anything and everything online. “It wasn't complicated,” Howard says. After accessing privilege mode he installed a third-party browser that allowed him to save passwords and fire up his beloved cloud security videos.

While NordicTrack doesn’t advertise privilege mode as a customer feature, its existence isn’t exactly a secret. Multiple unofficial guides tell people how to get into their machines, and even iFit’s support pages explain how to access it. The whole reason Howard bought the X32i, he says, was because he could access God mode. But the good times didn’t last long.

No they didn't, because NordicTrack subsequently removed the God mode feature through a software update. And not just on the treadmill, but also on its other associated exercise equipment. And a not insignificant number of customers are absolutely pissed about it. The comments coming in largely are combinations of anger and confusion, with many owners wondering why in the world they suddenly can't watch sports or Netflix while they workout. The other theme appears to be confusion as to how the company can even do this because, "Hey, don't we own this thing we bought?"

The answer, of course, is no.

“The block on privilege mode was automatically installed because we believe it enhances security and safety while using fitness equipment that has multiple moving parts,” says a spokesperson for NordicTrack and iFit. The company has never marketed its products as being able to access other apps, the spokesperson adds. “As there is no way of knowing what kind of changes or errors a consumer could introduce into the software, there is no way of knowing what specific issues accessing privilege mode might cause,” the spokesperson says. “Therefore, to maintain security, safety, and machine functionality, we have restricted access to privilege mode.” The spokesperson also emphasizes that privilege mode was “never designed as a consumer-facing functionality.” Rather, it was designed to allow the company’s customer service team to remotely access the products to “troubleshoot, update, reset, or repair our software.”

The move puts the company at the center of the right-to-repair debate, with consumers increasingly demanding that companies let them alter the products they purchase.

Kinda, yeah. And it's important to note that "owners" like Howard already had regular old treadmills and bought their NordicTrack treadmill because of the ability to put what they wants on the display. Again, sell the thing with a useful feature, then remove the useful feature afterwards via a software update. As I said, it's not exactly like the PS3 case, but it's pretty damned close.

The only real question now is whether iFit and NordicTrack too will have to pay out millions in attorney's fees and barely anything to the actual consumer in some massive class action like Sony did.

Filed Under: god mode, hacking, nordic track, ownership, software updates
Companies: ifit, nordic track

Lying NYPD Officers Cost Prosecutors Sixty More Criminal Convictions

from the propping-up-the-Drug-War-with-bogus-busts dept

Fighting crimes is easier when it's not being done by criminals. A bunch of cases are being tossed in New York City because misbehaving NYPD officers left their dirty handprints all over them.

Queens County District Attorney Melinda Katz is asking a state supreme court judge to vacate the cases of 60 people which their cases were based on the police work of three former NYPD detectives who were later convicted of various crimes.

This adds to the NYPD's list of self-inflicted wounds. Earlier this year, prosecutors tossed nearly 100 cases tainted by the presence of narcotics detective Joseph Franco. Franco was charged with 26 criminal counts -- including perjury and official misconduct -- in 2019. The dismissals followed another investigation which showed Franco had lied about drug buys to secure warrants and perform arrests. Some arrestees were able to get their cases dismissed by obtaining security camera footage showing alleged drug purchases had never occurred.

One lying cop and nearly 100 dismissals. Now this: three bad cops and 60 dismissals. And these cops have some pretty impressive rap sheets.

Former NYPD Detective Kevin Desormeau was convicted of perjury after lying about witnessing a drug sale that videotaped evidence showed did not take place. He also pleaded guilty after he fabricated the facts of a gun possession arrest. Desormeau was terminated by the NYPD and there are 34 cases the district attorney says should be dismissed based on his role as the essential witness.

Former NYPD Detective Sasha Cordoba pled guilty in Manhattan to perjury relating to her fabricating the facts of a gun possession arrest. Cordoba was terminated by the NYPD. 20 cases will be requested to be dismissed based on Cordoba’s role as the essential witness.

The third cop involved in these dismissals at least wasn't in the perjury business. No, he was into darker stuff.

As alleged in court filings by the government, in February 2008, Sandino arrested a woman identified in the Information as Jane Doe 1 (“the victim”) and her boyfriend on drug distribution charges following the execution of a search warrant at their apartment. During the arrest, Sandino forced the victim to undress in front of him in the bedroom of the apartment. Later, at the precinct, Sandino told the victim that she was going to jail and would lose her children unless she had sex with him. When the victim went to the restroom at the precinct, Sandino followed her inside and made her perform oral sex. Upon the victim’s release from custody, Sandino told her that he expected her to have sex with him at a later time. Thereafter, Sandino called the victim on numerous occasions. The victim subsequently reported Sandino’s misconduct to NYPD’s Internal Affairs Bureau, which began an investigation. In March 2008, Sandino was removed from active duty.

As further alleged in the government’s court filings, Sandino engaged in similar misconduct in the summer of 2006 in connection with the arrest of another drug dealer. On that occasion, Sandino coerced a female cousin of the drug dealer, identified in the Information as Jane Doe 2, to engage in sex acts with him based on threats he made concerning the lengthy prison sentence faced by the drug dealer.

More recently, in September 2009, Sandino allegedly engaged in lewd sexual behavior in front of a female arrestee and then forced her to raise her shirt to expose her upper body.

Sandino was fired by the NYPD in 2011, one year after he racked up this federal indictment. Somehow, he's still involved with six convictions now being tossed out because of his role as a witness. That means six people have spent a long time in jail due to this bad cop's testimony that was apparently given more than a decade ago.

It's good to see all three cops are listed as "former." But it is concerning that someone like Sandino managed to remain a law enforcement officer for thirteen years when it was likely apparent long before his indictment that he was abusing his power. Meanwhile, Detective Desormeau's misconduct has affected cases dating as far back as 2014, which potentially means someone lost most of a decade as the result of a bad cop's statements in court.

The repeal of a state law that effectively denied access to police misconduct records for decades means those overseeing the NYPD -- which includes city prosecutors that frequently rely on their testimony -- can no longer effectively pretend the department isn't home to a number of bad apples. Expect more of this in the near future as this long-delayed transparency forces city officials and, hopefully, the NYPD itself, to take officer misconduct more seriously. But while we wait for a police accountability ideal that may never arrive, we can at least take some satisfaction in these reversals of unjustly obtained criminal court "wins."

Filed Under: lying, lying police, nypd

When The FBI Shows Up At Your Door About Your Reporting, That's Intimidation

from the yikes dept

Having the government show up at your door to ask some questions about your reporting can be extremely unnerving. Zack Whittaker, the top notch cybersecurity reporter for TechCrunch got to experience the fun of that when the FBI showed up at his door over a year after he had published a story about a hacker dumping thousands of Mexican embassy documents from Guatemala after the Mexican embassy left the data exposed online.

As with many situations involving reporting on hacks and leaks, rather than focus on those actually responsible (often those who left the information exposed), law enforcement and the powers that be... often target the journalists. We saw that recently in Missouri where the governor called reporters hackers (and "fake news") for ethically disclosing that the state's elementary school agency had left teacher and administrator social security numbers exposed -- something the Department of Elementary and Secondary Educationapologized for weeks later (though it didn't apologize to the journalists).

For Whittaker, the experience was reasonably concerning:

I contacted Mexico’s consulate in New York for comment, as is standard practice when reporting a story. A spokesperson said the Mexican government took the matter “very seriously.” We published our story, and that seemed to be the end of it.

The FBI knock at my door a year later suggested it wasn’t. I declined to speak with the agents and closed the door.

After we published our story the Mexican government requested the help of the U.S. Department of Justice through diplomatic channels to investigate the hack and presumably try to identify the hacker. Because I had contact with the hacker, that must have made me a subject of interest to the Mexican authorities, hence the visit a year on.

A month after the house call, the Mexican government provided the FBI with a list of written questions it wanted us to answer, many of which were already answered in the story. Our response to the DOJ declined to provide anything more than what we had already published.

However, as Zack notes, even if he knew he hadn't done anything wrong, all of this is incredibly unnerving. Legal threats (unfortunately, and often ridiculously) now come with the territory of being a journalist, but the intimidation factor is very real -- and that can be super damaging for better informing the public. Indeed, it's often why the powerful -- be they governments or just wealthy people and companies -- make use of such intimidation tactics all the time:

We’ve rebuffed spurious legal demands before, but having federal agents on your doorstep simply for doing your job is certainly a new one for me. There has been no suggestion of wrongdoing, though it’s unsettling not knowing what view Mexico would take if I ever stepped foot on its soil.

But it’s the legal threats and demands that don’t make it to print that can have the most damage. Legal demands inherently have a silencing effect. Sometimes they succeed. Journalism can be risky and the newsrooms don’t always win. Left unchecked, legal threats can have a chilling effect that stifles both security research and journalism by making it legally toxic to work. That means the world is less informed and sometimes less secure.

Filed Under: fbi, intimidation, journalism, mexico, reporting, zack whittaker
Companies: techcrunch

Apple Sues NSO Group For Targeting IPhone Users With Powerful Exploits

from the [applauds-super-cautiously] dept

NSO Group's year from hell continues. Apple is now suing the Israeli exploit hawker for hacking its customers' iPhones -- customers who include not only the supposed terrorists and dangerous criminals NSO claims its customers target with malware, but also journalists, activists, lawyers, ex-wives, religious leaders, US citizens, and government officials NSO claims its customers don't target.

Apple isn't the first major tech company to sue NSO over its malware. Facebook and WhatsApp sued NSO in 2019, alleging that the use of WhatsApp to deploy powerful exploits violated WhatsApp's terms of use. While this is almost certainly true (deploying malware via WhatsApp is definitely not allowed), WhatsApp appears to want a ruling that would expand the definition of "unauthorized access" under the CFAA (Computer Fraud and Abuse Act) that's already been stretched several times by DOJ prosecutors.

On one hand, it would be undeniably enjoyable see NSO get slapped with an order denying it access to WhatsApp and its users, on the other, it wouldn't be helpful at all to turn research (security and otherwise) that violates sites' terms of use into a federal crime.

Unfortunately, Apple's lawsuit [PDF] appears to be asking for something along the same lines. It also stretches the definition of legal standing, alleging it has the right to sue on the behalf of its users because reacting to the deployment of NSO malware has caused it to spend a bit of its billions closing security holes.

That being said, Apple's legal reps sure know how to open a lawsuit. Here's the first paragraph of the suit's introduction:

Defendants are notorious hackers—amoral 21st century mercenaries who have created highly sophisticated cyber-surveillance machinery that invites routine and flagrant abuse. They design, develop, sell, deliver, deploy, operate, and maintain offensive and destructive malware and spyware products and services that have been used to target, attack, and harm Apple users, Apple products, and Apple. For their own commercial gain, they enable their customers to abuse those products and services to target individuals including government officials, journalists, businesspeople, activists, academics, and even U.S. citizens.

Welp. That's not going to help NSO's presumably permanently damaged SEO. The next paragraph builds on NSO's "amoral mercenary" reputation by pointing to the US Commerce Department's recent blacklisting of the company -- an act that almost never targets companies operating in countries the US considers to be close allies.

It follows these accusations with NSO's own admissions of malfeasance.

NSO admits that its destructive products have led to violations of “fundamental human rights,” which have been widely recognized and condemned by human rights groups and governments, including the U.S. Government. To ensure that their products can be used by others to maximum effect, NSO reportedly provides ongoing technical support and other services to their clients as they deploy NSO’s spyware against Apple’s products and users, including journalists, human rights activists, dissidents, public officials, and others. Most recently, the Guardian reported that six Palestinian human rights defenders—one of whom is also a U.S. citizen—were attacked and surveilled using NSO’s spyware. Although NSO claims that its spyware “cannot be used to conduct cybersurveillance within the United States,” U.S. citizens have been surveilled by NSO’s spyware on mobile devices that can and do cross international borders.

Then it starts talking about the damage Apple itself has suffered as a result of NSO customers targeting iPhone users.

Defendants force Apple to engage in a continual arms race: Even as Apple develops solutions and enhances the security of its devices, Defendants are constantly updating their malware and exploits to overcome Apple’s own security upgrades.

These constant recovery and prevention efforts require significant resources and impose huge costs on Apple. Defendants’ unlawful malware activities have caused and continue to cause Apple significant damages in excess of $75,000 and in an amount to be proven at trial.

That's the amount of damages needed to keep a lawsuit in federal court. But further into the lawsuit, Apple specifically cites the law amended by the CFAA and quotes a much lower price for actual monetary damages.

Defendants’ actions caused Apple to incur a loss as defined by 18 U.S.C. § 1030(e)(11), in an amount in excess of $5,000 during a one-year period, including the expenditure of resources to investigate and remediate Defendants’ conduct.

That puts the CFAA in play as Apple advocates on behalf of its users and its own defensive efforts. But standing is a tricky thing, as is attempting to hold NSO directly responsible for the activities of its customers.

Apple attempts to show standing by claiming end users are only borrowing the software it creates, so iPhone users targeted by NSO malware are, in effect, having their rented homes damaged by home invaders. Apple is the landlord, so to speak, so it believes it is due direct compensation for something that happened to its tenants. This is a dangerous argument to make, considering its the same one the DOJ deployed when it was trying to force Apple to break encryption on the San Bernardino shooter's iPhone.

Defendants violated and attempted to violate 18 U.S.C. § 1030(a)(2) because they intentionally accessed and attempted to access the iOS operating system on Apple’s users’ devices without authorization and, on information and belief, obtained information from Apple’s users’ devices.

Defendants violated 18 U.S.C. § 1030(a)(4) because they knowingly and with the intent to defraud accessed the operating system on Apple’s users’ devices without authorization using information from Apple’s servers and then installed highly invasive spyware on those Apple users’ devices, and by means of such conduct furthered the intended fraud and obtained something of value.

[...]

Apple retains ownership of its operating-system software pursuant to its Software License Agreements.

We'll see whose stretching works better. Apple wants to be able to represent users who've been targeted, citing its licensing and its own (apparently minimal) expenses related to patching security holes. NSO, on the other hand, will want out of this suit and has deployed some creative arguments of its own defending itself against WhatsApp's litigation.

It remains to be seen whether its argument that it can't be sued directly for the actions of its customers will convince the court WhatsApp's lawsuit should be dismissed. But it has already seen another of its defenses shot down at the appellate level, which refused to extend sovereign immunity to the private company that sold exploits to government agencies. The Ninth Circuit refused to buy the argument that selling stuff to government agencies makes one an extension of that government agency for immunity purposes.

We'll see what the court makes of this one. We already know at least one of NSO's defenses is foreclosed by precedent. But we shouldn't necessarily cheer Apple on just because the target of its suit is reprehensible. A ruling in favor of Apple's CFAA allegations could prove disastrous for researchers and others who bypass terms of service restrictions for far less malignant reasons.

On the bright side, Apple is handing out a lot of money to researchers who've exposed plenty of malfeasance by NSO Group's customers.

Apple commends groups like the Citizen Lab and Amnesty Tech for their groundbreaking work to identify cybersurveillance abuses and help protect victims. To further strengthen efforts like these, Apple will be contributing $10 million, as well as any damages from the lawsuit, to organizations pursuing cybersurveillance research and advocacy.

Apple will also support the accomplished researchers at the Citizen Lab with pro-bono technical, threat intelligence, and engineering assistance to aid their independent research mission, and where appropriate, will offer the same assistance to other organizations doing critical work in this space.

On top of this, Apple will continue notifying users it believes have been targeted by NSO malware, which is only going to result in more negative press for the malware purveyor. If NSO wanted to be perceived as a skilled warrior in the fight against international crime and terrorism, it blew that chance when it decided to sell to notorious human rights abusers and engage in zero oversight of the use of its products. It earned the reputation it now has and will carry with it forever, no matter how this lawsuit plays out.

Filed Under: cfaa, exploits, iphones, license, malware, ownership, research, spyware
Companies: apple, nso group

Facebook (Again) Tells Law Enforcement That Setting Up Fake Accounts Violates Its Terms Of Use

from the LAPD-teaching-respect-for-the-law-by-playing-by-its-own-rules-wtaf dept

Law enforcement agencies routinely engage in surveillance of social media accounts. Some of this is accomplished with third-party tools that use keywords and geofences to give cops info that may be relevant to investigations. These tools also give cops a lot of garbage data that law enforcement is free to sift through for officers' own entertainment or to bypass constitutional protections surrounding speech and warrantless searches.

Does it actually help combat crime? The jury (if a court would ever allow one to consider these issues…) is still out on that. But social media surveillance continues under the theory that anything someone published publicly should be accessible by cops since it's accessible by everyone else.

But the constitutional metric changes (or at least should) when cops set up fake accounts to engage in surveillance of suspected criminals. In these cases, cops may be welcomed into more private circles where information can't be accessed unless a person has been given access.

This isn't a new problem. It dates back to 2009, when Facebook was gaining critical mass and Twitter was just starting to generate enough interest to become (very eventually) sustainable. Twitter's account verification process allows users to engage without turning over much personal info. The same can't be said for Facebook, which would prefer to have its user base verified with as much personal info as possible -- something that was supposed to limit abusive behavior but just ended up giving the platform plenty of actionable (and sellable) demographic info. Facebook insisted on real people and real names and altered its policy to inform users that setting up bogus accounts was something that could result in account termination.

Cops didn't care. They had online lurking to do in hopes of finding something prosecutable without ever leaving the office. Facebook warned law enforcement that setting up fake accounts wasn't permissible in 2018 after news surfaced showing cops were bypassing these rules to do a little online fishing for potential criminals.

Facebook is now Meta. It is also still Facebook, albeit under a new umbrella corporation. The rules about "real names" still apply to Facebook account creation. And law enforcement officers are still continuing to ignore this rule. Three years after its last letter addressed to cops about terms of service violation Meta is sending out another one [PDF]. It reiterates what officers already know but are apparently of the belief Facebook/Meta won't actually do much to enforce.

The letter references Los Angeles Police Department activities exposed by the Brennan Center. The LAPD apparently encourages officers to set up fake accounts to locate and surveil criminal suspects. The practice is common enough that the LAPD actually has policies governing the use of social media surveillance via dummy accounts. But the policies ignore Facebook's rules, which take precedence over the LAPD's rules. After all, it's Facebook's platform, not the LAPD's playground.

According to the Brennan Center for Justice and media reports the Los Angeles Police Department (“LAPD”) has been instructing its officers to create fake (or “dummy”) Facebook accounts and impersonate legitimate users. Not only do LAPD instructional documents use Facebook as an explicit example in advising officers to set up fake social media accounts, but documents also indicate that LAPD policies simply allow officers to create fake accounts for “online investigative activity.” To the extent these practices are ongoing they violate our terms of service. While the legitimacy of such policies may be up to the LAPD, officers must abide by Facebook’s policies when creating accounts on our services. The Police Department should cease all activities on Facebook that involve the use of fake accounts, impersonation of others, and collection of data for surveillance purposes.

This alone won't prevent the LAPD from violating Facebook's terms of service to engage in online surveillance. Facebook will have to determine which accounts are fake and terminate them. But this letter gives the LAPD notice that when its bogus accounts are terminated, it will have zero recourse.

The letter also says the LAPD is violating other Facebook rules, albeit indirectly.

It has also come to our attention that the LAPD has used a third-party vendor to collect data on our platforms regarding our users. Under our policies, developers are prohibited from using data obtained on our platforms for surveillance, including the processing of platform data about people, groups, or events for law enforcement or national security purposes (https://developers.facebook.com/terms/#control).

Again, this won't stop the LAPD from utilizing services it's paid for. But it does make it clear that if Facebook ever decides to terminate access to this firehose being abused by third parties, neither the third parties or their LAPD beneficiaries will be able to do anything but bitch ineffectively about the loss of access to a surveillance tool.

Subterfuge is often essential to law enforcement investigations. But that doesn't mean private companies are obliged to provide cover for undercover surveillance. Law enforcement has been told (at least twice) that govern regular people also govern government employees -- people who often seem to believe they're above rules, laws, and even the rule of law.

Filed Under: fake accounts, impersonation, lapd, law enforcement, police
Companies: facebook, meta

Daily Deal: Cyber Monday Roundup

from the good-deals-on-cool-stuff dept

It's Cyber Monday and we have some special coupon codes you can use on the following deals and throughout the store. Coupon code CMSAVE20 gets you 20% off anything that is NOT a digital product, CMSAVE40 gets you 40% off apps and software, and CMSAVE70 gets you 70% off e-learning deals.

The AirBlast Pro Earbuds are the newest version of the best-selling earbuds that comes at an unbeatable price point. Featuring top-notch sound quality, wireless charging, and advanced Bluetooth 5.1 technology, the AirBlast Pro is what you need. With an hour of charging time, you get to enjoy up to 3 hours of playtime for up to 49 ft operating distance. Use the earbuds with their charging case, and you get to experience up to 8 hours of non-stop music/talk time. They're waterproof and can withstand water, sweat, or rain. A single pair is on sale for $40, 2 pairs for $55, or 3 pairs for $75.

The Dragon Alpha Z PRO Dual Camera Drone is equipped with a powerful wide angle 4K camera on the front and a 720p on the bottom. The front camera, with 90 degrees ESC adjustment, can help you to film and capture all the beautiful scenes you encounter. It has a companion app so you can view real-time images and not miss out at any moment. With an altitude hold mode function that stabilizes its flight, you do not have to constantly worry about the drone's stability and can concentrate on capturing your image better. The headless mode eliminates the need to adjust the position of aircraft before flying. The drone will return to its original point with one click, no matter where it was flying. It's on sale for $100.

The HumBird Speaker is the world’s smallest and most versatile bone conduction speaker that allows you to have a different but always spectacular listening experience anywhere. Using cutting-edge bone conduction technology, it delivers a high sound volume, being 4 to 5 times louder than the average cell phone speakers' volume, reaching up to 115dB, and it allows you to personalize the tone quality. HumBird turns sound into a mechanic vibration of different frequencies, leveraging the effects of the different materials on top of which it is placed and used. Put HumBird anywhere and experience a DIY customizable experience of sound. It's on sale for $26.95.

This Smart Keychain replaces the typical charging cable and uses the microcomputer electronic system to wirelessly charge the touch-sensitive Apple Watch by simply placing the watch on a black magnetic charger. It's easy to use. This charger with a built-in 950mAh lithium-ion battery can charge all iWatch series. Portable, pocket-size when you're outdoors, the pocket size of the portable charger will be carried around and it's easy to put in your pocket and bag while you're exercising. A single charger is on sale for $20, 2 for $39, or 4 for $77.

There are over a dozen different features now on the C-MAX Chrono-Max Smartwatch 1.69” full-color touchscreen display. Never miss a call, chat, or text when you get the alert right to your watch. See what the weather is like with one quick swipe. Control your music or audiobook playback, and track your sleep, fitness, and health vitals all on your wrist. The soft, flexible silicone band makes C-MAX comfortable to wear all day, every day. It's available in 4 colors and on sale for $60.

Don't forget to use those coupons!

Note: The Techdirt Deals Store is powered and curated by StackCommerce. A portion of all sales from Techdirt Deals helps support Techdirt. The products featured do not reflect endorsements by our editorial team.