The FBI Wants Speedy DNA Analysis Added To Its Biometric Dragnet

from the to-preserve-the-integrity-of-your-precious-bodily-fluids dept

The FBI's Next Generation Identification (NGI) database has been discussed here several times, thanks to its "expeditious" blend of criminal and non-criminal data, its postponed-forever Privacy Impact Assessment the agency has been promising since 2008, the limited, four-state rollout of facial recognition software with a 20% error rate, and its peculiar exclusion of DOJ/law enforcement employees from its lifelong criminal database monitoring.

It appears the FBI isn't satisfied with the wealth of biometric information it already has access to. It's grabbed everything external it can possibly get (faces, distinctive marks, fingerprints, civil/criminal records, voice recordings, iris scans [coming soon!]). Now, it's coming for what's inside you.

The FBI is preparing to accelerate the collection of DNA profiles for the government's massive new biometric identification database.

Developers of portable DNA analysis machines have been invited to a Nov. 13 presentation to learn about the bureau's vision for incorporating their technology into the FBI's new database.

So-called rapid DNA systems can draw up a profile in about 90 minutes.

DNA has been an integral part of criminal investigations for a number of years now and there's no question it has played an important role both in securing convictions and exonerating the falsely accused. But what the FBI is proposing is adding input from lab-in-a-box setups that return pass/fail DNA matches in a relative instant.

Rapid DNA analysis can be performed by cops in less than two hours, rather than by technicians at a scientific lab over several days. The benefit for law enforcement is that an officer can run a cheek swab on the spot or while an arrestee is in temporary custody. If there is a database match, they can then move to lock up the suspect immediately.

What used to take days in a secure, sterile lab now can apparently be accomplished in the "field" in a couple of hours. All technological improvements aside, this would appear to be a much less reliable method. Field drug testing kits have been available for years -- which utilize nothing more complex than chemical reactions -- and they've been shown to be far more unreliable than those utilizing them would have you believe. The same can most certainly be said about portable or on-site units wholly divorced from the normal constraints of a lab setting.

The government (so far) realizes this. That's why DNA obtained and analyzed by these units aren't included in the national DNA database. Only results from accredited public-sector laboratories are accepted. The companies manufacturing these devices are obviously interested in seeing this law changed. In the meantime, they've pushed for states to create their own DNA databases.

The FBI would like to see this changed as well, going so far as to issue a statement that is mostly wishful thinking.

FBI officials say their program does not impact any laws currently governing the operation of CODIS. Rapid DNA techniques in booking stations, “will simply expedite the analysis and submission of lawfully obtained samples to the state and national DNA databases,” [Ann] Todd, the FBI spokeswoman, said.

Except that it would impact laws governing CODIS… as they are today.

A legislative tweak is needed to allow DNA processed by a portable machine to be entered into the FBI's systems, bureau officials acknowledge.

Again, the FBI places efficiency above everything else. "Tweaking" the law to include portable devices would "expedite" the filling of the FBI's biometric database. Faster is better, even if the analysis method isn't as reliable as that performed by accredited labs. False positives/negatives are just the acceptable collateral damage of "combating crime and protecting the United States."

There's a huge backlog of untested DNA waiting for CODIS-qualified lab analysis. Offloading some of the work to private labs or portable devices sounds like a great way ease that congestion, but it actually could create more problems. If the government believes that only its chosen labs are capable of producing solid analysis, fixes like those suggested by three California Congressional reps would ask law enforcement (including the FBI) to decide which evidence goes the Gold Standard labs and what gets passed along to the lesser, unproven venues.

When presented with this set of options, law enforcement may prioritize cases badly, routing "time-sensitive" evidence through unproven but quicker analysis while sending out anything that can "wait" to the government's labs. Basically, without an across-the-board certification of all methods (with rigid testing and re-testing to ensure quality) as being equal, there's a good chance collected DNA will be treated just as prejudicially as the suspects themselves. And, if the expansion of CODIS inputs isn't handled with rigorous oversight, the chances of the guilty going free and the innocent being imprisoned increases.

Filed Under: biometrics, dna, doj, fbi, next generation identification, ngi, privacy

Scammers Using FBI And NSA Logos, Claiming Legal Actions And Demanding Payment Via GreenDot MoneyPak

from the the-latest-iteration dept

A few weeks ago, I first heard about a scam in which scammers were calling up unsuspecting people, claiming to be the IRS and saying that the recipient had failed to pay taxes and was at risk of arrest if they didn't pay up quickly. The caller demands that the money be sent via a "GreenDot MoneyPak," which is basically the equivalent of cash. Scams like this have been going on for a while now -- just do a simple Google search on "scam, greendot" and you'll find a lot of results. Most recently, the scam has focused either on the IRS, as mentioned above, or local utilities, with threats about turning off your power, phone, etc. New York City even put out an alert directly warning about GreenDot MoneyPak scams.

However, it appears that the scammers have recently attempted to move on from just the IRS and utilities -- to two appealing alternative options: the NSA and the FBI. Lawyer David Gingras apparently spotted the FBI version upon visiting a website recently: Apparently, at least some of these are appearing because of a virus that tries to make it look like the FBI locked up your computer. I particularly like the three reasons why your computer might have been locked up: First up is copyright infringement -- which does note "Article I, Section 8, Clause 8" (though later it says "Cause 8"), which is the Constitution's copyright clause, but here it's nonsensically described as "the Copyright of the Criminal Code of the United States of America," and then there's this, which is so obviously not written by someone fluent in English: "provides for a fine of two to five hundred minimal wages or a deprivation of liberty for two to eight years." Then there's the inevitable claim of child porn (though this calls it "child porno" and "article 202 of the Criminal Code"). You'd think for all the effort put into this, they'd at least look up the relevant laws. Finally, my favorite: they point out (somewhat accurately) that you might have malware on your computer, and then say, "thus you are violating the law on Neglectful Use of Personal Computer." Perhaps that's the most accurate, except that the fine here is paid for stupidity rather than any actual criminal violation.

Here's another version, using the DOJ's logo: I find it vaguely amusing that all of these scammers highlight the store logos where you can conveniently buy a GreenDot MonkeyPak to help out with the scam.

Malwarebytes claims that it's seen one of these scams with the CIA logo as well. However, on Friday, the issue apparently became so serious that the NSA put out an announcement about the scam using its logo:

The NSA/CSS is aware of a computer malware scam using the NSA/CSS seals and banner. Victims of this malware report that a pop-up or a locked Internet browser alerts them that they have violated the law and/or are being monitored. The scam may also request that victims pay a fine. This activity and the associated alerts have no affiliation to the federal government, NSA included, and no money should be paid to the scammers. Victims should consult a computer professional on how to address the computer infection. Victims may also contact the Internet Crime and Complaint Center, a partnership between the FBI and National White Collar Crime Center that accepts Internet-related criminal complaints. For more information about malware, users can review the NIST Guide to Malware Incident Prevention and Handling.

Of course, it's no surprise that with all of the reports of NSA and FBI surveillance and abuse, that scammers would jump on the opportunity to make use of that fear in their efforts. That said, I would imagine that targeting the FBI -- which actually does investigate cybercrime -- might not be that wise of a decision for the scammers.

Filed Under: fbi, greendot, irs, malware, money, moneypak, nsa, scams

Nine Epic Failures Of Regulating Cryptography

from the and-yet-they-try-again dept

They can promise strong encryption. They just need to figure out how they can provide us plain text. - FBI General Counsel Valerie Caproni, September 27, 2010

[W]e're in favor of strong encryption, robust encryption. The country needs it, industry needs it. We just want to make sure we have a trap door and key under some judge's authority where we can get there if somebody is planning a crime. - FBI Director Louis Freeh, May 11, 1995

Here we go again.  Apple has done (and Google has long announced they will do) basic encryption on mobile devices. And predictably, law enforcement has responded with howls of alarm.

We've seen this movie before.  Below is a slightly adapted blog post from one we posted in 2010, the last time the FBI was seriously hinting that it was going to try to mandate that all communications systems be easily wiretappable by mandating "back doors" into any encryption systems.  We marshaled eight "epic failures" of regulating crypto at that time, all of which are still salient today.  And in honor of the current debate, we've added a ninth: 

. . .

If the government howls of protest at the idea that people will be using encryption sound familiar, it's because regulating and controlling consumer use of encryption was a monstrous proposal officially declared dead in 2001 after threatening Americans' privacy, free speech rights, and innovation for nearly a decade. But like a zombie, it's now rising from the grave, bringing the same disastrous flaws with it.

For those who weren't following digital civil liberties issues in 1995, or for those who have forgotten, here's a refresher list of why forcing companies to break their own privacy and security measures by installing a back door was a bad idea 15 years ago:

1. It will create security risks. Don't take our word for it. Computer security expert Steven Bellovin has explained some of the problems. First, it's hard to secure communications properly even between two parties. Cryptography with a back door adds a third party, requiring a more complex protocol, and as Bellovin puts it: "Many previous attempts to add such features have resulted in new, easily exploited security flaws rather than better law enforcement access."It doesn't end there. Bellovin notes:
   

   Complexity in the protocols isn't the only problem; protocols require computer programs to implement them, and more complex code generally creates more exploitable bugs. In the most notorious incident of this type, a cell phone switch in Greece was hacked by an unknown party. The so-called 'lawful intercept' mechanisms in the switch — that is, the features designed to permit the police to wiretap calls easily — was abused by the attacker to monitor at least a hundred cell phones, up to and including the prime minister's. This attack would not have been possible if the vendor hadn't written the lawful intercept code.

   More recently, as security researcher Susan Landau explains, "an IBM researcher found that a Cisco wiretapping architecture designed to accommodate law-enforcement requirements — a system already in use by major carriers — had numerous security holes in its design. This would have made it easy to break into the communications network and surreptitiously wiretap private communications."

   The same is true for Google, which had its "compliance" technologies hacked by China.

   This isn't just a problem for you and me and millions of companies that need secure communications. What will the government itself use for secure communications? The FBI and other government agencies currently use many commercial products — the same ones they want to force to have a back door. How will the FBI stop people from un-backdooring their deployments? Or does the government plan to stop using commercial communications technologies altogether?

2. It won't stop the bad guys. Users who want strong encryption will be able to get it — from Germany, Finland, Israel, and many other places in the world where it's offered for sale and for free. In 1996, the National Research Council did a study called "Cryptography's Role in Securing the Information Society," nicknamed CRISIS. Here's what they said:
   

   Products using unescrowed encryption are in use today by millions of users, and such products are available from many difficult-to-censor Internet sites abroad. Users could pre-encrypt their data, using whatever means were available, before their data were accepted by an escrowed encryption device or system. Users could store their data on remote computers, accessible through the click of a mouse but otherwise unknown to anyone but the data owner, such practices could occur quite legally even with a ban on the use of unescrowed encryption. Knowledge of strong encryption techniques is available from official U.S. government publications and other sources worldwide, and experts understanding how to use such knowledge might well be in high demand from criminal elements. — CRISIS Report at 303

   None of that has changed. And of course, more encryption technology is more readily available today than it was in 1996. So unless the goverment wants to mandate that you are forbidden to run anything that is not U.S. government approved on your devices,  they won't stop bad guys from getting  access to strong encryption.

3. It will harm innovation. In order to ensure that no "untappable" technology exists, we'll likely see a technology mandate and a draconian regulatory framework. The implications of this for America's leadership in innovation are dire. Could Mark Zuckerberg have built Facebook in his dorm room if he'd had to build in surveillance capabilities before launch in order to avoid government fines? Would Skype have ever happened if it had been forced to include an artificial bottleneck to allow government easy access to all of your peer-to-peer communications?This has especially serious implications for the open source community and small innovators. Some open source developers have already taken a stand against building back doors into software.
4. It will harm US business. If, thanks to this proposal, US businesses cannot innovate and cannot offer truly secure products, we're just handing business over to foreign companies who don't have such limitations. Nokia, Siemens, and Ericsson would all be happy to take a heaping share of the communications technology business from US companies. And it's not just telecom carriers and VOIP providers at risk. Many game consoles that people can use to play over the Internet, such as the Xbox, allow gamers to chat with each other while they play. They'd have to be tappable, too.
5. It will cost consumers. Any additional mandates on service providers will require them to spend millions of dollars making their technologies compliant with the new rules. And there's no real question about who will foot the bill: the providers will pass those costs onto their customers. (And of course, if the government were to pay for it, they would be using taxpayer dollars.)
6. It will be unconstitutional.. Of course, we wouldn't be EFF if we didn't point out the myriad constitutional problems. The details of how a cryptography regulation or mandate will be unconstitutional may vary, but there are serious problems with nearly every iteration of a "no encryption allowed" proposal that we've seen so far. Some likely problems:
   • The First Amendment would likely be violated by a ban on all fully encrypted speech.
   • The First Amendment would likely not allow a ban of any software that can allow untappable secrecy. Software is speech, after all, and this is one of the key ways we defeated this bad idea last time.
   • The Fourth Amendment would not allow requiring disclosure of a key to the backdoor into our houses so the government can read our "papers" in advance of a showing of probable cause, and our digital communications shouldn't be treated any differently.
   • The Fifth Amendment would be implicated by required disclosure of a private papers and the forced utterance of incriminating testimony.
   • Right to privacy. Both the right to be left alone and informational privacy rights would be implicated.
7. It will be a huge outlay of tax dollars. As noted below, wiretapping is still a relatively rare tool of government (at least for the FBI in domestic investigations -- the NSA is another matter as we now all know). Yet the extra tax dollars needed to create a huge regulatory infrastructure staffed with government bureaucrats who can enforce the mandates will be very high. So, the taxpayers would end up paying for more expensive technology, higher taxes, and lost privacy, all for the relatively rare chance that motivated criminals will act "in the clear" by not using encryption readily available from a German or Israeli company or for free online.
8. The government hasn't shown that encryption is a problem. How many investigations have been thwarted or significantly harmed by encryption that could not be broken? In 2009, the government reported only one instance of encryption that they needed to break out of 2,376 court-approved wiretaps, and it ultimately didn't prevent investigators from obtaining the communications they were after.This truth was made manifest in a recent Washington Post article written by an ex-FBI agent. While he came up with a scary kidnapping story to start his screed, device encryption simply had nothing to do with the investigation.  The case involved an ordinary wiretap. In 2010, the New York Times reported that the government officials pushing for this have only come up with a few examples (and it's not clear that all of the examples actually involve encryption) and no real facts that would allow independent investigation or confirmation. More examples will undoubtedly surface in the FBI's PR campaign, but we'll be watching closely to see if underneath all the scary hype there's actually a real problem demanding this expensive, intrusive solution.
9. Mobile devices are just catching up with laptops and other devices.  Disk encryption just isn't that new. Laptops and desktop computers have long had disk encryption features that the manufacturers have absolutely no way to unlock. Even for simple screen locks with a user password, the device maker or software developer doesn't automatically know your password or have a way to bypass it or unlock the screen remotely.Although many law enforcement folks don't really like disk encryption on laptops and have never really liked it, and we understand that some lobbied against it in private, we haven't typically heard them suggest in public that it was somehow improper for these vendors not to have a backdoor to their security measures.That makes us think that the difference here is really just that some law enforcement folks think that phones are just too popular and too useful to have strong security.  But strong security is something we all should have.  The idea that basic data security is just a niche product and that ordinary people don't deserve it is, frankly, insulting.  Ordinary people deserve security just as much as elite hackers, sophisticated criminals, cops and government agents, all of whom have ready access to locks for their data.  

The real issue with encryption may simply be that the FBI has to use more resources when they encounter it than when they don't. Indeed, Bellovin argues: "Time has also shown that the government has almost always managed to go around encryption." (One circumvention that's worked before: keyloggers.) But if the FBI's burden is the real issue here, then the words of the CRISIS Report are even truer today than they were in 1996:

It is true that the spread of encryption technologies will add to the burden of those in government who are charged with carrying out certain law enforcement and intelligence activities. But the many benefits to society of widespread commercial and private use of cryptography outweigh the disadvantages.

The mere fact that law enforcement's job may become a bit more difficult is not a sufficient reason for undermining the privacy and security of hundreds of millions of innocent people around the world who will be helped by mobile disk encryption.  Or as Chief Justice of John Roberts recently observed in another case rejecting law enforcement's broad demands for access to the information available on our mobile phones:   "Privacy comes at a cost."  

Reposted from the Electronic Frontier Foundation's Deeplinks Blog

Filed Under: cryptography, encryption, fbi, fud, mobile

FBI Director Angry At Homebuilders For Putting Up Walls That Hide Any Crimes Therein

from the wtf dept

We already wrote about how law enforcement was freaking out over the (good) news that Apple and Google were making encryption a default on both iOS and Android. Then we had a followup where a recently retired FBI guy insisted that such encryption would have meant a kidnap victim died... until everyone pointed out that the entire premise of that story was wrong and the Washington Post had to change the entire thing. We had hoped that, maybe, just maybe the misguided whining and complaining wouldn't come from those in charge, but apparently that's not happening.

On Thursday, FBI boss James Comey displayed not only a weak understanding of privacy and encryption, but also what the phrase "above the law" means, in slamming Apple and Google for making encryption a default:

"I am a huge believer in the rule of law, but I am also a believer that no one in this country is above the law," Comey told reporters at FBI headquarters in Washington. "What concerns me about this is companies marketing something expressly to allow people to place themselves above the law."

[....]

"There will come a day -- well it comes every day in this business -- when it will matter a great, great deal to the lives of people of all kinds that we be able to with judicial authorization gain access to a kidnapper's or a terrorist or a criminal's device. I just want to make sure we have a good conversation in this country before that day comes. I'd hate to have people look at me and say, 'Well how come you can't save this kid,' 'how come you can't do this thing.'"

First of all, nothing in what either Apple or Google is doing puts anyone "above the law." It just says that those companies are better protecting the privacy of their users. There are lots of things that make law enforcement's job harder that also better protect everyone's privacy. That includes walls. If only there were no walls, it would be much easier to spot crimes being committed. And I'm sure some crimes happen behind walls that make it difficult for the FBI to track down what happened. But we don't see James Comey claiming that homebuilders are allowing people to be "above the law" by building houses with walls.

"I get that the post-Snowden world has started an understandable pendulum swing," he said. "What I'm worried about is, this is an indication to us as a country and as a people that, boy, maybe that pendulum swung too far."

Wait, what? The "pendulum" hasn't swung at all. To date, there has been no legal change in the surveillance laws post-Snowden. The pendulum is just as far over towards the extreme surveillance state as it has been since Snowden first came on the scene. This isn't the pendulum "swinging too far." It's not even the pendulum swinging. This is just Apple and Google making a tiny shift to better protect privacy.

As Christopher Soghoian points out, why isn't Comey screaming about the manufacturers of paper shredders, which similarly allow their customers to hide papers from "lawful surveillance?"

But, of course, the freaking out continues. Over in the Washington Post, there's this bit of insanity:

“Apple will become the phone of choice for the pedophile,” said John J. Escalante, chief of detectives for Chicago’s police department. “The average pedophile at this point is probably thinking, I’ve got to get an Apple phone.”

Um. No. That's just ridiculous. Frankly, if pedophiles are even thinking about encryption, it's likely that they already are using one of the many encryption products already on the market. And, again, this demonizing of encryption as if it's only a tool of pedophiles and criminals is just ridiculous. Regular everyday people use encryption every single day. You're using it if you visit this very website. And it's increasingly becoming the standard, because that's just good security.

Filed Under: crime, encryption, fbi, james comey, john escalante, mobile encryption, overreaction

FBI's Biometric Program Blends Criminal And Non-Criminal Data For 'Efficiency,' Obsessed With Tracking Care Providers

from the not-discussed?-privacy-impact-or-unintended-consequences dept

As was noted here earlier, the FBI's Next Generation Identification (NGI) system has rolled out, pretty much right on schedule and well ahead of the Privacy Impact Assessment it hasn't updated since the announcement of the "system upgrade" back in 2008.

EPIC has obtained another load of documents from an FOIA request dealing with the "Rap Back" portion of the NGI system, one that provides constant monitoring of certain people -- like suspected criminals, people on parole, employees with security clearances and "trusted positions." Notably, the Rap Back program does not track employees of the criminal justice system, and nothing in what's been obtained even suggests it can be used that way.

The FOIAed documents run 202 pages [pdf link] with tons of duplicate presentation slides and long lists of fully-withheld documents. As is par for the course with sloppy fulfillments like these, the redactions are inconsistent, raising questions about the legitimacy of the exemptions used to justify removal in one place but not another. For instance, two back-to-back copies of the same slide show the FBI has an interest in redacting "DHS" [using exemption b7(e) -- "disclosure of techniques and procedures for law enforcement investigations"], but not a consistent interest.




Elsewhere, the FBI goes into more specifics as to who's included in the term "trusted positions" -- something it offers a lifetime of active monitoring for if that's what the "customer" wishes.

It is imperative that the FBI maintain a complete CHRI database in order to provide customers with information necessary to make informed decisions regarding the backgrounds of individuals whether for criminal justice purposes, noncriminal justice purposes for employment, licensing, and gun permit matters, or for purposes of national and international security. Disposition data is information pertaining to the resolutions of arrest charges or the custody or supervisory status of subjects subsequent to convictions. Disposition data is the core of the criminal history database.

Further details indicate that "trusted positions" are actually just a variety of caretakers, rather than those in positions that contain a healthy mixture of power and access (i.e., law enforcement members).

Availability of complete computerized criminal records is vital for criminal investigations, prosecutorial charging, sentencing decisions, correctional supervision and release, and background checks for licensing, purchasing of handguns, and applying for child-care positions or other responsibilities involving children, the elderly, and the disabled.

While it is definitely preferable to have someone with a clean record providing caretaking services, you have to wonder why the FBI is so focused on monitoring this specific group of employees. There's been a push to include this group in its Rap Back program pretty much since the beginning. Further down in the document, presentation slides suggest making inroads with legislators to turn the FBI's monitoring preference into an integral part of federal law.


The FBI wants officials to target legislators as "champions" and includes documentation on existing and upcoming legislation where wording could be inserted to make participation in Rap Back mandatory.

Bill Name: No Child Left Behind Act of 2007
Designation: S1775
Sponsor: Richard Burr 07/12/07
Cosponsor: 0-D, l-R (as of 08/24/07)

Sections 4222 and 4223 would require the Office of Justice Programs to develop model screening guidelines to include a criminal background check. The Secretary of Education is authorized to award grants to those entities that have conducted background checks on mentors in accordance with these guidelines. The bill does not indicate how these checks would be conducted.

Bill Name: Patient Safety Abuse Prevention Act of 2007
Designation: 1577
Sponsor: Herb Kohl 06/07/07
Cosponsor: (as of 08/24/07)

Section 3 of the bill expands the pilot program, as established under Section 307 of the Medicare Prescription Drug, Improvement, Modernization Act of 2003, to be conducted on a nationwide basis. Section 4 of the bill requires a state and FBI fingerprint criminal history background check on direct patient access applicants and employees of skilled nursing facilities and long-term care facilities. It also requires the state to develop "rap back capability. Section 5 also requires the FBI to develop "rap back" capability by January 1, 2011. The FBI would only be authorized to charge the actual costs of conducting the criminal history background check.

Elsewhere, the documents note that the FBI will be mixing its criminal and noncriminal databases -- for efficiency.

The existing LAFIS criminal and civil repositories are maintained as separate and distinct databases that do not allow for the automated transfer of records among repositories. The proposed IAFIS design change combines the records from the civil and criminal repositories into an interoperable repository. The repository design will facilitate the transition, search, addition, consolidation, modification, expungement, response generation, and file maintenance of criminal and civil information; provide the ability to search the civil records with remote latent fingerprint submissions; and support user required fingerprint search and notification capabilities. With this initiative, the records from the civil and criminal repositories will be maintained in one interoperable repository.

It also notes that in order to keep its fingerprint database up to date, it will need to pull from civil fingerprint records.


And, finally, sitting by itself, unduplicated anywhere else in the 202 duplicate-ridden pages, is a single slide dedicated to mandatory privacy considerations -- neither of which have been fulfilled even though the program is now fully operational.


There's no discussion included as to why the FBI is so focused on including caretakers and childcare providers in its lifelong monitoring program. In terms of its other stated interests (national security/counterterrorism, support for law enforcement), this seems like a much lower-level concern. While these positions would ideally be filled by citizens with clean records, constant updates from the criminal justice system seems a bit much -- especially when good employees may be forced out of work for unrelated infractions, like being arrested for exercising their First Amendment rights (filming public officials, attending protests) or marijuana possession.

It is notable that a legislative attempt to make this sort of monitoring mandatory for government contractors providing security services in war zones was shot down by the executive branch (p. 143). Apparently, it's more important to track caretakers than it is to ensure those operating security teams overseas (with a minimum of oversight) aren't former (or current) felons.

In all of the pages released, nothing deals directly with the program's privacy impact or its deliberate exclusion of criminal justice employees. No concerns are raised and no suggestions are made that law enforcement entities might do well to include their officers in the Rap Back monitoring system. And, even though the documents range from 2008-2011, there are no updated statistics that suggest the facial monitoring software has improved over its 20% error rate. Presumably, it has, but the FBI seems to feel the error rate isn't worth discussing (or releasing), even though that program actually went live in a four-state rollout three years ago.

The mixing of civil and criminal data should be the biggest concern, especially if the program pulls potential mug shots from both when seeking matches for facial recognition. There's a good reason to keep these separate. Blending both for efficiency's sake only makes the existing problem -- law enforcement's disinterest in ensuring that arrestees that were never charged or had records expunged are removed from the system -- even worse. Now, when Rap Back notifications are delivered, they have a higher potential to return data on noncriminals.

Filed Under: biometrics, fbi, next generation identification, ngi, privacy, rap back

Murder Case Prosecutors Claim 'National Security' To Stop Questions About FBI Examination Of Google Maps Search

from the coverups.gov dept

A Google Map search is seemingly the only piece of evidence tying former Cisco engineer Brad Cooper to the the murder of his wife, Nancy. According to his testimony, Cooper was at home with the couple's two daughters at the time his wife was strangled in a nearby park.

Nancy Cooper disappeared on July 12, 2008. That same day, Brad Cooper was questioned by local law enforcement. During the next couple of days, he consented to a search of his house and vehicle and turned over a pair of his wife's running shoes for dogs to track her scent. On July 14th, a body was discovered. This was confirmed to be Nancy Cooper the next day. Brad Cooper turned over the house to investigators that same day, moving out to "preserve" the house itself as evidence. He left behind his computer, which was still connected to the internet. This stayed on for 27 hours before investigators removed it.

Here's where it gets interesting. (An admittedly callous way to look at a situation where one person is dead, one is headed to jail and two kids are effectively parentless…)

The most damning evidence gathered by investigators (working with the FBI) was a Google search showing the exact spot where Nancy Cooper's body was discovered, supposedly performed by Brad Cooper the day before she was killed. This being the only evidence is a fact, rather than conjecture. It's acknowledged in the appeals court's decision which granted Cooper a new trial. [pdf link]

Prosecutors pressed hard with this discovery, coupling it with the fact that Cooper and his wife were observed arguing at a party the night before she vanished. The real story about this supposed search may never come out. Cooper pled guilty to reduced charges earlier this week, after being granted a new trial on appeal. Perhaps Cooper actually did murder his wife, but the key evidence being used against him was severely questionable, enough so that he was awarded another chance to fight the charge.

The 56-page opinion granting him a new trial details the previous court's unconstitutional "abuses," which led to a guilty verdict.

Cooper's defense attacked the supposedly damning search, alleging that it had been planted on the computer by investigators. Their first witness could likely have offered testimony indicating the search had been planted but the State called into question his expertise as a forensic expert and his testimony was prohibited by the court from covering this topic.

Cooper's defense tried to bring in another witness, one more specifically-trained to testify on the specifics the court was demanding. This last-minute replacement, who had reached the same conclusion as the previous expert (that the search had "been placed on the hard drive [and] could not have been the result of normal internet activity"), but was prevented from doing so when the State objected to this "violation" of discovery rules (i.e., witness and testimony were not presented to the prosecution before the trial began).

The appeals court disagreed with the previous court's dismissal of the first expert witness. It argued that this witness was specifically trained to discover computer tampering, something a planted search result would fall under.

The Google Map files recovered from Defendant's laptop were perhaps the most important pieces of evidence admitted in this trial. We hold that the trial court abused its discretion in excluding Ward from testifying, relying on the State's own evidence, to his opinion that the Google Map files recovered from Defendant's laptop had been tampered with.

[...]

We hold, whether the error was constitutional or not, that erroneously preventing Defendant from presenting expert testimony, challenging arguably the strongest piece of the State's evidence, constituted reversible error and requires a new trial…

The appeals court also found that excluding the second witness because of discovery violations was also unconstitutional, noting that using procedural issues to deny the defendant a chance to defend against the single, most important piece of evidence is a deprivation of due process.

In light of the lack of willful misconduct on the part of Defendant, the rational reason presented for failing to inform the State before trial that Defendant would be calling [the new witness], the role of the State in having this situation arise after the trial had commenced, the fundamental nature of the rights involved, the importance to the defense of the testimony excluded, and the minimal prejudice to the State had the trial court imposed a lesser sanction – such as continuance or recess, we hold that imposing the harsh sanction of excluding Masucci from testifying constituted an abuse of discretion.

The third key issue leading to Cooper being awarded the new trial is the most interesting -- a motion made to limit discovery with assistance from the FBI. Cooper's team tried to get the State to turn over information related to the means and methods used during its forensic search of Cooper's computer and found itself being denied on "national security" grounds.

The State filed a motion in opposition, arguing that there exists "a law enforcement sensitive qualified evidentiary privilege" which should act to prevent discovery of these items, "because such disclosure could lead to the development of countermeasures to FBI investigative techniques. Such countermeasures could defeat law enforcement's ability to obtain forensic data in criminal cases." The State also argues that this information was protected as "work product."

The trial court agreed.

The trial court found as fact "[t]hat the FBI's Standard Operating Procedures and policies are the same techniques and tools that are used in counterterrorism and counterintelligence investigations[.]" The trial court concluded that "under the provisions of N.C. Gen. Stat. §15A-903, patterned after Federal Rule of Criminal Procedure 16, the disclosure of the information sought by... Defendant would be contrary to the public interest in the effective functioning of law enforcement[,]" and that "under the provisions of N.C. Gen. Stat. § 15A-908[,]" disclosure of the information would result in "substantial risk" of harm to "any person, including the citizens of this State, of physical harm."

As the appeals court pointed out, there was no reason to completely deny discovery. The documentation could have been reviewed in camera for any potential national security issues, or allowed certain redactions to be made. It also pointed out that even the FBI's stated national security concerns don't necessarily preclude discovery.

Even in the face of a compelling State interest in keeping records confidential, due process might compel discovery, depending on how material the records are to a defendant's defense.

In this case -- with the "sole piece of evidence" being a questionable Google Maps search -- discovery was extremely material and possibly exculpatory. But the trial court wouldn't even allow the defense to ask whether revealing the forensic method used to "recreate" the map search would have national security implications.

MR. KURTZ: Well, Judge, there is potentially a piece of information that exists on Mr. Cooper's computer that could say definitely that this material was planted, absolutely definitive. I may be wrong. Special Agent Johnson's testing may indeed be that it all has the exact same millisecond all the way across. I don't think I'm wrong. Now, one way or the other, whether it's having a -- a test done on a Vista machine now and seeing what it -- what it actually shows or giving us access to the original test data, which I don't believe has any national security ramifications since it deals with a Google Map test. One way or the other, we should be entitled to this information as it could be tremendously exculpatory.

THE COURT: Upon reconsidering this issue about this in-court test, pursuant to Rule 53-403, I'm going to sustain the objection and exclude any testing in Court because of the differences in the equipment and the statements made by this witness that this is not the appropriate place to do it. We need to bring the jury back in. And regarding the national security issue, that is a matter that we have already ruled on. It is something I have already dealt with.

MR. KURTZ: But, Your Honor, there is a witness on the stand that can answer specifically whether this is an issue of national security. And I'm not even going to be allowed to ask that question?

THE COURT: I believe I've already determined, because of the rules of the -- and the discovery process that you are not entitled to get those things.

MR. KURTZ: So my understanding is, the -- the rules and the discovery process, we're hiding behind national security on an issue where we could get a clear answer from a witness that this is not in fact a national security issue. And we're talking about a piece of information that could be exculpatory to Mr. Cooper.

Further on, Cooper's defense presses the issue further, veering into exasperated sarcasm, only to be shut down again.

THE COURT: It's the methodology that they used, I think, that falls under the security issue, but –

MR. KURTZ: But if I could ask Special Agent Johnson if he has any national security concerns related to that methodology, we might be able to determine that this one particular test is a legitimate one to be disclosed, that it will not actually disclose the missile codes.

[...]

THE COURT: The objection is sustained. I'm not going to allow further questioning in this line or any in-court testing of that computer.

This shut-down of discovery was the third factor prompting the decision to grant Cooper a new trial. Not that it matters. As stated earlier, Cooper has opted to plead guilty, perhaps because the lighter sentence could see him freed in another six years or so, as well as possibly give him the chance to be visited by his family members. It may also be that his new trial was being handled by a public defender who wasn't familiar with the details, rather than his previous legal team. There are a lot of factors to weigh, and even innocent people have been known to cop a plea rather than keep on fighting. It's been more than six years since Brad Cooper was arrested. He may spend less time in jail than he has fighting these charges.

None of the above is meant to imply that Cooper is definitely innocent, but the key piece of evidence is very questionable. Even without the FBI's "national security" intercession, the State has been very reluctant to turn over any information about its examination of Cooper's computer. An anonymous blogger who has been tracking this case notes that those who examined the computer made two different statements about the presence of a "cookie" verifying the Google Maps search.

Cooper's computer contained cookies for every day except the day the search was to alleged to have occurred. The forensic examination of the computer turned up no evidence of the cookie being deleted, as testified by the FBI's Agent Johnson. It simply wasn't there. The FBI could have subpoenaed Google for the information regarding this search but never did, even though it requested other information from the search giant.

Agent Chappell, on the other hand, offered up two different stories in court documents. In the report stating that the FBI had found no evidence that Cooper's computer had been tampered with, he says that "we have an index.history.dat file the week of 7/11 that corroborates the visit to maps.google.com and a cookie for the visit."

But in his testimony, he states the opposite. Chappell was unable to find the cookie corroborating the visit in "allocated or recovered deleted." In fact, Chappell could find "nothing from this side."

Futhermore, it appears law enforcement may have attempted to "wait out" Google's privacy policy, which states that information is only retained for 18 months.

In May ’09 …. 10 months after the crime, Howard Kurtz, Brad’s defense attorney contacted Agent Johnson and asked him if he could obtain a copy of the hard drive and Johnson informed him that he was finished and that he could pick up a copy that day. Hours later, Detective Daniels contacted Brad’s attorneys and informed them that ADA Howard Cummings would not release the hard drive to them. No reason was given, no timing was given. They wouldn’t receive it until after the privacy policy had expired, making it too late to ever verify the search through Google cookies.   Because they received the Defense “preservation of evidence” letter, the prosecution knew that they would miss this privacy deadline.

There's more. According to the defense's examination of the hard drive, dozens of files were altered during its stay with local law enforcement. A police officer charged with recovering information from Nancy Cooper's Blackberry destroyed it instead, possibly inadvertently. This happened nine days after the preservation order in 2008. The defense wasn't informed of this fact until shortly before the trial began in 2011.

But in the middle of it all is the FBI. While the FBI may not have tampered with Cooper's computer, the simple fact is that any law enforcement agency can ask for the FBI's help in matters like this and use the feds' "national security" shield to withhold certain information from the defense. The appeals court chastised the trial court for indulging the FBI's secrecy, but many, many courts will swiftly defer, even if it means the withholding of possibly exculpatory evidence. That's the very troubling side effect of the FBI's dalliance in national security, something it has focused more and more of its efforts on over the past several years. It can assist law enforcement, like it always has, and use its "higher calling" to shroud itself and those it helps in secrecy.

Filed Under: brad cooper, doj, evidence, fbi, google maps, murder, national security, search

FUD: Former FBI Guy Lies, Claiming New Mobile Encryption Would Have Resulted In Dead Kidnap Subject

from the uh,-no dept

Yesterday, we wrote about law enforcement freaking out over the announcements from both Apple and Google that they'd start encrypting phones by default, better protecting data on those phones from anyone who wants it -- whether government/law enforcement or hackers. We noted, oddly, that former FBI guy Ronald Hosko had showed up in articles in both the Washington Post and the WSJ spewing a bunch of FUD about it. In the WSJ:

The level of privacy described by Apple and Google is "wonderful until it's your kid who is kidnapped and being abused, and because of the technology, we can't get to them,'' said Ronald Hosko, who left the FBI earlier this year as the head of its criminal-investigations division. "Who's going to get lost because of this, and we're not going to crack the case?"

In the Washington Post:

Ronald T. Hosko, the former head of the FBI’s criminal investigative division, called the move by Apple “problematic,” saying it will contribute to the steady decrease of law enforcement’s ability to collect key evidence — to solve crimes and prevent them. The agency long has publicly worried about the “going dark” problem, in which the rising use of encryption across a range of services has undermined government’s ability to conduct surveillance, even when it is legally authorized.

“Our ability to act on data that does exist . . . is critical to our success,” Hosko said. He suggested that it would take a major event, such as a terrorist attack, to cause the pendulum to swing back toward giving authorities access to a broad range of digital information.

This is just blatant fear mongering, and not even close to realistic. But the Washington Post doubled down and let Hosko write an entire (and entirely bogus) story about how he helped save a kidnapped man from murder earlier this year and "with Apple's and Google's new encryption rules, he would have died." He accurately writes about a kidnapping in North Carolina, and how law enforcement tracked down the perpetrators, including by requesting and getting "the legal authority to intercept phone calls and text messages." Of course, here's the thing: nothing in this new encryption changes that. Transmitted content is unrelated to the encryption of stored content on the phones. It's the stored content that is being encrypted. It's kind of scary that a supposed "expert" like Hosko doesn't seem to comprehend the difference.

Either way, he insists that the encryption would have prevented this (it wouldn't). His story originally said:

Last week, Apple and Android announced that their new operating systems will be encrypted by default. That means the companies won’t be able to unlock phones and iPads to reveal the photos, e-mails and recordings stored within.

It also means law enforcement officials won’t be able to look at the range of data stored on the device, even with a court-approved warrant. Had this technology been used by the conspirators in our case, our victim would be dead. The perpetrators would likely be freely plotting their next revenge attack.

After some people pointed out how very, very, very wrong this is, Hosko or the Washington Post "updated" the story, but still makes the same basic claims:

Last week, Apple and Google announced that their new operating systems will be encrypted by default. Encrypting a phone doesn’t make it any harder to tap, or “lawfully intercept” calls. But it does limit law enforcement’s access to a data, contacts, photos and email stored on the phone itself.

Had this technology been in place, we wouldn’t have been able to quickly identify which phone lines to tap. That delay would have cost us our victim his life.The perpetrators would likely be freely plotting their next revenge attack.

Except, even the update is not true. As the AP's Ted Birdis notes, the affidavit in the case shows that the FBI used phone toll records and wiretaps to figure out the case, and didn't get access to any phones "until after [the] victim [was] safe."

In other words, Hosko's story is pure FUD. The new moves by these companies would not have meant the guy died. It wouldn't have impacted the story at all.

Meanwhile, as a massive post by Julian Sanchez notes, phone encryption products have been on the market for a while and if it was such a big problem we'd already know about it, but so far it's been pretty limited. In the entire US in 2013, there were nine cases where police claimed that encryption stymied their investigations. Furthermore, in the vast majority of cases where they came up against encryption, they were still able to crack it. So... the impact here is minimal.

But that apparently won't stop lies from the likes of Ronald Hosko.

Update: And... it appears that the Washington Post edited the story again to now make it accurate, but which also disproves the entire point of the story. Now the basic story is "we saved this guy... and mobile encryption would have done nothing to stop it, but it's a bad bad thing anyway." If Hosko couldn't get the very basics right, how could he be considered a credible person discussing this issue?

Filed Under: encryption, fbi, fud, kidnapping, mobile encryption, ronald hosko
Companies: apple, google

New Zealand Whistleblower Reveals He Was Told To 'Bury' Unflattering Info About The Gov't Spying On Dotcom

from the incredible dept

The list of incredible screwups concerning the investigation, raid and prosecution of Kim Dotcom in New Zealand is fairly incredible. At nearly every step of the way, we find out more and more about just how monumentally questionable the whole thing was. Frankly, I have no idea if what Dotcom did with Megaupload broke the law, but the indictment against him was filled with really questionable claims, the GCSB (local equivalent of the NSA) illegally spied on Dotcom and then deleted the evidence, the police sought to suppress images of the raid itself, and evidence was mishandled. Oh, and it was eventually revealed that customs officials agreed to share info on Dotcom with the FBI in the US to "buy... brownie points" with the FBI.

And, now a former high-ranking New Zealand Customs lawyer has said that he quit his job after he was ordered to "bury" information that made the New Zealand government look bad. Specifically, this is about that last point above -- the letter concerning the brownie points. Apparently, the New Zealand government didn't want that email to get out, despite it being required to be released under a freedom of information request (in New Zealand it's the Official Information Act). Curtis Gregorash, a lawyer in the Customs department was told directly not to release any such documents:

"Mr Taylor directed me to withhold all information and pass the same direction on to my team."

He said he was subjected to an internal investigation after releasing information about Dotcom sought by the NZ Herald through the Official Information Act. The information released saw Customs staff discuss earning "brownie points" by passing on Dotcom information to the FBI.

"Simpson Grierson [Dotcom's lawyers] had made several Privacy Act requests of the Government, some of which flowed through Customs, and decisions were made from ministerial level with Maurice Williamson directing Customs, 'Don't you dare release anything - nothing at all.'"

Gregorash apparently disobeyed these orders and released the "brownie points" letter -- as required by law -- and then faced an internal investigation, leading to him resigning in protest.

The "brownie points" OIA release to the Herald was the tipping point. "I got dragged over the coals for it. There was an investigation into me. I was cleared. I resigned after that."

He also seems to indicate that other documents that should have been released were withheld as well:

"All sorts of jokes and laughs and cut-downs that were being made by officials to each other were being withheld for [what he considered to be] no reason."

Gregorash had held onto the story for a while, but decided that it needed to be told.

Combined with everything else about this investigation and prosecution, it again makes you wonder what people were thinking. It still really feels like the DOJ and New Zealand officials all simply believed Hollywood's fanciful stories about Dotcom being "Dr. Evil" -- a cartoonish villain so bad that official and legal processes could be thrown out the window just to get him at any cost. Once again, it suggests that Hollywood and the DOJ officials who support it would be much better off actually taking the time to understand the nuances of the copyright debate, rather than their crude "piracy bad" level of understanding that they seem to have of it.

Filed Under: brownie points, copyright, coverup, curtis gregorash, customs, fbi, kim dotcom, new zealand, raid
Companies: megaupload

DOJ Proposal Would Let FBI Hack Into Computers Overseas With Little Oversight

from the freedom?-what-freedom? dept

Ahmed Ghappour, over at JustSecurity, alerts us to a rather frightening proposal from the Justice Department that would enable law enforcement to hack into the computers of people who are trying to be anonymous online. At issue is that current rules basically would extend the powers granted for terrorism investigations to everyday criminal investigations, concerning specifically the DOJ/FBI's ability to hack into computers. In the past, judges could issue warrants for such computer hacking if the target was known to be located in the same district. But the proposed change would wipe out that limitation, and basically give the DOJ/FBI the power to get approval for hacking into a much broader range of computers. Without the geographical limitation, there's concern about just how broadly this new power would be (ab)used:

The DOJ proposal will result in significant departures from the FBI’s customary practice abroad: overseas cyber operations will be unilateral and invasive; they will not be limited to matters of national security; nor will they be executed with the consent of the host country, or any meaningful coordination with the Department of State or other relevant agency.

Under the DOJ’s proposal, unilateral state action will be the rule, not the exception, in the event an anonymous target “prove[s] to be outside the United States.” The reason is simple: without knowing the target location before the fact, there is no way to provide notice (or obtain consent from) a host country until after its sovereignty has been encroached.

Without advanced knowledge of the host country, law enforcement will not be able to adequately avail itself to protocols currently in place to facilitate foreign relations. For example, the FBI will not be able to coordinate with the Department of State before launching a Network Investigative Technique. This puts the U.S. in a position where a law enforcement entity encroaches on the territorial sovereignty of foreign states without coordination with the agency in charge of its foreign relations.

In short, every new criminal investigation by the FBI will open up the possibility of a diplomatic nightmare and embarrassment. But, really, who cares when there are criminals to go after, right?

When a state’s sovereignty is encroached upon, its response depends on the nature and intensity of the encroachment. In the context of cyberspace, states (including the United States) have asserted sovereignty over their cyber infrastructure, despite the fact that cyberspace as a whole, much like the high seas or outer space, is considered a “global common” under international law.

[....] Given the public nature of the U.S. criminal justice system, it is hard to see how the FBI will avoid risk of prosecution (similar to that in the Chelyabinsk incident) if the DOJ proposal is approved.

The Chelyabinsk incident refers to involved Russia filing criminal hacking charges against the FBI for the FBI logging into a Russian server, seeking evidence against some Russian hackers.

And, of course, there are other issues with the proposal as well -- as you'd expect any time you see law enforcement seek to move anti-terrorism tools over to standard crime-fighting. For example, the current proposal could authorize questionable hacking techniques by the FBI. Ghappour suggests that if the DOJ really wishes to push forward with such a proposal, it needs to clearly limit the techniques that are allowed:

The Rule should not authorize drive-by-downloads that infect every computer that associates with a particular webpage, the use of weaponized software exploits in order to establish “remote access” of a target computer, or deployment methods that risk indiscriminately infecting computer systems along the way to the target. Nor should the Rule authorize a “search” method that requires taking control of peripheral devices (such as a camera or microphone).

There are other suggestions, of course. As it stands, the proposed amendment allows the FBI to use a wide array of invasive (and potentially destructive) hacking techniques where it may not be necessary to do so, against a broad pool of potential targets that could be located virtually anywhere.

Of course, why would the DOJ ever limit itself when it has the chance to get access to an even more powerful tool for hacking into anyone's computers?

Filed Under: anonymity, cooperation, diplomacy, doj, fbi, hacking, overseas, tor

FBI Rolls Out Biometric Database On Schedule, Accompanying Privacy Impact Assessment Still Nowhere To Be Found

from the move-along,-nothing-to-see-but-millions-of-faces dept

The FBI has just announced that all systems are go for its biometric database.

The Federal Bureau of Investigation (FBI) Criminal Justice Information Services (CJIS) Division announced today the achievement of full operational capability of the Next Generation Identification (NGI) System. The FBI’s NGI System was developed to expand the Bureau’s biometric identification capabilities, ultimately replacing the FBI’s Integrated Automated Fingerprint Identification System (IAFIS) in addition to adding new services and capabilities.

This puts the agency pretty much right on schedule for its stated goal of "full operational capacity in fiscal year 2014." As was to be expected from its earlier foot-dragging, the press release makes no note of the Privacy Impact Assessment that was supposed to precede the roll out.

The system itself has been in the works since 2008. Coincidentally, this is also the last time anyone at the FBI delivered a Privacy Impact Assessment. Since then, the database's sweep and power has increased immensely. The PIA promised in 2012 still hasn't been delivered and there's no indication at the FBI's website that one is right around the corner.

The release notes two other tools that will be folded into NGI.

As part of NGI’s full operational capability, the NGI team is introducing two new services: Rap Back and the Interstate Photo System (IPS). Rap Back is a functionality that enables authorized entities the ability to receive ongoing status notifications of any criminal history reported on individuals holding positions of trust, such as school teachers. Law enforcement agencies, probation and parole offices, and other criminal justice entities will also greatly improve their effectiveness by being advised of subsequent criminal activity of persons under investigation or supervision.

Rap Back sounds useful but its tracking of people in "trusted positions" does not include some very specific "trusted positions." This 2012 presentation on Rap Back [pdf] clearly delineates between "trusted" civilians and those exempt from ongoing criminal background monitoring.


Here's the relevant info in case you can't read/see the pic, Rap Back ongoing monitoring and notification service only targets these individuals.

Non-criminal justice applicants, employees, volunteers, and licensees;

Individuals under the supervision or investigation of criminal justice agencies.

Note that "supervision" doesn't mean employees of criminal justice agencies, but rather parolees and those on probation. Presumably, the criminal justice system will police itself, relying only on pre-employment screenings (if that). The problem is that employees with criminal history have been known to jump from agency to agency without their new employers knowing (or caring) about the incidents that forced the job change. Apparently, this is an acceptable situation despite the fact that the DOJ tends to ignore much of the misconduct that occurs in agencies under its command.

The Interstate Photo System sounds like license plates but is actually the FBI's facial recognition database. A high error rate and a flood of too-lo-res-to-be-useful photos hasn't stopped the FBI from pushing this system -- basically a searchable mug shot repository that includes millions of non-criminals just for the hell of it. To reach its lofty goals (52 million pics by 2015), the FBI is including generic federal employee records. The potential for the system to return non-criminals in searches for "candidates" remains high, but the FBI has reassuringly stated that it bears no legal responsibility if any of the 18,000 law enforcement agencies that have access arrest the wrong person.

An unvetted system that can be accessed by thousands is a huge problem. The FBI will join the NSA in hoarding massive amounts of irrelevant data with very little oversight. The hoarding mentality has taken over and everyone involved is hesitant to implement stringent minimization and disposal policies because of the irrational fear that something discarded might be needed later.

If and when the privacy assessment arises, I expect it will be filled with paragraphs that underplay the potential civil liberties violations, lots of explanations as to why there's no expectation of privacy in anything the government collects and some mumbling around the edges about minimization and access control.

While I realize that it's inevitable that the march of technology would lead to this sort of thing -- and while it does have several legitimate uses -- my biggest problem with these advances is that the FBI and others continually stress that it's the only way to keep up with evolving criminal behavior. The justifications deployed point to a constantly-rising criminal threat that has no basis in reality. I cannot buy into the narrative that the best way to combat crime (or terrorism, for that matter) is vast, untargeted databases.

The FBI focuses most of its assets on two opponents: drugs and terrorism. The first is exacerbated by years of bad legislation and policies, and for all the time and money spent, the war doesn't seem to be on the way to being won. The latter has devolved into the FBI's proprietary con game, wherein it sets up a mark or two and takes them down. Now, it's inviting the nation's law enforcement agencies to run searches on a database populated with non-hit data and leave them holding the bag when the inevitable occurs.

An updated privacy assessment isn't going to make this a better idea, especially when the FBI (and the law enforcement agencies that feed info to it) are blithely unconcerned that current background check databases are filled with people who were never criminally charged. An internal change is needed -- one that makes these agencies more accountable to the public for screwing up their lives. But no one up top is interested in fixing what's already broken. They just want to roll out new databases that grab more info. If the FBI insists this is the only way to fight crime effectively, then it needs to exercise the sort of vigilance and internal accountability it's never shown in the past. That starts with a detailed privacy assessment, delivered in a timely fashion. And it's already failed this small step.

Filed Under: biometric database, doj, fbi, fingerprints, privacy, privacy impact assessment