Will Jurisdictional Fight Slow Down CISPA's Momentum?

from the one-hopes dept

Thanks to a fair bit of propaganda making the rounds, it feels like CISPA -- the cybersecurity bill that seeks to obliterate privacy protections without explaining how that will increase our security -- is on a bit of a fast track towards approval. However a bit of a stumbling block may have popped up. Congressional Representatives Bennie Thompson and Yvette Clarke -- the ranking members on the Committee on Homeland Security and the Subcommittee on Cybersecurity, Infrastructure Protection and Security Technologies -- have suddenly realized that all of this is happening without their support. That is, they finally realized that, while this is being handled by the Intelligence Committee, it directly impacts Homeland Security and Cyersecurity (obviously), and so they're suddenly asking why it's not going through their committees.

This is just a basic jurisdictional dispute between various fiefdoms within Congress. They pop up every now and again, and usually get resolved in due time. However, in the short term, it could certainly represent a speed bump that hopefully slows down the pace at which Congress seems to want to rush into approving CISPA.

Filed Under: bennie thompson, cispa, congress, cybersecurity, homeland security, jurisdiction, momentum, yvette clarke

Homeland Security: Not Searching Your Laptop Doesn't Benefit Your Civil Liberties, So We Can Do It

from the interesting-4th-amendment-interpretation dept

We've written many times over the years concerning the legality of Homeland Security searching your laptop at the border without reasonable suspicion. Many courts have held that, effectively, the 4th Amendment does not apply at the border, so they don't need a warrant to search your laptop. However, they've been continually pushing this ability further and further. For example, they got a court to say that this applies not just while you're at the border -- they can take your laptop off site to search it and hang onto it for a while. However, that time, they at least needed to have a "reasonable suspicion." DHS has taken a pretty firm stand that it must be able to keep doing this. While the ACLU and the EFF and others keep challenging these rules, to date the only possible crack was in a case where there's evidence that the search was politically motivated.

Late last week, a bizarre finding popped up. Back in 2009, when DHS announced its new rules for laptop searches at the border, it also promised that it would do its own "Civil Liberties Impact Assessment" within 120 days. Three years later, Homeland Security's Orwellian "Office of Civil Rights and Civil Liberties" has finally released a two page executive summary of the findings, which more or less says "there are no civil liberties issues" with laptop searches. What else would you expect them to say? The ACLU has filed a FOIA request for the full report, but let's just focus on the most horrifying statement in the executive summary:

We conclude that CBP's and ICE's current border search policies comply with the Fourth Amendment. We also conclude that imposing a requirement that officers have reasonable suspicion in order to conduct a border search of an electronic device would be operationally harmful without concomitant civil rights/civil liberties benefits.

That statement is so bizarre I read it half a dozen times before I was sure it really said what it appears to say. It appears to be a somewhat stunning redefinition of how one reviews whether or not something violates the 4th Amendment. Rather than recognizing the rather explicit restrictions under the 4th Amendment, they merely say that it is okay to do these searches because not doing them would not have civil rights/civil liberties "benefits." That is incredible. The double negative logic there is truly amazing. In other words, we can violate the Constitution, so long as not doing so would not have civil liberties benefits. Wow.

Meanwhile, since Homeland Security has similarly argued (as part of these cases) that its Constitution Free zone for searches applies to any place 100 miles from the United States border, some are pointing out that this means that every electronic device -- computers, cell phones, you name it -- in Detroit can be searched with absolutely no reasonable suspicion under DHS's interpretation (since Detroit is less than 100 miles from Canada). But don't worry, since there is little civil liberties or civil rights benefits to not searching your stuff, DHS says it's okay.

Oh, and in case you're wondering on what basis DHS makes this assessment, it appears to be based on their own directives rather than on any "laws."

So, if you're playing along at home, DHS has decided, based on its own review of its own directives, that it can search any electronic device within 100 miles of the border without requiring a warrant, probable cause, reasonable suspicion or anything like that -- because actually respecting the Constitution "would be operationally harmful" and wouldn't really create any "civil rights/civil liberties benefits" for you.

Filed Under: 4th amendment, border searches, civil liberties, civil rights, homeland security, privacy

As Expected, ICE Seizes 313 Websites In Its Role As The NFL's Private Police Force

from the government-overreach dept

Earlier this week, we predicted that either today or tomorrow, we'd hear about ICE and the DOJ once again seizing a bunch of websites... and here it is. This morning, ICE announced that it had seized another 313 websites based on its highly questionable legal theory concerning taking down websites without any adversarial hearing. Of course, lately it's moved away from doing site seizures concerning websites that deal with content/copyright issues, and focused instead on those it claims are selling counterfeit merchandise. Along those lines, ICE announced that it arrested a few people with counterfeit Super Bowl merchandise.

Of course, this is all for show. Waiting until just a couple days before the Super Bowl is pretty ridiculous, since if people were going to buy merch, they already did so. This is just ICE, once again, generating headlines for the corporations it seems to think it represents. As is his usual MO, ICE boss John Morton talked up just how "successful" this operation was, based on his own metrics, claiming "This just takes good old-fashioned police work, people getting out on the streets."

Funny, then, that he completely leaves out the parts where they seized legitimate merchandise and hassled the seller. It appears that, sometimes, ICE just isn't very good at "good old-fashioned police work." And that's especially true when it seems to be taking orders from big companies, rather than the public it is supposed to be protecting.

Filed Under: counterfeiting, dhs, doj, domain seizures, homeland security, ice, merchandise, super bowl, trademark
Companies: nfl

Department of Homeland Security Unable To Define 'Homeland Security'

from the we-have-one-thing-to-do-and-that-is-[tbd] dept

The problem with large government agencies is "feature creep." If given a broad enough area to cover, years of territorial expansion and absorption of "related" entities will render the agency nearly unrecognizable from its original form. Not only that, but any stated directive or focus will have been lost, abandoned or hopelessly mutated as well.

If the government agency was crafted in "response" to a tragic event, the problem is both magnified and accelerated. As Wired reports, slightly more than a decade on from its formation, the Department of Homeland Security is having trouble defining the very thing it's in charge of.

What is “homeland security?” The federal bureaucracy doesn’t know, and that’s problematic for a government that has been fighting the ill-defined “war on terror” following 9/11, according to a new report from the Congressional Research Service.

In short, “homeland security” is whatever the government says it is.

Thirty federal entities — among them agriculture, education, labor, treasury and social security — are receiving “homeland security” funding. The actual Department of Homeland Security, created in the aftermath of 9/11, receives 52 percent of the “homeland security” money pie, according to the Tuesday report.

“Ten years after the September 11, 2001, terrorist attacks, the U.S. government does not have a single definition for homeland security,” the report said. “Currently, different strategic documents and mission statements offer varying missions that are derived from different homeland security definitions.”

The varied definitions given by the DHS and the White House still put the main focus on "terrorism," but others list "Homeland Security" responsibilities as including border/maritime security, immigration, natural disasters and "other hazards."

According to the Congressional Research Report, posted at Secrecy News, this lack of definition undermines the very "security" the agency is supposed to be providing.

“An absence of consensus about the inclusion of these policy areas may result in unintended consequences for national homeland security operations,” the CRS report [pdf] said. “For example, not including maritime security in the homeland security definition may result in policymakers, Congress, and stakeholders not adequately addressing maritime homeland security threats, or more specifically being able to prioritize federal investments in border versus intelligence activities.”

“The competing and varied definitions in these documents may indicate that there is no succinct homeland security concept. Without a succinct homeland security concept, policymakers and entities with homeland security responsibilities may not successfully coordinate or focus on the highest prioritized or most necessary activities.”

Part of the problem here is the large number of entities who receive funding under the "Homeland Security" banner. Trying to craft a unified front is nearly impossible as each entity has its own "mission statement" to justify its funding. Speaking of which, the report thinks the funding itself could be adding layers of fuzziness to the "homeland security" definition.

At the national level, there does not appear to be an attempt to align definitions and missions among disparate federal entities. DHS is, however, attempting to align its definition and missions, but does not prioritize its missions; there is no clarity in the national strategies of federal, state, and local roles and responsibilities; and, potentially, funding is driving priorities rather than priorities driving the funding.

Unsurprising, to say the least. This sort of normal government agency behavior does very little towards cutting through the vagueness surrounding it. This lack of clarity is the last thing you want to see in the DHS, either in its role as a "protector" or as a "respondent." This results in redundancy and inefficiency which hampers proactive and reactive measures, resulting in less of the safety and security the agency was created to provide.

Filed Under: homeland security, mission

DOJ Taking Down Sites For Infringement... While Infringing Content Is Available Via Its Own Network

from the look-at-that dept

Following on the story of IP addresses assigned to the major Hollywood studios using BitTorrent to distribute copyright-covered works, Torrentfreak and Scaneye are back pointing out that the same thing is true of all of the major labels and various parts of the US government. That last part is interesting, because they show that IP addresses assigned to the Justice Department, Homeland Security and Congress are all being used by people to distribute popular works covered by copyright. Here, for example, is just a snippet of the content being shared via IP addresses assigned to the Justice Department: Again, the same caveats to yesterday's article apply -- but the key issue remains. If the big content industry folks, along with government officials in the Justice Department are using evidence like IP addresses to make their case of infringement, it would seem like they ought to clean up their own homes first.

Filed Under: congress, dhs, doj, file sharing, homeland security, ip addresses, justice department
Companies: riaa

Obama Administration Quietly Allowed National Counterterrorism Center To Keep Database Of Info On Innocent Americans

from the total-information-privacy-breach dept

The arguments are still ongoing concerning whether or not Congress will reauthorize the FISA Amendments Act, which has enabled -- via a secret interpretation of the law, that even many members of Congress are not told about -- law enforcement to collect huge chunks of private info on Americans with no oversight or warrants. However, in a move that should raise significant concerns about allowing such widespread trolling of private info, a report in the Wall Street Journal by Julia Angwin uncovered that the Obama administration quietly changed the rules back in March concerning the National Counterterrorism Center -- allowing it to retain a giant database of information on innocent Americans. This was done over the objections of many in the administration, including the "Chief Privacy Officer" for the Department of Homeland Security.

The National Counterterrorism Center (NCTC) is where all intelligence agencies were told to send their leads, after it was determined that there was an intelligence failure that allowed the so-called underwear bomber, Umar Farouk Abdulmutallab, to get on a plane a few years ago. Then came some interagency squabbling over information:

Unfortunately, NCTC didn't have the resources to "exhaustively" pursue the torrent of leads it began receiving. So it fell behind. Late last year, after Homeland Security had given NCTC a database on condition that it purge the names of all innocent persons within 30 days, things came to a head. Homeland Security eventually revoked NCTC's access to the data and NCTC decided it needed to operate under different rules. In particular, it wanted unlimited access to all government agency information for as long as it needed it, including both suspects and non-suspects alike. In March, after discussion at the White House, Eric Holder granted their request.

In a separate blog post, Angwin breaks down the specific rule changes from the 2008 document to the 2012 document. They detail just how a system that was initially limited to protect privacy has now turned into the exact opposite of that. Among the rule changes: it used to require a focus on terrorism information. No longer. And then there are the following two changes:

Dropping the requirement to remove innocent U.S. person information. The 2008 guidelines required NCTC to remove US person information that is “not reasonably believed to be terrorism information.” In 2012, the guidelines were updated to allow NCTC to keep U.S. person information for “up to five years” and to “continually assess” the information to determine whether it constitutes terrorism information.

Adding the ability to do “pattern-based queries” of entire datasets. The 2008 guidelines explicitly prohibit analysts from conducting “pattern-based” queries that are not based on known terrorism datapoints. The 2012 guidelines explicitly allow pattern-based queries that are not based on known terrorism data points. Pattern-based queries are still prohibited for databases that NCTC has not copied in its entirety.

Or, as the original article noted:

Now, NCTC can copy entire government databases—flight records, casino-employee lists, the names of Americans hosting foreign-exchange students and many others. The agency has new authority to keep data about innocent U.S. citizens for up to five years, and to analyze it for suspicious patterns of behavior. Previously, both were prohibited.

This all comes out almost exactly a decade after it was revealed that the feds were planning a "Total Information Awareness" program to troll through all of its databases to try to hunt down evidence of terrorism at work. That resulted in widespread public backlash and an eventual backing down from the program. This time around, since the whole thing was debated outside of the public eye (and they didn't given it an Orwellian name -- or an equally creepy logo), apparently it's just fine.

But, if you actually believe in things like basic civil liberties, the 4th Amendment and a right to privacy, this is all downright scary. It's the type of stuff that we're told over and over again the US government isn't supposed to do. And then it goes and does it anyway.

Filed Under: database, homeland security, national counterterrorism center, nctc, obama administration, privacy, total information awareness

Homeland Security Pays San Francisco To Buy Surveillance Equipment That Records Video AND Audio On City Buses

from the surveillance-society dept

We all know that law enforcement has been regularly expanding its ability to spy on people at every turn, especially with surveillance cameras installed all over the place. But it still seems a bit shocking to find out that many municipalities are installing systems on public buses that record both audio and video of everyone on the bus -- including in San Francisco. That doesn't just seem like overkill, it raises significant legal questions. California -- for better or for worse (and I'd argue, for worse) is a two party consent state when it comes to recording, meaning everyone has to know they're being recorded. So it seems like recording without getting consent should be seen as an illegal, warrantless form of wiretapping. Even more troubling: the reason San Francisco is doing this upgrade? The Department of Homeland Security paid them to do it. It gave them a grant covering the entire cost. Is Homeland Security really worried about drunks getting into a brawl on the bus? Or do they see this as an opportunity to do significantly more involved surveillance? The whole program seems pretty troubling, and yet more and more places are adding the devices, with little to no public recognition.

Filed Under: buses, homeland security, san francisco, surveillance

What Do Sandy & Pearl Harbor Have In Common? Politicians Exploit Both To Push Cybersecurity Agendas

from the but-of-course dept

Defense Department boss Leon Panetta has been recycling his cyber Pearl Harbor ghost stories for a few years now to push for expansive cybersecurity legislation (i.e. budget and power to spy on people), but Pearl Harbor is a bit outdated these days. So why not shoot for a more contemporary reference? Why not something in the "now"? Well, Homeland Security boss Janet Napolitano (who's in a bit of a turf war with Panetta over who gets control -- again, budget and power to spy on people -- of "cybersecurity") has decided to go with the most contemporary possible reference: Hurricane Sandy. Apparently, to Napolitano, the answer to the question of "how soon is it appropriate to cynically abuse the story of Hurricane Sandy for political gain?" is "right away."

Napolitano, who, you may remember, doesn't know how the internet works, went to a cybersecurity event on Wednesday to warn that without cybersecurity legislation, an attack might be just as bad as Hurricane Sandy. Quoting a report from Hillicon Valley:

After Hurricane Sandy wreaked havoc on the East Coast, Napolitano said people should look than no further than the damage caused by the massive storm to understand the need to boost the nation's cybersecurity protections.

"One of the possible areas of attack, of course, is attacks on our nation's control systems — the control systems the operate our utilities, our water plants, our pipelines, our financial institutions," Napolitano said. "If you think that a critical systems attack that takes down a utility even for a few hours is not serious, just look at what is happening now that Mother Nature has taken out those utilities."

"The urgency and the immediacy of the cyber problem; the cyberattacks that we are undergoing and continuing to undergo can not be overestimated," she said.

I'd say that it's not so much the utility downtime that's been the problem with Hurricane Sandy compared to, say, the wind and the copious amounts of water falling from the sky and piling up on the ground. Last I checked, that can't be controlled via a computer (leaving wacky conspiracy theories aside).

As per usual, when it comes to cybersecurity threats, Napolitano (like pretty much every single other politician pushing for legislation) refused to get into specifics about how real any threat is -- other than to make scary "be afraid, be very afraid!" noises. The one time she was asked about a specific threat, she immediately went vague, but in full-on FUD mode:

When asked by Post editor Mary Jordan about whether hackers are stealing information or money from banks, Napolitano answered "yes" and then quickly added, "I really don't want to go into that per se."

"All I want to say is that there are active matters going on with financial institutions," she said.

Is it really so crazy to think that if the government is going to pass a bill that has broad implications for our privacy, they should at least come up with a legitimate and clear explanation for why it's needed? Instead they toss out scare stories about hackers stealing money, planes falling from skies and utilities shutting down -- without any proof that any of it is actually likely or possible.

Filed Under: cybersecurity, fud, grandstanding, homeland security, hurricane sandy, janet napolitano

DHS: Our Reports To Congress Are Successful Bullshit

from the yeah,-we-already-kinda-figured dept

Okay, it's official. I no longer believe that our Department of Homeland Security is an actual government agency with important work to do. No, I now believe that it is a series of highly subtle performance art pieces designed to make us laugh at the sheer audacity of dumb government. We already know about the agency's boss, who is in charge of cybersecurity, not bothering to use the internet. And then there is the DHS's highly touted fusion centers being both a waste of money and a detriment to the very freedoms they're supposedly protecting.

But Tim K writes in about a rather stunning admission by DHS officials of a bogus DHS report on a water pumping facility. It essentially amounts to: "sure the report is a complete lie, but it was a successful lie." Don't believe me?

Officials behind the false claims told Senate investigators that such reports weren’t meant to be “finished intelligence” and that despite their report’s inaccuracies and sloppy wording they considered it to be a “success.”

“[It did] exactly what it’s supposed to do – generate interest,” DHS officials told Senate investigators.

Now, let's do some quick background on this report, less because it informs you and more because it's hysterical. About a year ago, a water pump failed in an Illinois water facility. In response, almost immediately, an Illinois fusion center (part DHS, part Illinois State Police) circulated a report blaming a hacking attack from Russia. Not soon after that report was circulated, the greater DHS office rebuffed the fusion center's hacking allegation as absolute nonsense. It pointed out, as does the linked article, that the allegation was pure conjecture based on the fusion center's inability to do even the most basic investigation.

Someone did access the water district’s SCADA system from Russia, but it was a water district contractor who was asked to access the system by water district employees, as Wired first reported. They had called him to seek his opinion on something while he was on vacation in Russia, and he had logged into the system remotely to check on some data for them.

When the pump broke five months later and someone examined the network logs to determine the cause, they found an IP address from Russia listed in the logs next to the username and password of the contractor. No one ever bothered to call the contractor to see if he had logged in from Russia; they just assumed someone in Russia had stolen his credentials.

It's worth noting that the water pump busted 5 months after this Russian IP logged in. In other words, none of this makes a lick of sense, except if it's the case of someone looking for a convenient scapegoat. "Hackers! Russians!" is apparently what these people went with, for reasons unknown to this author.

But the DHS report circulated to Congress, which DHS says is a success even though it's bullshit, was written up after they called out their own fusion center for making stuff up. I think most reasonable people would suspect that such successful excriment is part of the fear mongering around so-called cyberwars and the trumped up need for Congress to pass some kind of cybersecurity bill. But even the least cynical person would at least expect the DHS to correct their report and alert Congress to the pure made-up-iness of it. DHS has thus far declined to do so, because, paraphrasing DHS itself, the lie is more effective than the truth. Yay, government!

Filed Under: congress, cybersecurity, dhs, fear mongering, fud, homeland security