The Latest Targets Of DHS Surveillance Are Journalists Who Published Leaked Documents

from the can't-secure-a-homeland-without-breaking-a-few-amendments dept

Is there anything the DHS can't turn into a debacle while pretending to secure the homeland? It would appear it's impossible for America's least essential security agency to move forward without stepping in something.

As protests in Portland neared the 60-day mark, the DHS was tasked with protecting federal property like courthouses and… um… statues. ICE, CBP, Federal Protective Services, and US Marshals all arrived in Portland ready to go to war with people exercising their First Amendment rights. You only have one chance to make a first impression, and the unidentified officers from unknown agencies throwing protesters into unmarked vehicles was one hell of a first impression.

The federal agencies went to war, firing tear gas and projectiles at protesters, rioters, journalists, and legal observers. It made no difference to the DHS which was which. But it did make a difference to a federal judge, who issued a temporary restraining order forbidding federal officers from attacking, gassing, assaulting, or arresting journalists and observers who were just trying to do their jobs.

The federal officers immediately violated the restraining order. Or, more accurately, they never stopped doing the stuff that earned them the restraining order in the first place. Apparently, the DHS feels it hasn't violated First Amendment rights hard enough. The latest black eye for the DHS is more targeting of journalists, this time with surveillance.

The Department of Homeland Security has compiled “intelligence reports” about the work of American journalists covering protests in Portland, Ore., in what current and former officials called an alarming use of a government system meant to share information about suspected terrorists and violent actors.

Over the past week, the department’s Office of Intelligence and Analysis has disseminated three Open Source Intelligence Reports to federal law enforcement agencies and others, summarizing tweets written by two journalists — a reporter for the New York Times and the editor in chief of the blog Lawfare — and noting they had published leaked, unclassified documents about DHS operations in Portland. The intelligence reports, obtained by The Washington Post, include written descriptions and images of the tweets and the number of times they had been liked or retweeted by others.

Ironically, one of the leaks involved discussions of other leaks. An internal memo leaked to Benjamin Wittes, who runs the Lawfare blog, complains about earlier leaks.

Here's an excerpt from the leaked memo about leaked memos.

[T]he ongoing leaks related to our work in Portland remain of great to concern as it distracts from our mission and creates opportunities for others to exploit this information for their own benefit. This is wrong and we must make every effort to protect our information and prevent our work from being manipulated in any way.

Not sure what this official thinks journalists are "exploiting" and "manipulating." One of the leaked documents published by Lawfare gave DHS components permission to engage in domestic surveillance on behalf of statues and monuments. There doesn't appear to be any spin here.

It appears the DHS will stop doing this thing it supposedly only just started doing just this one time, allegedly without the knowledge of the guy acting like he's running the place. An angry statement was issued after the [acting] boss was just right now informed about these things.

“Upon learning about the practice, Acting Secretary Wolf directed the DHS Intelligence & Analysis Directorate to immediately discontinue collecting information involving members of the press,” a department spokesman said in a statement. “In no way does the Acting Secretary condone this practice and he has immediately ordered an inquiry into the matter. The Acting Secretary is committed to ensuring that all DHS personnel uphold the principles of professionalism, impartiality and respect for civil rights and civil liberties, particularly as it relates to the exercise of First Amendment rights.”

But see the ongoing violations of the restraining order that was supposed to force federal officers to "uphold the principles of professionalism" and "respect civil rights and liberties." See also the DHS's arguments in court, where it claimed protecting the government's stuff was more important than protecting citizens' rights.

The Federal Defendants intend to keep dispersing journalists and legal observers. See ECF 67 at 20 (arguing that allowing journalists and legal observers to remain "is not a practicable option"). The actions by the federal agents described by Plaintiffs are part of a pattern of officially sanctioned conduct. The Federal Defendants argue that such conduct is necessary to protect federal property.

This is why I'm not falling for Acting Director Chad Wolf's "I'm shocked, SHOCKED to discover there is disrespect for civil liberties in my agency" shtick. That and all the other times the federal government -- including agencies under the DHS's roof -- have engaged in domestic surveillance targeting journalists. And it wasn't just open source intel gathered from publicly available sites. It was also journalists' communications.

A senior Department of Homeland Security official told a Senate committee earlier this month that the department had not collected, exploited or analyzed information from the electronic devices or accounts of protesters in Portland, Ore.

But an internal DHS document obtained by The Washington Post shows the department did have access to protesters’ electronic messages and that their conversations were written up in an “intelligence report” that was disseminated to federal law enforcement agencies, including the FBI, as well as state and local governments.

This all looks very bad. But under this administration, harming journalists and/or curtailing their rights is probably fine. The President thinks most of them are "fake news" purveyors. Trump also believes most protesters are anarchists and "antifa." The DHS is under considerable pressure to make the Commander-in-Chief's conspiratorial dreams come true.

Officials who are familiar with the reports, and who spoke on the condition of anonymity to candidly discuss them, said they are consistent with the department’s aggressive tactics in Portland, and in particular the work of the Intelligence and Analysis Office, which they worried is exceeding the boundaries of its authority in an effort to crack down on “antifa” protesters to please President Trump.

All of this is troubling. If it's leak investigations, the DHS needs to keep that in-house and stop violating the Constitution. If the agency is fishing for (nonexistent) evidence of anarchists embedded in local newspapers, it's even more problematic.

The DHS was asked to rein in protests in Portland -- something the President blames on the city and state's "liberal" leadership. The DHS has failed to do anything but make itself -- and everyone involved with its response -- look worse. And every new move it makes only causes more reputational damage. The DHS needs to leave Portland before it hurts itself again.

Filed Under: 1st amendment, ben wittes, dhs, journalists, surveillance

DOJ, DHS Sued Over Inaccurate 'Terrorist Entry' Report

from the fix-it,-you-stooges dept

At the beginning of the year, the DOJ and DHS teamed up to release a report (very) narrowly crafted to support President Trump's claims about inherently-dangerous immigrants. Known as the "terrorist entry" report, it skewed data and omitted all mentions of domestic terrorism to paint a distressing picture of foreign individuals wreaking havoc on US soil.

The omission of domestic terrorism was by design. The Executive Order predicating the report [PDF] specifically called only for numbers on "foreign nationals in the US who have been charged with terrorism-related offenses." That's because those numbers would look pretty unimpressive stacked up against terrorist acts perpetrated by US citizens, as was pointed out by Lawfare's vetting of the report.

For one thing, this data set does not include domestic terrorism convictions. That is, it does not capture domestic terrorism subjects, who are more likely to be white and natural-born U.S. citizens. Leaving out those convictions is a big mistake. Last year, when Ellingsen and Daniels wrote about President Trump’s executive order, they found that 1,306 defendants had been convicted of domestic terrorism offenses in the U.S. since 1996. That’s more than twice the number of international terrorism convictions during the same period.

Even if you look past the report's built-in confirmation bias, the stats compiled by the DOJ/DHS are still questionable. The number of foreign-born terrorism convictions is inflated by defendants who never even temporarily resided in the US.

What’s more, the list included almost 100 foreign-born defendants who were extradited into the United States and therefore never would have been affected by U.S. immigration policy. That is, even excluding domestic terrorism cases, it was possible to support the president’s claim only if one counted as foreign-born terrorism suspects people the United States had actively imported in order to prosecute for terrorism or terrorism-related crimes.

Cleaning up the data -- stripping out extradited defendants -- results in unimpressive stats that hardly back the administration's claim that foreign-born individuals are more dangerous than natural-born US citizens.

Ben Wittes of Lawfare is doing more than pointing out the flaws in the report's methodology. He's suing the government over its misleading data. Along with the Protect Democracy Project and the Brennan Center For Justice, Wittes is taking the DHS and DOJ to court for violating federal law with the release of this misleading report. (via Courthouse News)

The lawsuit [PDF] points out the administration's report is, at best, highly misleading.

The Report is rife with inaccuracies and methodological flaws. It fails to disclose most of the data on which it is supposedly based, and fails to objectively analyze what limited data it does identify. Its leading claim is that 73% of individuals convicted of international terrorism-related charges since September 11, 2001 were born in other countries. See Report at 2. Defendants do not reveal the data supposedly underlying that statistic, and a review of the available data demonstrates that the statistic is likely wrong and, at the very least, highly misleading.

Of the 549 convictions underlying the terrorism statistic in the Report, only about two-thirds included charges that the government considers directly related to international terrorism. Even that portion may include convictions where the government originally brought international terrorism charges that were ultimately dropped or that resulted in an acquittal on the international terrorism charge. The Report thus falsely and misleadingly asserts that all of these 549 convictions are for international terrorism-related charges.

This statistic in the Report also excludes instances of domestic terrorism without explanation. Domestic terrorism convictions account for the majority of terrorism convictions resulting in fatalities since September 11, 2001. And the statistic includes, again without explanation, those who were transported to the United States solely for the purposes of prosecution. By omitting domestic terrorism from its analysis, and conflating those who voluntarily came to the United States with those whom the government itself brought here, the Report depicts a false picture of the proportion of terrorism convictions attributable to immigrants.

In addition to this, Wittes, et al allege the report relies on unreliable studies when not misstating conclusions to "pander to negative stereotypes about Islam." But what can citizens do when the government supports its own actions with bogus numbers and purposefully-skewed data sets? Turns out there's a law for that.

Fortunately, Congress has provided a remedy for correcting inaccurate or misleading information distributed by executive agencies. The Information Quality Act (“IQA”) requires that information published by agencies of the federal government satisfy standards of objectivity, utility, and integrity. The IQA requires agencies to identify the data and methods underlying their statistical claims. It directs the Office of Management and Budget (“OMB”) to promulgate information quality standards for any information that executive branch agencies disseminate. These standards are legally binding, and require that agency publications be accurate, clear, complete, unbiased, and useful to both the agencies and the public.

And when a report is released that satisfies almost none of these stipulations? Citizens are welcome to use the law to seek redress and official corrections.

The IQA also provides a process for third parties to challenge and obtain corrections to publications that violate these standards. On February 8, 2018, Plaintiffs filed a petition (the “Petition”) with Defendants identifying specific flaws in the Report that violate the quality standards in the IQA and its implementing regulations. Plaintiffs requested that Defendants either rescind the Report or revise it to correct the IQA violations identified in the Petition.

Defendants have not responded to the Petition within the time allotted by applicable regulations, much less rescinded or corrected the Report. The failure to respond violates Defendants’ obligation to adjudicate IQA challenges and continues the ongoing violation of the IQA substantive standards, contrary to the Administrative Procedure Act (“APA”).

Plaintiffs seek to enforce their right to petition agencies for the correction of publications that fail to meet the IQA’s standards, and bring this lawsuit to vindicate their right to receive a response to the Petition as required by applicable regulations.

Neither agency is in any hurry to correct the record. The president has leaned on this report frequently to shore up anti-immigrant rhetoric and justify travel bans. And both agencies can hook up to federal fund fire hoses by presenting immigration as a source of national security threats. It may take a court order to push these agencies to reveal their underlying stats and methodology, if not issue a corrected report fixing its numerous errors.

Filed Under: ben wittes, dhs, doj, executive order, misleading data, terrorist entry

Long Time Mass Surveillance Defenders Freak Out Now That Trump Will Have Control

from the shoulda-thought-of-that-before dept

The Lawfare blog, run by the Brookings Institution, has long reliably been a good source to go to for reading what defenders of mass surveillance and the surveillance state are thinking -- in a non-hysterical way. While I disagree with much of what's posted on there, it tends to be thoughtful and interesting reading. Its founder and Editor-in-Chief is Ben Wittes, who's always good for an impassioned defense of the NSA's surveillance on Americans, and was all in on forcing tech companies to break encryption. He wasn't worried, you see, because he was quite sure the NSA would never spy on him. Because, you know, he's a good guy.

And... yet. Something seems to have changed. And that something is who is suddenly about to be in charge of the surveillance state apparatus:

When we founded this site more than six years ago, I never in my wildest dreams imagined myself writing these words about a man who will take the oath of office as President of the United States. We began Lawfare on the assumption that the U.S. federal executive branch was a tool with which to confront national security threats. While I accepted that its manner of doing so might threaten other values—like civil liberties—or prove counterproductive in protecting national security goods, I never imagined I would confront the day when I ranked the President himself among the major threats to the security of the country.

Today, we have to confront that possibility.

Your lack of imagination is really fucking us all over now, isn't it Ben? This is exactly why so many of us -- the people he likes to mock -- have said all along that the concern with the surveillance state is always based on the fact that you have to imagine what will happen when the people you trust the least are in power.

Wittes is suddenly having something of an existential crisis about all of this:

So while I of course hope for a successful Trump presidency, I know of only one way Trump can succeed in the national security arena. And that is by radically changing the reckless persona he embodied during a long campaign—changing how he behaves, changing what he believes, changing what he aspires to do, acquiring a sense of restraint, and changing the way he talks about people and groups. And while I agree with Clinton that we owe Trump a chance to lead, the burden is on him to make these changes, not on us to suspend disbelief and pretend we live in the world he has described.

I will be candid and confess that, Clinton’s admonition notwithstanding, my mind is not entirely open about Trump’s capacity to do this, or even his interest in doing it. I have, in fact, deep doubts. And that leaves me, and I think most of America’s national security community, in a very strange position.

Maybe take the time to explore that strange feeling and you can start to understand why so many of us have been concerned about the entire apparatus that you've been cheering on for years, because, as you once said: "I have a great deal of confidence that the National Security Agency is not spying on me." There are an awful lot of people who haven't had that confidence for a while. And a great many more who won't have that confidence under the next administration. That strange feeling that Wittes has is finally a recognition that maybe he should be concerned about those people too.

This isn't a post to mock Ben, but to highlight why so many of us were so concerned all along, even as he mocked us. This is serious stuff and believing that unconstitutional warrantless mass surveillance is okay because you trust the guy in charge only works if you can always trust the guy in charge. And you can't... as Ben and others are suddenly discovering.

Filed Under: ben wittes, donald trump, mass surveillance, national security, nsa, surveillance

Insanity Rules: NSA Apologists Actually Think Apple Protecting You & Your Data Could Be 'Material Support' For ISIS

from the this-is-wrong dept

A few weeks ago, we pointed out that Senator Sheldon Whitehouse led the way with perhaps the most ridiculous statement of any Senator (and there were a lot of crazy statements) in the debate over encryption and the FBI's exaggerated fear of "going dark." He argued that if the police couldn't find a missing girl (using a hypothetical that not only didn't make any sense, but which also was entirely unlikely to ever happen), then perhaps Apple could face some civil liability for not allowing the government to spy on your data. Here's what he said:

It strikes me that one of the balances that we have in these circumstances, where a company may wish to privatize value -- by saying "gosh, we're secure now, we got a really good product, you're gonna love it" -- that's to their benefit. But for the family of the girl that disappeared in the van, that's a pretty big cost. And, when we see corporations privatizing value and socializing costs, so that other people have to bear the cost, one of the ways that we get back to that and try to put some balance into it, is through the civil courts. Through the liability system. If you're a polluter and you're dumping poisonous waste into the water rather than treating it properly somebody downstream can bring an action and can get damages for the harm they sustained, can get an order telling you to knock it off.

You can read our longer analysis of how wrong this is, but in short: encryption is not pollution. Pollution is a negative externality. Encryption is the opposite of that. It's a tool that better protects the public in the vast majority of cases. That's why Apple is making it so standard.

The suggestion was so ridiculous and so wrong that we were surprised that famed NSA apologist Ben Wittes of the Brookings Institute found Whitehouse's nonsensical rant "interesting" and worthy of consideration. While we disagree with Wittes on nearly everything, we thought at the very least common sense would have to eventually reach him, leading him to recognize that absolutely nothing Whitehouse said made any sense (then again, this is the same Wittes who seems to have joined the magic unicorn/golden key brigade -- so I'm beginning to doubt my initial assessment that Wittes is well-informed but just comes to bad conclusions).

However, even with Wittes finding Whitehouse's insane suggestion "interesting," it's still rather surprising to see him find it worthy of a multi-part detailed legal analysis for which he brought in a Harvard Law student, Zoe Bedell, to help. In the first analysis, they take a modified form of Whitehouse's hypothetical (after even they admit that his version doesn't actually make any sense), but still come to the conclusion that the company "could" face civil liability. Though, at least they admit plaintiffs would "not have an easy case."

The first challenge for plaintiffs will be to establish that Apple even had a duty, or an obligation, to take steps to prevent their products from being used in an attack in the first place. Plaintiffs might first argue that Apple actually already has a statutory duty to provide communications to government under a variety of laws. While Apple has no express statutory obligation to maintain the ability to provide decrypted information to the FBI, plaintiffs could argue that legal obligations it clearly does have would be meaningless if the communications remained encrypted.

To make this possible, Bedell and Wittes try to read into various wiretapping and surveillance laws a non-existent duty to decrypt information from your mobile phone. But that's clearly not true. If that actually existed, then we wouldn't be having this debate right now in the first place, and FBI Director James Comey wouldn't be talking to Congress about changing the law to require such things. But, still, they hope that maybe, just maybe, a court would create such a duty out of thin air based on things like "the foreseeability of the harm." Except, that's going to fall flat on its face, because the likelihood of harm here goes the other way. Not encrypting your information leads to a much, much, much greater probability of harm than encrypting your data and not allowing law enforcement to see it.

Going to even more ridiculous levels than the "pollution" argument, this article compares Apple encrypting your data to the potential liability of the guy who taught the Columbine shooters how to use their guns:

For example, after the Columbine shooting, the parents of a victim sued the retailer who sold the shooters one of their shotguns and even taught the shooters how to saw down the gun’s barrel. In refusing to dismiss the case, the court stated that “[t]he intervening or superseding act of a third party, . . . including a third-party's intentionally tortious or criminal conduct[,] does not absolve a defendant from responsibility if the third-party's conduct is reasonably and generally foreseeable.” The facts were different here in some respects—the Columbine shooters were under-age, and notably, they bought their supplies in person, rather than online. But that does not explain how two federal district courts in Colorado ended up selecting and applying two different standards for evaluating the defendant's duty.

But it's even more different than that. Even with this standard -- which many disagree with -- there still needs to be "conduct" that is "reasonably and generally foreseeable." And that's not the case here that it is "reasonably and generally foreseeable" that because data is encrypted that people will be at more risk. In all these years, the FBI still can't come up with a single example where such encryption was a real problem. It would be basically impossible to argue that this is a foreseeable "problem," especially when weighed against the very real and very present problem of people trying to hack into your device and get your data.

In the second in the series, Bedell and Wittes go even further in looking at whether or not Apple could be found to have provided material support to terrorists thanks to encryption. If this sounds vaguely familiar, remember a similarly ridiculous claim not to long ago from a music industry lawyer and a DOJ official that YouTube and Twitter could be charged with material support for terrorism because ISIS used both platforms.

Bedell and Wittes concoct a scenario in which a court might argue that providing a phone that can encrypt a terrorist's data, opens the company up to liability:

In our scenario, a plaintiff might argue that the material support was either the provision of the cell phone itself, or the provision of the encrypted messaging services that are native on it. Thus, if a jury could find that providing terrorists with encrypted communications services is just asking for trouble, then plaintiffs would have satisfied the first element of the definition of international terrorism in § 2331, a necessary step for making a case for liability under § 2333.

Of course, this is wiped out pretty quickly because that law requires intent. The authors note that this would "pose a challenge" to any plaintiff "as it would appear to be difficult, if not impossible, to prove that Apple intended to intimidate civilians or threaten governments by selling someone an iPhone..."

You think?

But, our intrepid NSA apologists still dig deeper to see if they can come up with a legal theory that will actually work:

But again, courts have handled this question in ways that make it feasible for a plaintiff to succeed on this point against Apple. For example, when the judge presiding over the Arab Bank case considered and denied the bank’s motion to dismiss, he shifted the analysis of intimidation and coercion (as well as the question of the violent act and the broken criminal law) from the defendant in the case to the group receiving the assistance. The question for the jury was thus whether the bank was secondarily, rather than primarily, liable for the injuries. The issue was not whether Arab Bank was trying to intimidate civilians or threaten governments. It was whether Hamas was trying to do this, and whether Arab Bank was knowingly helping Hamas.

Judge Posner’s opinion in Boim takes a different route to the same result. Instead of requiring a demonstration of actual intent to coerce or intimidate civilians or a government, Judge Posner essentially permits the inference that when terrorist attacks are a “foreseeable consequence” of providing support, an organization or individual knowingly providing that support can be understood to have intended those consequences. Because Judge Posner concludes that Congress created an intentional tort, § 2333 in his reading requires the plaintiff to prove that the defendant knew it was supporting a terrorist or terrorist organization, or at least that it was deliberately indifferent to that fact. In other words, the terrorist attack must be a foreseeable consequence of the specific act of support, rather than just a general risk of providing a good or service.

But even under those standards, it's hard to see how Apple could possibly be liable for material support. It's just selling an iPhone and doing so in a way that -- for the vast majority of its customers -- is better protecting their privacy and data. It would take an extremely twisted mind and argument to turn that into somehow "knowingly" helping terrorists or creating a "foreseeable consequence." At least the authors admit that much.

But why stop there? They then say that Apple could still be liable after the government asks them to decrypt messages. If Apple doesn't magically stop the user in particular from encrypting messages, then, they claim, Apple could be shown to be "knowingly" supporting terrorism.

The trouble for Apple is that our story does not end with the sale of the phone to the person who turns out later to be an ISIS recruit. There is an intermediate step in the story, a step at which Apple’s knowledge dramatically increases, and its conduct arguably comes to look much more like that of someone who—as Posner explains—is recklessly indifferent to the consequences of his actions and thus carries liability for the foreseeable consequences of the aid he gives a bad guy.

That is the point at which the government serves Apple with a warrant—either a Title III warrant or a FISA warrant. In either case, the warrant is issued by a judge and puts Apple on notice that there is probable cause to believe the individual under investigation is engaged in criminal activity or activity of interest for national security reasons and is using Apple’s services and products to help further his aims. Apple, quite reasonably given its technical architecture, informs the FBI at this point that it cannot comply in any useful way with the warrant as to communications content. It can only provide the metadata associated with the communications. But it continues to provide service to the individual in question.

But all of this, once again, assumes an impossibility: that once out of its hands, Apple can somehow stop the end user from using the encryption on their phone.

This is the mother of all stretches in terms of legal theories. And, throughout it all, neither Bedell nor Wittes even seems to recognize that stronger encryption protects the end user. It's like it doesn't even enter their minds that there's a reason why Apple is providing encryption that isn't "to help people hide from the government." It's not about government snooping. It's about anyone snooping. The other cases they cite are not like that at all. These arguments, even as thin as they are, only make sense if Apple's move to encryption doesn't really have widespread value for basically the entire population. You don't sue Toyota for "material support for terrorism" just because a terrorist uses a Toyota to make a car bomb. Yet, Wittes and Bedell are somehow trying to make the argument that Apple is liable for better protecting you, just because in some instances it might also help "bad" people. That's a ridiculous legal theory that barely deserves to be laughed at, let alone a multi-part analysis of how it "might work."

Filed Under: ben wittes, encryption, isis, liability, material support, mobile encryption, pollution, sheldon whitehouse, terorrism, zoe bedell
Companies: apple

NSA Apologist Offers Solutions To 'Encryption' Problem, All Of Which Are Basically 'Have The Govt Make Them Do It'

from the wishful-thinking dept

Benjamin Wittes, one of the NSA apologists ensconced at Lawfare, has written a long piece in defense of FBI head James Comey's assertions that there must be some way tech companies can give him what he wants without compromising the privacy and security of every non-terrorist/criminal utilizing the same broken encryption.

What he suggests is highly problematic, although he obviously pronounces that word as "pragmatic." He implies the solution is already known to tech companies, but that their self-interest outweighs the FBI's push for a "greater good" fix.

The theory is that companies have every incentive for market reasons to protect consumer privacy, but no incentives at all to figure out how to provide law enforcement access in the context of doing so.

There's some truth to this theory. Tech companies are particularly wary of appearing to be complicit in government surveillance programs as a couple of years of leaks have done considerable damage to their prospects in foreign markets.

Wittes suggests the government isn't doing much to sell this broken encryption plan, despite Comey's multiple statements on the dangers posed by encrypted communications. And he's right. If the government truly wants a "fix," it needs to start laying the groundwork. It can't just be various intel/law enforcement heads stating "we're not really tech guys" and suggesting tech companies put the time and effort into solving their problems for them.

If we begin—as the computer scientists do—with a posture of great skepticism as to the plausibility of any scheme and we place the burden of persuasion on Comey, law enforcement, and the intelligence community to demonstrate the viability of any system, the obvious course is government-sponsored research. What we need here is not a Clipper Chip-type initiative, in which the government would develop and produce a complete system, but a set of intellectual and technical answers to the challenges the technologists have posed. The goal here should be an elaborated concept paper laying out how a secure extraordinary access system would work in sufficient detail that it can be evaluated, critiqued, and vetted; think of the bitcoin paper here as a model. Only after a period of public vetting, discussion, and refinement would the process turn to the question of what sorts of companies we might ask to implement such a system and by what legal means we might ask.

Thus ends the intelligent suggestions in Wittes' thinkpiece. Everything else is exactly the sort of thing Comey keeps hinting at, but seems unwilling to actually put in motion. It's the government-power elephant in the room. Actually, several elephants. It's the underlying, unvocalized threat that lies just below the surface of Comey's government-slanted PR efforts. Wittes just goes through the trouble of vocalizing them.

First, he gives Comey's chickenshit, ignorant sales pitch a completely disingenuous, self-serving reading. Comey has refused to acknowledge the fact that what he's seeking is not actually possible. He claims he doesn't have the tech background to make more informed assertions while simultaneously insisting the solution exists -- and could easily be found if only these tech companies were willing to apply themselves.

[Comey] is talking in very different language: the language of performance requirements. He wants to leave the development task to Silicon Valley to figure out how to implement government's requirements. He wants to describe what he needs—decrypted signal when he has a warrant—and leave the companies to figure out how to deliver it while still providing secure communications in other circumstances to their customers.

The advantage to this approach is that it potentially lets a thousand flowers bloom. Each company might do it differently. They would compete to provide the most security consistent with the performance standard. They could learn from each other. And government would not be in the position of developing and promoting specific algorithms. It wouldn't even need to know how the task was being done.

In Wittes' estimation, Comey is being wise and promoting open innovation, rather than just refusing to openly acknowledge that his desire to access and intercept communications far exceeds his desire to allow millions of non-criminals access to safer connections and communications.

Wittes goes on to offer a handful of "solutions" to the Second Crypto War. Not a single one includes the government growing up and learning to deal with the new, encrypted status quo. He follows up the one useful suggestion -- government research exploring the feasibility of the proposed encryption bypass -- with one of his worst ideas:

If you simply require the latter [law enforcement access] as a matter of law, [tech companies] will devote resources to the question of how to do so while still providing consumer security. And while the problems are hard, they will prove manageable once the tech giants decide to work them hard—rather than protesting their impossibility.

There's not a worse idea out there than making certain forms of encryption illegal to use in the United States. But Wittes tries his hardest to find equally awful ideas. Like this one, which would open tech companies to an entire new area of liability.

Another, perhaps softer, possibility is to rely on the possibility of civil liability to incentivize companies to focus on these issues. At the Senate Judiciary Committee hearing this past week, the always interesting Senator Sheldon Whitehouse posed a question to Deputy Attorney General Sally Yates about which I've been thinking as well: "A girl goes missing. A neighbor reports that they saw her being taken into a van out in front of the house. The police are called. They come to the home. The parents are frantic. The girl's phone is still at home." The phone, however, is encrypted.

Wittes quotes Whitehouse's statements, in which he compares encryption to industrial pollution and suggests tech companies -- not the criminal in question; not the investigators who are seemingly unable to explore other options -- be held liable for the criminal's actions. Wittes poses a rhetorical question -- one that assumes most of America wants what Comey wants.

Might a victim of an ISIS attack domestically committed by someone who communicated and plotted using communications architecture specifically designed to be immune, and specifically marketed as immune, from law enforcement surveillance have a claim against the provider who offered that service even after the director of the FBI began specifically warning that ISIS was using such infrastructure to plan attacks? To the extent such companies have no liability in such circumstances, is that the distribution of risk that we as a society want?

Holding companies responsible for the actions of criminals is completely stupid. Providing encryption to all shouldn't put companies at risk of civil suits. The encryption isn't being provided solely for use by bad guys. It makes no more sense than holding FedEx responsible for shipments of counterfeit drugs. And yet, we've seen our government do exactly that, in essence requiring every affected private company to act as deputized law enforcement entities, despite there being no logical reason to put them in this position. Wittes feels the best solutions involve the government forcing companies to bend to its will, and provide compromised encryption under duress.

The final solution proposed by Wittes is to let everything go to hell and assume the political landscape -- along with tech companies' "sympathies" -- will shift accordingly. This would be the "let's hope for the tragic death of a child" plan:

[W]e have an end-to-end encryption issue, in significant part, because companies are trying to assure customers worldwide that they have their backs privacy-wise and are not simply tools of NSA. I think those politics are likely to change. If Comey is right and we start seeing law enforcement and intelligence agencies blind in investigating and preventing horrible crimes and significant threats, the pressure on the companies is going to shift. And it may shift fast and hard. Whereas the companies now feel intense pressure to assure customers that their data is safe from NSA, the kidnapped kid with the encrypted iPhone is going to generate a very different sort of political response. In extraordinary circumstances, extraordinary access may well seem reasonable.

If this does happen, Wittes' assumption will likely be correct. Politicians have never been shy about capitalizing on tragedies to nudge the government power needle. This will be no different. One wonders why no one has come forward with a significantly compelling tragedy by this point, considering the wealth of encryption options currently on the market. A logical person would assume this lack of compelling anecdotal evidence would suggest encryption really hasn't posed a problem yet -- especially considering the highly-motivated sales pitches that have been offered nonstop since Google and Apple's announcement of their encryption-by-default plans. The "problem" Comey and others so desperately wish to "solve" remains almost entirely theoretical at this point.

But the FBI and others aren't going to wait until the next tragedy. They want the path of least resistance now. The solutions proposed by Wittes are exactly the sort of thing they'd be interested in: expanded government power and increased private sector liability. This is why Comey has no solution to offer. There is none. There is only the option of making companies do what he wants, but he's too wary of public backlash to actually say these things out loud. Wittes has saved him the trouble and proven himself no more trustworthy than those who want easy access, no matter the negative implications or unintended consequences of these actions.

Filed Under: backdoors, ben wittes, encryption, going dark, nsa, surveillance

Paper Says Public Doesn't Know How To Keep Score In Privacy Discussion While Glossing Over Government Surveillance

from the noting-the-obvious-while-ignoring-the-elephant-bugging-the-room dept

Lawfare -- a blog primarily devoted defending the practices of spy agencies -- has released a paper authored by Benjamin Wittes and Jodie Liu that theorizes that the public's concern over privacy encroachments are -- if not overblown -- then failing to properly factor in the privacy "gains" they've obtained over the past several years.

The theory is solid, but the paper fails to differentiate between what sort of privacy losses people find acceptable and which ones they don't -- mainly by leaving privacy invasions by government entities almost completely undiscussed. It opens by quoting a scene from an old Woody Allen film in which the protagonist attempts to "hide" his purchase of porn at a magazine stand by purchasing several unrelated (and presumably uninteresting) magazines at the same time. This leads to the conclusion that people's ability to enjoy porn in private has risen with the advent of the internet, while simultaneously opening them up to data harvesters and internet companies less interested in personal privacy than selling users to advertisers.

True enough, but there's a big difference between exposing that information to the Googles of the world, rather than the surveillance agencies of the world. On one hand, Google and its competitors provide something in exchange for the privacy loss -- tailored ads, relevant search results, email, document creation platforms, etc. And there are still those -- a steadily-growing minority -- that realize Google's privacy invasions are often inseparable from the government's privacy invasions (via court orders, subpoenas and NSLs) and work hard to keep their personal information away from both. What the government offers in exchange for access to much of the same info is intangible: "security." While one might recognize the value of the first exchange, it's harder to sell the latter tradeoff, especially since intelligence agencies are much, much better at scooping up information than they are at disseminating it.

A huge amount of technological development follows this basic pattern. Google and Microsoft and Yahoo! enable you to search for information privately—with data collection by the companies and possible retrieval by other actors as a consequence. Amazon lets you buy all sorts of products with nobody the wiser—but with your purchase history stored and mined for patterns.

Your smartphone lets you put all this capability in your pocket and take it with you— and thus also lets you use it more and record your location along the way. That information too is then subject to retrieval. Facebook allows you to identify discrete groups of people with whom you want to share material—yet it stores your actions for processing and retrieval as you go. In our mental tabulation of gain and loss, we tend to count only one side of the ledger, pocketing what we have won as though it were of no privacy value while bemoaning what we have given up.

Even more mischievously, when we do acknowledge the gains, we tend to redefine them as gains in something other than privacy. We define them, most commonly, as mere convenience or efficiency gains—a dismissive description that implies we have won something inconsequential or time-saving while giving up something profound. But the construction leaves us with a distorted and altogether-too-bleak outlook on technology’s impact on our lives. Yes, technology involves gains in convenience and efficiency, but those are not the only gains.

To reiterate, we do not argue here that technology is necessarily privacy-enhancing in the aggregate, or that technology does not erode privacy. Rather, our general point is that the interaction between technology and privacy is less clear-cut than the debate commonly acknowledges, that we don’t keep score well, and that the actual privacy scorecard is a murky one.

The paper does make the solid argument that technology has resulted in greater individual privacy -- provided it's measured on the scale the paper's authors present. In one example, the authors point to a teen's desire to discuss a sexual or health issue as being more "private" because of access to medical websites and forums where information can be obtained with relative anonymity -- something a doctor's office can't completely provide.

But medical records are private information, governed by a specific set of laws. If anything, the online search is less private because these websites are not subject to patient privacy laws. Someone inquiring about a teen's visit to a health clinic would be frozen out, but any number of entities can access web-related information without facing similar statutory roadblocks.

While there are some good points made, the paper is undermined by the authors' insistence that Americans just don't know how to properly balance their privacy concerns. The implication -- given author Benjamin Wittes' frequent defense of government surveillance -- is that if the public can't weigh privacy gains and losses correctly in the context of private corporations, it certainly can't be expected to make informed decisions when it comes to government surveillance. And it's true that most citizens aren't likely to rigorously examine their fears of privacy erosion.

The paper does very little to compare privacy "violations" by internet entities to government surveillance programs, choosing instead to focus almost entirely on the tradeoffs made by people who hand over a certain amount of personal info for the privilege of watching porn or googling STD symptoms without having to involve another living, breathing person. It's presented as being in favor of a "more rigorous balance sheet" when it comes to personal privacy, but then fails to closely examine government surveillance concerns. There's another tradeoff being performed here -- without the input of those surveilled and who receive almost nothing tangible in exchange for the privacy erosion. Because of this, there's little comparison between the Googles and the NSAs of the world.

You don't hand a government the tools of totalitarianism and a long leash and simply assume it will end well. Google, et al may be similarly close-fisted when it comes to producing specifics on the use of personal data, but they also don't bear the same obligation to the American public that the US government does. Even if Google is more intrusive than the NSA, it still is only one of many platform providers and there are options (admittedly not many and not easily achieved) for avoiding its data-gathering efforts. The government provides no such options, other than forgoing the use of phones, the internet, etc.

I think the paper does add to the discussion of privacy gains and losses, but the authors' unwillingness to honestly approach government surveillance efforts in the same context blunts its impact. It quotes privacy advocates like the ACLU and EFF on the subject of data harvesting by private companies, but doesn't address the similar concerns they've raised about the erosion of privacy by government actions.

There's an attempt being made here to paint the government as no worse (and possibly even better) than private companies' data harvesting efforts, albeit by way of omission rather than by comparison. It's disingenuous to depict the public as ignorant of their privacy "gains" against the domestic surveillance backdrop, while omitting any mention of similar privacy erosions at the hand government intelligence agencies. Wittes opens his post on the paper by claiming American and European privacy debates "keep score very badly" and then points to a paper that leaves key parties in the privacy debate almost wholly unmentioned. I'm all for an open discussion about privacy gains and losses, but a paper that focuses solely on interactions with private companies -- while claiming the public can't keep score -- isn't much of an addition to the debate.

Filed Under: ben wittes, cost benefit, privacy, surveillance

NSA Cheerleader Ben Wittes Takes A Written Swing At The Anti-NSA Crowd And Misses His Target Entirely

from the pro-surveillance-jackassery dept

Benjamin Wittes, adjunct NSA apologist at the Brookings Institution and the most prolific blogger at Lawfare, has just unloaded a post meant to portray those opposed to the NSA as simpleminded strawmen/women who are triggered by certain letters rather than by the critically-important nuances.

Here's the gist of it, which I can hopefully convey without copy-pasting the entirety of the short, extremely self-satisfied piece.

I was at the National Security Agency yesterday giving a Constitution Day speech and I learned details of a shocking collection program: The government is bulk collecting all traffic on Twitter. Under a program menacingly called “Bulk Data in Social Media” and abbreviated—appropriately enough—as BDSM [insert proxy self-amused snicker here], Twitter has been providing all public traffic since 2010 for a massive government database that, as of early last year, contained 170 billion tweets. The goal of this program? To “collect the story of America” and to “acquire collections that will have research value” to analysts and others.

Those of you who are not the morons Wittes makes you out to be will already know where this is headed. Wittes breathlessly adds in italics that Twitter does this voluntarily without a court order or FISA court review.

Then he drops the "bombshell."

Why would NSA do all this?

It wouldn’t. The agency I’m talking about here is the Library of Congress.

Yes, the Library of Congress is collecting every Tweet with the blessing of Twitter itself, and has been doing so for years. It was in all the papers. Those of us opposed to the NSA's bulk collections are supposed to stare deep inside ourselves as Wittes fumblingly twists the rhetorical knife.

So here’s the question: If you were shocked when you read the first paragraph of this post and relieved when you read that the agency doing all this collection is not NSA but the good guys over at the Library of Congress, and that the good guys are actually planning to make that data available widely, why did you have those reactions? And do those reactions make sense?

First of all, no one with any amount of sense would claim that the government can't access or collect public messages on a public platform. That's an expectation we live with when we use these services. But the collection of every public tweet for archival and research purposes is far different than the collection of private metadata and communications for the purposes of rooting out threats to the nation's security. (Or fighting drug wars, etc.)

It's called intent. Wittes should look that up. Also, he should perhaps look into the difference between public and private info if he's got the time.

While many people use social media to lay bare certain aspects of their lives, a high percentage of them do not reveal everything, or at least not as much as "just metadata" can reveal. Many intimate details about a person's life can be revealed by the data they "voluntarily" hand over to third parties. Cops can track people's movements with license plate data. The NSA can peer deeply into a person's life with bulk phone records. People don't "volunteer" this information, but there's no way to opt out. Vehicles travel outside on public roads. Phone connection data is collected because phone companies need to track usage for billing (and are required to do so by the federal government).

Billions of tweets are all given up voluntarily by Twitter users. Even those who regret tweets they've sent or accounts they made still know in the back of their mind it's been archived somewhere. It's public speaking on a public platform.

Which brings us to another major difference between the two: transparency.

The Library of Congress has addressed this collection program publicly a number of times. Twitter also publicly announced this partnership. If anyone wanted to avoid being part of this collection, they could simply avoid using the platform -- a choice more realistic than the government's continued assertion that travel and communication are "luxuries" in which we wlllingly exchange our rights for convenience.

What has the NSA announced? Not a goddamn thing. It's only talking now because someone took its secret programs and spread them all over the internet. Now it has to address these issues, but even in this era of forced openness, it still deploys a tremendous amount of black ink.

I'm sure Wittes' post garnered a few chortles from like-minded individuals (including some he heavily elbowed in the ribs), but the whole setup is disingenuous. It conveniently ignores crucial differences between the two forms of collections in hopes of portraying the anti-NSA crowd as ultimately no more complex than single-celled organisms. The good news is that those of us on this side of the divide are constantly underestimated by those whose views skew more towards Wittes'.

This sort of presumptive arrogance is what allowed a government contractor to walk out the door with thousands of classified documents from the top national security entity in the world -- one with a massive budget and the best minds the government could hire. The NSA simply believed nothing of that scope would happen to No Such Agency, even with an obviously lax set of internal controls. Now it's been burned. And yet, its apologists still think they can talk down to everyone on the other side of argument.

Filed Under: ben wittes, communications, library of congress, metadata, nsa, private, public, sharing, surveillance, volunteering
Companies: twitter

Saying That You're Not Concerned Because The NSA Isn't Interested In You Is Obnoxious And Dangerous

from the think-again dept

One of the more common responses we've seen to all of the revelations about all of that NSA surveillance, is the response that "Well, I don't think the NSA really cares about what I'm doing." A perfect example of that is long-time NSA defender Ben Wittes, who recently wrote about why he's not too worried that the NSA is spying on him at all, basically comparing it to the fact that he's confident that law enforcement isn't spying on him either:

As I type these words, I have to take on faith that the Washington D.C. police, the FBI, the DEA, and the Secret Service are not raiding my house. I also have to take on faith that federal and state law enforcement authorities are not tapping my various phones. I have no way of knowing they are not doing these things. They certainly have the technical capability to do them. And there’s historical reason to be concerned. Indeed, there is enough history of government abuse in the search and seizure realm that the Founders specifically regulated the area in the Bill of Rights. Yet I sit here remarkably confident that these things are not happening while my back is turned—and so do an enormous number of other Americans.

The reason is that the technical capability for a surveillance event to take place does not alone amount to the reality—or likelihood—of that event’s taking place....

For much the same reason as I am not rushing home to guard my house, I have a great deal of confidence that the National Security Agency is not spying on me. No doubt it has any number of capabilities to do so. No doubt those capabilities are awesome—in the wrong hands the tools of a police state. But there are laws and rules that protect me, and there are compliance mechanisms that ensure that the NSA follows those laws and rules. These systems are, to be sure, different from those that restrain the D.C. cops, but they are robust enough to reassure me.

Julian Sanchez has a blistering response to that, appropriately entitled Check Your Privilege, which highlights that while Wittes, a well-paid, white, DC-based policy think tank worker, may be confident of those things, plenty of other folks are not nearly so confident, and that the NSA has made it pretty clear that they shouldn't be so confident.

In a democracy, of course, the effects of surveillance are not restricted to its direct targets.  Spying, like censorship, affects all of us to the extent it shapes who holds power and what ideas hold sway.  Had the FBI succeeded in “neutralizing” Martin Luther King Jr. earlier in his career, it would hardly have been a matter of concern solely for King and his family—that was, after all, the whole point. 

Instead of a couple wonks comfortably ensconced in D.C. institutions, let’s instead ask a peaceful Pakistani-American who protests our policy of targeted killings, perhaps in collaboration with activists abroad; we might encounter far less remarkable confidence.  Or, if that seems like too much effort, we can just look to the survey of writers conducted by the PEN American Center, finding significant percentages of respondents self-censoring or altering their use of the Internet and social media in the wake of revelations about the scope of government surveillance. Or to the sworn declarations of 22 civil society groups in a lawsuit challenging bulk phone records collection, attesting to a conspicuous decline in telephonic contacts and members expressing increased anxiety about their association with controversial or unpopular organizations. 

As Sanchez notes, it's not just whether or not any of us are direct targets, but the overall chilling effects of how the system is used. And, I should note, that while Wittes is confident that he's safe -- there are a growing number of folks who have good reason to believe that they are not immune from such surveillance. The recent revelation that Tor users are labeled as extremists who get extra-special scrutiny seems like a major concern. Similarly, the story from earlier this year that the NSA targeted the Pirate Bay and Wikileaks as part of some of its surveillance efforts is a major concern. In the process of doing journalism, I've communicated with folks associated with some of those and other similar organizations. In the past, I probably would have similarly noted that I doubted the NSA cared at all about what I was doing, but as each of these stories comes out, I am increasingly less sure. And, more importantly, even if the NSA is not at all concerned with what I happen to be doing, just the fact that I now have to think about what it means if they might be certainly creates a chilling effect, and makes me think twice over certain people I contact, and what I say to them.

It's easy to claim that you're not worried when you're the one out there supporting those in power. It becomes a lot trickier when you're either criticizing those in power, or communicating with those who challenge the power structure. Suddenly, it's not so easy to sit on the sidelines and say "Meh, no one's going to care about me..." And that should be a major concern. The way we keep a strong democracy is by having people who are able and willing to challenge the status quo and those in power. And yes, the US is much more forgiving than many, many other countries to such people, but there are clear biases and clear cases where they are not at all accepting of such things. And the more of a chilling effect the government creates around those things, the more dangerous it becomes to stand up for what you believe in.

Filed Under: ben wittes, chilling effects, concern, julian sanchez, nsa, privacy, privilege, surveillance