Apple Puts Dead Man's Switch About Not Receiving PATRIOT Act Requests In Its Transparency Report

from the well,-look-at-that... dept

It's a bit late, but it appears that Apple has finally caught up with Google, Twitter, Microsoft, Facebook and Yahoo, as tech companies that have issued "transparency reports" about government requests for data (and, in some cases, for takedowns). The first Apple Transparency Report is pretty similar to the transparency reports issued by those other companies. As with the others, the US government only allows "ranges" of information to be released about certain kinds of reports, rather than exact numbers. And, of course, no companies are yet allowed to reveal the details of Section 702 orders -- which are a part of the PRISM program. The various companies are suing the government over that one.

Some people have noted that Apple seems to get fewer requests than some other companies, but that doesn't seem like an apples-to-apples comparison, since Apple's main business is hardware, and its online services are much more limited and targeted than those other companies. But, there is one interesting tidbit in the report. Way down at the end it says the following:

Apple has never received an order under Section 215 of the USA Patriot Act. We would expect to challenge such an order if served on us.

Now, Section 215 of the PATRIOT Act is the so-called "business records" or "tangible things" clause, which is used to demand all the metadata from the various telcos (who appear to be happy to hand it over without complaint). There's been no indication so far that the government has used 215 on the tech companies. PRISM all relates to Section 702 of the FAA, which the lawsuit mentioned above is about. And, of course, there are reports of the NSA using Executive Order 12333 to justify hacking into servers overseas, without companies even knowing about it. So, you can argue that whether or not any Section 215 orders were served on Apple is somewhat meaningless.

But... it appears that Apple has put this in the report as a sort of dead man's switch, such as Cory Doctorow suggested a few months ago: for companies that have not received any such type of order, if they announce that publicly on a regular basis, if the next time they release a report it's not in there, it becomes clear that they have received such an order, even if they're gagged about it. This is also known as a warrant canary, and was originally suggested for libraries -- who were afraid of Section 215 from the very beginning (early on, it was often referred to as the library clause), as people expected the feds to use it to spy on people's library records.

While given the other programs this may not seem like a big deal, it's nice to see Apple taking this particular step, even if small, to effectively protest against the 215 gag orders.

Filed Under: dead man's switch, patriot act, prism, section 215, section 702, transparency, warrant canary
Companies: apple

Why Companies Should Start Regularly Reporting That They Have Not Received Secret NSA Orders

from the because-when-they-stop... dept

One of the more amusing side notes in Google's recent filing to get permission to accurately report on how many FISA Court orders it receives, is the following footnote:

Nothing in this Motion is intended to confirm or deny that Google has received any order or orders issued by this Court.

It's amusing, because everyone knows that Google has received such orders, which is why this whole legal fight is happening in the first place. If it hadn't received any such orders, then it wouldn't have any standing to sue in the first place. Furthermore, when asked, the company could just easily say that it had never received any such orders (as a few companies have claimed). While those orders come with gag orders, there is no general gag order on people from saying they haven't received any such orders. That got me thinking that companies should really start saying publicly that they've received no such orders, because at a future date, if they can't say that officially, we'd know that they had received such an order, without them violating the gag order.

It appears I wasn't the only person to start thinking along these lines. Cory Doctorow has a fascinating suggestion, first talking about how librarian Jessamyn West came up with a similar idea to deal with the gag orders associated with the Patriot Act's Section 215, which librarians had protested loudly early on, in part because of the gag order on revealing that the government had ordered records be handed over. It involved putting up a sign in a library that says "The FBI has not been here [watch very closely for the removal of this sign.]" Smart. Doctorow then notes that a software company he's talking to, called Wickr, had planned something similar:

She explained that her company had committed to publishing regular transparency reports, modelled on those used by companies like Google, with one important difference. Google's reports do not give the tally of secret orders served on it by governments, because doing so would be illegal. Sell has yet to receive a secret order, so she can legally report in each transparency report: "Wickr has received zero secret orders from law enforcement and spy agencies. Watch closely for this notice to disappear." When the day came that her service had been served by the NSA, she could provide an alert to attentive users (and, more realistically, journalists) who would spread the word. Wickr is designed so that it knows nothing about its users' communications, so an NSA order would presumably leave its utility intact, but notice that the service had been subjected to an order would be a useful signal to users of other, related services.

Of course, then, as he's been know to do time and time again, Doctorow takes this basic idea, and ratchets it up a few notches with the following amazing suggestion:

This gave me an idea for a more general service: a dead man's switch to help fight back in the war on security. This service would allow you to register a URL by requesting a message from it, appending your own public key to it and posting it to that URL.

Once you're registered, you tell the dead man's switch how often you plan on notifying it that you have not received a secret order, expressed in hours. Thereafter, the service sits there, quietly sending a random number to you at your specified interval, which you sign and send back as a "No secret orders yet" message. If you miss an update, it publishes that fact to an RSS feed.

As he notes, the FISA Court might then try to argue that recipients of orders would need to lie, but forcing a company to flat out lie has even more Constitutional issues in the US than the already troubling concept of a basic gag order. This seems like something simple that absolutely needs to exist.

Filed Under: dead man's switch, fisa court, free speech, gag orders

Snowden's 'Dead Man's Switch' May Just Make Him A Bigger Target

from the forcing-the-government-to-protect-its-'enemy' dept

Word has it that Ed Snowden has gone all George Smiley and implemented his version of a "dead man's switch," one that will lead directly to a full data dump if anything unpleasant happens to him. What's in these yet-unleaked documents is still a mystery, although Snowden has claimed they provide a "blueprint" of the NSA's surveillance architecture, one that could be probed for weaknesses or replicated.

[S]nowden... reportedly passed encrypted copies of his cache to a number of third parties who have a non-journalistic mission: If Snowden should suffer a mysterious, fatal accident, these parties will find themselves in possession of the decryption key, and they can publish the documents to the world.

Obviously, Snowden has set this up to prevent the US from deciding to simply take him out, rather than risk any more leaks. This conceivably shifts priorities for the US, which now must take care to ensure Snowden remains unharmed. (It's not explicitly stated whether an arrest or successful extradition to the US will trigger the "switch.") Notably, Snowden doesn't actually have to die to set things in motion.

"It's not just a matter of, if he dies, things get released, it's more nuanced than that," he said. "It's really just a way to protect himself against extremely rogue behavior on the part of the United States, by which I mean violent actions toward him, designed to end his life, and it's just a way to ensure that nobody feels incentivized to do that."

Bruce Schneier, however, sees how this "insurance plan" could actually make things more dangerous for Snowden.

I'm not sure he's thought this through, though. I would be more worried that someone would kill me in order to get the documents released than I would be that someone would kill me to prevent the documents from being released. Any real-world situation involves multiple adversaries, and it's important to keep all of them in mind when designing a security system.

This could make Snowden a target for people whose motivations run from the anti-American (exposed documents will hurt the US) to those who view chaos as its own end (exposed documents will wreak further mayhem in governments worldwide). This sort of action is probably more limited to individual actors rather than agents of unhappy/rival states.

If someone did manage to take him out, all eyes would turn to the US government. Whether the government did or didn't do it doesn't matter. It will be assumed it was ordered by the US. And whether or not the US government was behind it, it will issue a denial. This denial, of course, won't be believed because at this point, the government has the credibility of a heroin addict.

If the government has taken any of the above into consideration, it's back to having to ensure Snowden remains unharmed and safe, something made even more difficult by Snowden inadvertently painting a target on his own back.

Filed Under: dead man's switch, documents, ed snowden, encryption, leaks, protection