ICE Is So Toxic That The DHS's Investigative Wing Is Asking To Be Completely Separated From It

from the annul-this-arranged-marriage-please dept

The Department of Homeland Security is trying to distance itself from its most toxic asset, the Washington Post reports:

Federal agents from Homeland Security Investigations say they have been kicked out of joint drug operations, shunned by local police departments and heckled at campus career fairs. Their parent agency, U.S. Immigration and Customs Enforcement, carries a stigma that is undermining their investigative work across the country, the agents said in an internal report.

The agents say they face a backlash in liberal “sanctuary” jurisdictions where authorities strictly limit contact with ICE but also in some Republican-led states where politicians are vocal in their support for the agency. And the toll on HSI agents is “getting worse,” according to the report that was prepared by a working group of agents formed by HSI to consider changes to the agency’s place within the Department of Homeland Security.

ICE has always been controversial. Under President Trump, the agency was unleashed. It willingly embraced its awfulness, deploying everything from fake warrants to fake colleges in its war on foreign residents and would-be immigrants, many of whom were here legally. It courted controversial tech companies to expand its surveillance arsenal and made it clear it was interested in ejecting as many foreign people as possible, rather than the "worst of the worst" Trump claimed his immigration policies targeted.

But now it's clear that working with ICE means not actually getting any work done. Homeland Security Investigations (HSI) agents have informed the DHS Secretary that partnering with ICE has all sorts of negative side effects. Agents are complaining about threats to their personal safety, crime victims being unwilling to engage with investigators due to ICE presence, and harming relationships with local law enforcement. ICE is a drain on resources due to its horrendous reputation. Here's how the HSI agents put it in their letter to DHS officials:

“HSI’s affiliation with ICE significantly impedes investigations and HSI’s ability to fulfill its mission.”

Unfortunately, it appears this is unlikely to result in HSI decoupling from ICE. It would take an act of Congress to do so, and support for this sort of division is far from universal. The other solution is just as unlikely to happen: the rehabilitation of ICE's image.

ICE has done a lot of damage to its reputation due to its willingness to become the embodiment of xenophobic presidential directives and policies. It could rein itself in, but any rehabilitation could easily be undone by the next president to take office. Most people never truly believed someone like Trump could ever be elected, but millions of Americans proved us wrong in 2016. All bets are off.

ICE's response to the assertions in this letter is less than helpful. The agency, through a spokesperson, says nothing but uses a lot of words to deliver its nonexistent message:

In a statement, ICE spokeswoman Paige Hughes said the agency “relies on close working relationships with its state, local, and international partners,” but she did not elaborate on the details of the report. She added: “ICE refrains from discussing deliberations publicly with its partners to maintain operational security and in recognition of the sensitive nature of many of our activities.”

Congress may not be willing to bless a HSI-ICE divorce. But it's clear from this letter that federal agencies forced to partner with ICE are being held back by ICE's negative reputation. And ICE can't blame anyone else for being so toxic its federal partners want nothing to do with it. It may have received questionable directives from the former president, but it was under no obligation to carry these out with as much enthusiasm and zeal as it did.

Plenty of federal agencies are capable of barely meeting the minimal requirements of Congressional and presidential mandates. ICE could have slow-walked its "toss out the brown people" directives until power changed hands. Instead, it showed itself to be an enthusiastic participant in bigoted policies, making it clear the 2016 regime change had simply allowed it to be the thuggish enforcer of immigration law it had always wanted to be.

Filed Under: dhs, homeland security investigations, hsi, ice

DHS, ICE Begin Body Camera Pilot Program With Surprisingly Good Policies In Place

from the exceeding-admittedly-low-expectations dept

Following protests over killings by law enforcement officers, the Department of Justice decided it might be a good idea to equip more police officers with body cameras. In May 2015, it announced the federal government would be spending $75 million over the next three years to purchase body cameras for local law enforcement agencies.

The DOJ saw the potential for body cameras to produce more accountability, lower the chances of deadly interactions, and rebuild some trust with the communities officers served. That's presumably why it opted out of this push for body camera adoption. Five months after it announced the body cam grant program, DOJ reps told local law enforcement that use of body cameras wasn't allowed when partnering with federal law enforcement. Either the cameras stayed home or the local cops did. No exceptions.

It wasn't until five years later that the DOJ finally decided it was ok for federal agents to work with local law enforcement officers sporting body cameras, perhaps realizing the cameras simply weren't going to go away. After all, it had encouraged adoption of the tech with three years of federal funding. But this still meant federal officers were going about their work unobserved, which still seemed problematic given all the advantages the DOJ said these cameras created when it started handing out federal cash in 2015.

It took another year before the DOJ finally decided federal officers should get with the body camera program. Six years after it invested in nationwide distribution of body cameras, federal officers are finally going to start wearing them. The ATF was the first to perform a test run of the cameras. Now, the DHS is following suit.

Agents with an investigative unit of the Department of Homeland Security will wear body cameras for the first time as part of a six-month pilot program that will focus on the costs and benefits of using the technology in federal law enforcement, officials said Tuesday.

The cameras will be used during the test by 55 members of the SWAT-like special response teams at Homeland Security Investigations in Houston, Newark, New Jersey, and New York, an official told reporters.

That's the first wave of adoption for the DHS, albeit not one that guarantees permanent adoption. The second wave will rope in one of the federal government's most controversial agencies.

The senior ICE official, who spoke to reporters on condition of anonymity to provide details on the program before the announcement, said the agency expects later to expand the pilot to include officers who conduct immigration enforcement arrests.

Fortunately, this rollout is accompanied by something that often goes missing when the federal government deploys new tech: privacy impact assessments and written policies. In this case, there's both. The DHS has issued a Privacy Impact Assessment [PDF] that contains the guidelines for camera use by officers. This one directly addresses the ICE pilot program.

The rules laid down are actually pretty solid, which is somewhat surprising given the federal government's reluctance to adopt the tech and ICE's roguelike reputation.

ICE personnel must record Pilot enforcement activities at the start of the activity, or, if not practicable, as soon as safely possible thereafter. Once a Body Worn Camera is activated, ICE personnel should only deactivate the Body Worn Camera when their participation or involvement in the enforcement activity has concluded. If ICE personnel fail to activate their Body Worn Camera, or if the recording is interrupted, they must provide a statement detailing the reason why they failed to activate the Body Worn Camera or why the recording was interrupted.

ICE personnel will verbally notify (i.e., provide notice to) individuals that they are being recorded if (or as soon as) it is operationally feasible. This notice should not be construed as a requirement for ICE to obtain consent from the subjects being recorded. The Body Worn Camera will be placed on a visible location on ICE personnel’s outerwear (e.g., on vest or helmet) so that individuals can see the Body Worn Camera.

ICE personnel are prohibited from intentionally making Body Worn Camera recordings in places or areas where cameras generally are not allowed or permissible (e.g., locker rooms, dressing rooms, medical facilities, restrooms, in facilities where recording is prohibited) unless related to an enforcement activity.

ICE personnel should not record encounters with undercover officers, confidential informants, and cooperating defendants.

ICE personnel should not record in a manner that would infringe on activity protected by the First Amendment (e.g., lawful protests).

Body Worn Cameras will not be used during undercover operations or in situations in which it would pose a risk to officer or public safety.

Body Worn Camera recordings will not be used for any facial recognition activities.

All recordings collected during this pilot period will be saved. Anything of evidentiary value will be sorted out. Recordings can (at least theoretically) be obtained with FOIA requests.

Of some concern is the directive forbidding the recording of First Amendment activities. On one hand, you don't want federal agents to engage in surveillance of protected activities. On the other hand, you don't want any interactions between federal officers and protesters to go unrecorded. So, this will have to be refined. It would seem that the rule ordering the recording of all "enforcement activities" would supersede the rule forbidding the recording of First Amendment activities when officers interact with protesters. But it will probably be months or years before the public knows how ICE officers have chosen to interpret these rules.

Still, it's a good set of ground rules. And it gets a little better. ICE officers are expected to record any questioning of individuals (whether in custody or not), as well as any brief detentions or frisks of individuals they encounter. It's also mandatory for all warrant service and searches incident to an arrest.

Better late than never. And a far better set of rules than was expected, given both the federal government's resistance to early adoption and ICE's general unwillingness to welcome examination of its enforcement efforts. Hopefully, the rollout will continue with similar rules in place for other federal agencies. While body cameras aren't a panacea for law enforcement misconduct, they're far better than having nothing but an officer's word for what went down.

Filed Under: accountability, body cameras, dhs, ice, transparency

Fifth Circuit Says Man Can't Sue Federal Agencies For Allegedly Targeting Him After He Refused To Be An FBI Informant

from the hard-to-prove-anything-that-can't-be-confirmed-or-denied dept

The secrecy surrounding all things national security-related continues to thwart lawsuits alleging rights violations. The Fifth Circuit Court of Appeals has just dumped a complaint brought by Abdulaziz Ghedi, a naturalized American citizen who takes frequent trips to Somalia, the country he was born in. According to Ghedi's complaint, rejecting the advances of one federal agency has subjected him to continuous hassling by a number of other federal agencies.

The Appeals Court decision [PDF] opens with a paragraph that telegraphs the futility of Ghedi's effort, as well as the ongoing string of indignities the government has decided to inflict on people who just want to travel.

Abdulaziz Ghedi is an international businessman who regularly jets across the globe. Frequent travelers, however, are not always trusted travelers. In recent years, Ghedi has had repeated run-ins with one of America’s most beloved institutions: modern airport security.

The general indignities were replaced with seemingly more personal indignities when Ghedi decided he wasn't interested in working part-time for the feds.

Ghedi complains that ever since he refused to be an informant for the Federal Bureau of Investigation a decade ago, he has been placed on a watchlist, leading to “extreme burdens and hardship while traveling.”

This isn't a novel complaint. This has happened to plenty of immigrants and US citizens who visit countries the federal government finds interesting. Many, many Muslims have been approached by the FBI to work as informants. And many have reported their traveling experiences got noticeably worse when they refused to do so.

Without moving past a motion to dismiss, there can be no discovery. And national security concerns means there isn't going to be much to discover, even if a plaintiff survives a first round of filings.

Unsurprisingly, the Government refuses to confirm or deny anything.

That put Ghedi in the crosshairs of "a byzantine structure featuring an alphabet soup of federal agencies," as the court puts it. The DHS oversees everything. Day-to-day hassling is handled by the TSA (domestic travelers) and the CBP (international travelers). Ghedi saw more of one (CBP) than the other, but the TSA still handles screening of passengers and luggage, so he saw plenty of both.

The refusal to join the FBI as a paid informant apparently led to all of the following:

• an inability to print a boarding pass at home, requiring him to interact with ticketing agents “for an average of at least one hour, when government officials often appear and question” him;

• an SSSS designation on his boarding passes;

• TSA searches of his belongings, “with the searches usually lasting at least an hour”;

• TSA pat downs when departing the U.S. and CBP pat downs when returning to the U.S.;

• encounters with federal officers when boarding and deboarding planes;

• questioning and searches by CBP officers “for an average of two to three hours” after returning from international travel;

• CBP confiscation of his laptop and cellphone “for up to three weeks”;

• being taken off an airplane two times after boarding; and

• being detained for seven hours by DHS and CBP officials in Buffalo, New York in May 2012 and being detained in Dubai for two hours in March 2019.

Ghedi approached the DHS through its court-mandated redress program to inquire about his status twice -- once in 2012 and again in 2019. In both cases, the DHS refused to confirm or deny anything about his travel status or his placement on any watchlists that might result in enhanced screening and extended conversations with federal agents every time he flew.

Ghedi sued the heads of all the agencies involved, alleging rights violations stemming from his refusal to become an informant and his apparent placement on some watchlist operated by these agencies.

Ghedi brings two Fourth Amendment claims. The first alleges that the heads of the DHS, TSA, and CBP violated his Fourth Amendment rights through “prolonged detentions,” and “numerous invasive, warrantless patdown searches” lacking probable cause. The second alleges that the heads of the DHS, TSA, and CBP also violated his Fourth Amendment rights through their agents conducting “warrantless searches of his cell phones without probable cause.” The Fourth Amendment protects “[t]he right of the people to be secure in their persons . . . and effects, against unreasonable searches and seizures.”

The district court said he had no standing to sue. The Fifth Circuit says he does. But standing to sue doesn't matter if you sue the wrong people. The Appeals Court says there's a plausible injury alleged here, but it wasn't perpetrated by the named defendants.

Even though we hold that Ghedi has plausibly alleged an injury in fact, he still must satisfy standing’s second prong—that his injury is fairly traceable to these Defendants. Here Ghedi’s Fourth Amendment claims falter. That is because Ghedi bases his Fourth Amendment claims on TSA and CBP agents’ searching him and seizing his electronics. He argues these searches and seizures are atypical actions, even for people on the Selectee List. Yet instead of suing these agents directly, Ghedi has brought his Fourth Amendment claims against the heads of DHS, TSA, and CBP. Ghedi does not allege that any of these officials personally conducted or directed the searches or seizures he has experienced. And his allegations that his experiences are atypical cut against an inference that these agents are following official policy.

Not only that, but the court says Ghedi has never been prevented from traveling. At worst, traveling has become a constant hassle, marked by hours-long delays, unexplained device seizures, and plenty of unwanted conversations with federal agents. But ultimately Ghedi got where he was going and I guess that's good enough.

Ghedi never alleges that he was prevented from ultimately getting to his final destination. At most, these allegations lead to a reasonable inference that the Government has inconvenienced Ghedi. But they do not plausibly allege a deprivation of Ghedi’s right to travel.

There are some rights the court will recognize but this isn't one of them.

In short, Ghedi has no right to hassle-free travel. In the Supreme Court’s view, international travel is a “freedom” subject to “reasonable governmental regulation.” And when it comes to reasonable governmental regulation, our sister circuits have held that Government-caused inconveniences during international travel do not deprive a traveler’s right to travel.

And, putting the final nail in Ghedi's litigation coffin, the Appeals Court says the government's secrets may harm individuals but they can't harm their reputation… because they're secret.

As we noted at the outset, Ghedi’s status on the Selectee List is a Government secret. Simply put, secrets are not stigmas. The very harm that a stigma inflicts comes from its public nature. Ghedi pleaded no facts to support that the Government has ever published his status—one way or the other—on the Selectee List. His assertions that the Government has attached the “stigmatizing label of ‘suspected terrorist’” and “harm[ed] . . . his reputation” are legal conclusions, not factual allegations.

That's how it goes for litigants trying to sue over rights violations perpetrated by agencies engaged in the business of national security. Allegations are tough to verify because the government refuses to confirm, deny, or even discuss a great deal of its national security work in court. Ghedi could always try this lawsuit again, perhaps armed with FOIA'ed documents pertaining to his travels and the many agencies that make it difficult for him. But that's as unlikely to result in clarifying information for the same reason: national security.

Heads, the government wins. Tails, the plaintiff loses. Ghedi is still free to pursue lawsuits against the individual agents who hassled him, took his stuff, and tried to coerce him into becoming an informant, but given the national security implications and the ongoing existence of qualified immunity, it's just as likely he'd lose that suit as well.

Filed Under: 5th circuit, abdulaziz ghedi, civil rights, dhs, doj, fbi, informants, somalia

Inspector General Says CBP's Device Search Program Still A Mess, Still (Ironically) Mostly Undocumented

from the PAPERS-PLS dept

The CPB continues to increase the number of electronic devices (at least temporarily) seized and searched at border crossings and international airports. Basic searches -- ones that don't involve any additional tech or software -- can be performed for almost any reason. For deeper searches, the CBP needs only a little bit more: articulable suspicion.

Even though it's only a very small percentage of the total, it continues to increase, both in total numbers and as a percentage of the whole.

In fiscal year 2018, OFO processed more than 413 million travelers arriving at U.S. POEs and conducted an estimated 33,062 basic and advanced electronic device searches of those inbound travelers (.008 percent). In FY 2019, CBP processed more than 414 million travelers and conducted an estimated 40,610 basic and advanced electronic device searches of those inbound travelers (.010 percent).

That's from the DHS Inspector General's latest investigation [PDF] of CBP device searches. The last time the IG stopped by the CBP to perform some oversight in this area, it declared the whole thing a catastrophe. There was very little direct supervision of searches, documentation was almost nonexistent, and the CBP had no idea whether more searches were resulting in more investigations or arrests of criminals. Not only that, but the CBP had yet to implement any method of quantifying the security/safety gains of performing invasive device searches at border crossings.

Right at the top, the IG refers to the CBP's policy on device searches, which clearly and succinctly states the agency's obligations:

CBP’s Directive requires CBP officers to fully document all information related to searches of electronic devices.

You can already guess where this is headed.

First, there's a callback to the last investigation by the IG:

In our first audit of CBP’s searches of electronic devices at POEs [Ports of Entry], we reported deficiencies in supervision, guidance, equipment management, and performance measures and made five recommendations to improve the program’s effectiveness. CBP concurred with all five recommendations and has taken some actions to improve oversight, such as streamlining license renewals, developing processes to conduct annual field office reviews, and updating its self-inspection worksheet to better identify deficiencies. As of May 2021, CBP had not fully implemented four of five recommended corrective actions.

Since there's been no improvement on the back end, there's been no improvement on the front end.

Here's a more detailed description of what's required when a phone is searched by CBP personnel:

CBP’s Directive requires CBP officers to include all information related to the search, such as whether the device’s wireless data connection was disabled, a tear sheet was provided, and if a supervisor approved advanced searches. In instances in which OFO detains or seizes an electronic device, officers document such incidents on DHS Form 6051D, Detention Notice and Custody Receipt for Detained Property and DHS Form 6051S, Custody Receipt for Seized Property and Evidence, to demonstrate chain of custody. The Directive also tasks supervisors with ensuring officers complete thorough inspections and that all notification, documentation, and reporting requirements are met.

Here's what happened instead:

OFO [Office of Field Operations] did not always adhere to all requirements outlined in the Directive when conducting electronic device searches nor properly document searches. Of the 100 from FYs 2018 and 2019 that we reviewed, 79 had one or more instances of non-compliance, which totaled 139 instances. [...] We also identified 32 EMRs [electronic media reports] not approved by a supervisor within 7 days.

The largest number of infractions came from two areas: no indication of whether the device's data connection was disabled (27) -- something that's supposed to prevent agents from intercepting incoming communications or accessing content stored in the cloud -- and no indication of whether a supervisor was present for advanced searches (44), which is a violation of CBP policy.

That's just the problem with the stuff that's (apparently incompletely) documented. Then there are the cases where no documentation occurred at all.

During site visit... we identified instances in which OFO officials used advanced screening equipment to conduct advanced searches of electronic devices without documenting these searches in TECS. For example, in reviewing DOMEX activity log entries from the three POEs, we identified 33 advanced searches that were not documented in TECS.

CBP officials said these didn't need to be tracked because they were not related to new searches, but rather to ongoing investigations, training, and "ongoing maintenance." As proof of this claim, the officials offered nothing.

We could not confirm these assertions because OFO did not have controls to ensure all advanced searches were traceable to the officer conducting the search.

As for seeing if these searches are actually resulting in any net security and public safety gains, the CBP is still sort of working on that. There are existing metrics the CBP could use, but it has simply chosen not to.

According to an OFO official, OFO does not see the benefit of receiving the outcomes of referrals, or tracking prosecutions and convictions, and does not have a system to track or receive this information. Without tracking final legal disposition of devices and information transferred to other Federal agencies, OFO cannot fully evaluate the program’s effectiveness or whether advanced searches are achieving their intended purpose to detect evidence and identify crimes.

The refusal to properly track and document searches also causes problems elsewhere.

For example, OFO equipment used to search computers [equipment name redacted] has not functioned since July 2018 due to network compatibility issues. Because of these technical issues, officers at POEs cannot conduct advanced searches of computers on-site.

Here's the punchline:

Despite technical issues, OFO renewed the software licenses for all equipment in 2019 and 2020, including for equipment that does not function, at a total cost of $330,629.

Which leads to yet another punchline in the OIG's recommendations:

We recommend the Executive Assistant Commissioner for the Office of Field Operations: a. Suspend the renewal of licenses for nonfunctional equipment, as appropriate.

You think?

The report concludes like the last one did. Recommendations for the CBP to something -- anything! -- to improve its tracking and documentation of phone searches. And like last time, the CBP has promised to get right on that… eventually. And we the people can all expect more of the same in the 2022 report, given the lack of progress since the last IG review.

Filed Under: 4th amendment, cbp, device search, dhs, inspector general

CBP Facial Recognition Program Has Gathered 50 Million Face Photos, Identified Fewer Than 300 Imposters

from the more-buck-than-bang-at-this-point dept

The CBP and DHS have released their annual report [PDF] covering trade and travel. It touts the agencies' successes in these areas but raises some questions about the use of facial recognition tech to make the nation safer.

Dave Gershgorn, writing for One Zero, points out the system the DHS and CBP claim is essential to national security isn't doing much to secure the nation. And it's not for a lack of input data.

U.S. Customs and Border Protection scanned more than 23 million people with facial recognition technology at airports, seaports, and pedestrian crossings in 2020, the agency recently revealed in its annual report on trade and travel.

The agency scanned four million more people than in 2019. The report indicates that the system caught no imposters traveling through airports last year and fewer than 100 new pedestrian imposters.

There are two ways of looking at this -- neither of which justify the DHS's aggressive expansion of biometric collection at airports, border crossings, and any other place travelers might be found.

This low number of imposters recognized could indicate the system is flawed -- incapable of accurately doing the job it's supposed to do: recognize faces. This is a problem inherent to every facial recognition algorithm being used anywhere. The tech tends to be most accurate when presented with white male faces. Everyone else is subjected to higher risk of being misidentified, which can lead to false arrests or being prevented from traveling.

But it could also indicate imposters aren't all that common -- certainly not common enough to justify the erection of a mass surveillance system that gives travelers the option of giving up their biometric info or not traveling.

The CBP only began tracking and publishing stats in 2018, trailing its biometric rollout by a couple of years. Since 2018, the government has caught less than 300 imposters. Over that same time period, it performed 50 million face scans. That's a pretty terrible return on investment. But that's not how the CBP portrays this in its report:

Biometrics have proven an effective tool to combat the use of stolen and fraudulent travel and identity documents. Since the program’s inception, in 2018, CBP officers at U.S. airports have successfully intercepted seven impostors who were denied admission to the United States and identified 285 imposters on arrival in the land pedestrian environment.

I guess it all depends on what your definition of "effective" is. The CBP's expansive definition suggests literally any number above zero justifies the cost of the tech and its attendant surveillance creep.

Of course, if the real purpose of the program is to create a massive database of facial photos and personal information, it's been a tremendous success. And if that's all the CBP and DHS expect from it, it will continue to perform this task with minimal interruption.

But travelers and taxpayers should expect more from the DHS and its agencies. Spending millions to deal with a minor problem by deploying tech that remains unproven shouldn't be considered acceptable. Neither is the alternative: a system that rarely recognizes imposters, allowing government agencies to assume it's less of a problem than it might actually be.

Filed Under: cbp, dhs, facial recognition, national security, privacy, security theater, surveillance

Texas Immigration Lawyer Sues DHS, CBP Over Seizure And Search Of His Work Phone

from the most-likely-place-to-find-plenty-of-privileged-information dept

A Texas immigration lawyer is suing the DHS and CBP over one of its infamous border device searches. His attempt to keep the federal government from accessing privileged attorney-client communications was rebuffed by CBP officers who decided they'd just keep his phone until they were able to access the contents. This is especially problematic considering the lawyer, Adam Malik, is representing clients currently engaged in lawsuits and other legal actions against or involving both the DHS and CBP. (via ABA Journal)

Another troubling aspect of this case is that Malik had already proved his non-terrorist bona fides to the federal government well before CBP officers decided he was in need of some enhanced screening. From the lawsuit [PDF]:

To facilitate his extensive travel, Mr. Malik applied for and received membership in CBP’s Global Entry Trusted Traveler Program (“Global Entry”). DHS approved him for Global Entry on or about November 2014 and approved his renewal in 2019.

To receive membership in Global Entry, Mr. Malik passed a layer of extremely thorough security checks conducted by DHS. Mr. Malik passed a DHS conducted background check against criminal, law enforcement, customs, immigration, agriculture, and terrorist indices, a process that includes fingerprinting. He also passed an in-person interview with a DHS security officer.

Despite being a government-ordained "Trusted Traveler," Malik was detained upon his return from a trip to Costa Rica. During his trip, he had communicated with clients using his law firm issued iPhone. The CBP officers told Malik he had been "randomly selected" for an "eligibility review." Once they had him detained, they questioned him about his personal life, family, and immigration history.

More worryingly, they questioned him about his legal practice and clients, demanding to know who he was representing and which cases he had handled. Obviously, this involved plenty of litigation work involving the same agency now questioning him. Malik refused to answer those questions. That made the CBP unhappy, leading to the incident at the center of this lawsuit.

During interrogation, Officer Sullivan displayed anger to Mr. Malik when Mr. Malik would not reveal Privileged Information. In response to Mr. Malik’s assertion of privilege, Officer Sullivan asked Mr. Malik to place the iPhone on the table. Mr. Malik placed the iPhone on the table.

Officer Sullivan asked Mr. Malik to unlock the iPhone so that the digital contents could be inspected.

Mr. Malik explained to Officer Sullivan that the iPhone contains extensive Privileged Information and allows for the accessing of Privileged Information that is stored remotely. Mr. Malik told Officer Sullivan that he cannot consent to the search of the iPhone.

Texas bar rules prohibit divulging privileged information. Not that it mattered to the CBP officer, who took everything a disturbing step further.

In response to Mr. Malik’s assertion of privilege, Officer Sullivan informed Mr. Malik that DHS was seizing the iPhone and that the digital contents would be searched. Officer Sullivan did not disconnect the iPhone from the internet or the communications network. He failed to take action that would protect the iPhone from accessing the internet or a communications network. Officer Sullivan ordered Mr. Malik to leave the deferred inspection area without the iPhone while the iPhone still was connected to the internet and a communications network.

Neither Officer Sullivan nor any other employee of Defendants asked Mr. Malik to disable connectivity of the iPhone to the internet or to any network. Had Officer Sullivan or any employee of Defendants offered to permit Mr. Malik to place the iPhone in airplane mode upon or after seizure of the iPhone, Mr. Malik would have done so immediately.

As the lawsuit notes, the CBP is given broad discretion on device searches. It can perform basic or in-depth searches of phones without a warrant and with nothing more than reasonable suspicion evidence of a crime may be found on the devices. It also has some national security powers which give it even more leeway. However, there's nothing reasonably suspicious about someone denying access to privileged communications, especially when doing so means they're abiding by their legal obligations as an attorney, rather than shirking them to avoid further border control nastiness from federal officers with too much power and too little oversight.

Despite all this leeway, Malik says the CBP still violated its very permissive directives. It did not attempt to disconnect the phone from any network, which would have allowed it access to data in motion, rather than just data at rest. It did not make any effort to restrict its search to non-privileged information by use of a filter team. Instead, it seized Malik's phone and searched its contents with it connected to the internet and without the aid of anything that would have steered it clear of information it had no business seeing. According to the lawsuit, the CBP is still in possession of the phone, nearly a month after it seized it.

As evidence of the illegal search, Malik states that he received a request for a verification code from FLYP (a call, text, and voicemail app) one day after he was forced to leave his phone in the CBP's possession. This indicated the phone was still connected to the internet and the CBP had unlocked the device.

Two weeks after seizing the phone, the CBP finally got around to getting a filter team together. It sent an email to Malik demanding a list of clients and their contact info. Supposedly this was to identify who his clients were so the CBP wouldn't access those communications. But, as Malik points out, he is forbidden from providing that information. Not only that, but identifying current and future litigants would compromise them and make them more susceptible to adverse actions by agencies opposing them or targeted by litigation.

Plaintiffs are prohibited from identifying such names because the identification for most, if not all the individuals, are connected inextricably with the privileged and confidential purpose for which the clients sought legal advice.

Part of the Privileged Information contained on the iPhone and on the remote servers is identifiable only by a telephone number of the client. Telephone numbers of the clients are privileged and confidential and will lead to exposure of Privileged Information.

Filter team protocols suck when searches are performed by defendants in lawsuits filed by the lawyer whose phone they've seized.

CBP’s proposed filter team as implemented and as articulated in the Directive, creates the appearance of and potential for improprieties. The Directive authorizes CBP officers to rummage through attorney-client communications. The use of the filter team in these circumstances will chill the free flow of information between clients and lawyers.

Malik asserts a number of First and Fourth Amendment violations. The seizure and search of communications and other information protected by the First Amendment ("expressive content, associational information, and private information") without reasonable suspicion of criminal activity is just one of the problems. The same lack of suspicion carries over the Fourth Amendment, which guards against "unreasonable" searches, no matter what their context.

In addition to findings in favor of his Constitutional claims, Malik is also asking for an independent team to be involved in the search of information on the iPhone and to be given the right to challenge any search that may result in privileged communications being accessed by the government. He also wants CBP blocked from searching the phone until his demands are met and a Special Master put in place to oversee the search. Finally, he asks for a permanent injunction blocking the government from searching the phone at all, which, if granted, would make the intermediate demands unnecessary.

From these allegations, it appears the CBP retaliated against the lawyer because he refused to break his code of ethics. And it appears CBP officers were willing to violate long-held ethics itself if this "Trusted Traveler" wouldn't do it for them. This is the unsurprising side effect of giving border control agencies almost complete control over travelers and their possessions. When there are few restraints, very few will act with restraint. Hopefully a lawsuit like this will start nudging our borders back into Constitutional territory.

Filed Under: 4th amendment, adam malik, attorney client privilege, cbp, dhs, seizure, texas

The SolarWinds Hack Is Just The Same Sort Of Espionage The US Government Engages In Every Day

from the ugly-and-inconvenient-truth dept

A historic hack of unprecedented scale has set off alarms in the US government -- itself a target of suspected Russian hackers who leveraged IT infrastructure company SolarWinds' massive customer base to compromise an unknown number of victims. Among those victims were several US government agencies, including the DHS's cybersecurity wing, which announced its own breach hours after issuing a dire warning to potentially affected government agencies.

Is it time to panic? No, says the lame duck president, who claims this is already "under control" -- something that very definitely isn't true. SolarWinds says it has 18,000 customers using the affected Orion software. And many of those customers (which include Fortune 500 companies and major telcos/service providers) have thousands of customers of their own -- all of which may be operating compromised systems. The DHS said the only way to ensure systems are clear of this threat was to airgap them and uninstall the infected software.

Others who have been briefed on the hack are far less cheery about its ongoing impact. Trump tweeted there was nothing to worry about. Republican allies seem more concerned than the man who won't have to worry about this for much longer.

Shortly after Mr. Trump’s tweet, Sen. Marco Rubio (R., Fla), acting chairman of the Senate Intelligence Committee, said it was “increasingly clear that Russian intelligence conducted the gravest cyber intrusion in our history.”

Mr. Rubio added on Twitter that efforts to determine the extent and damage of the hack were ongoing and that remediation would take significant time and resources. “Our response must be proportional but significant,” he said.

The 2050s will be like 1950s, apparently: with America in the midst of another Cold War.

But is it true this is the "gravest cyber intrusion in our history?" Or is it just the "gravest" intrusion that's targeted us? After all, the Russians don't have a monopoly on government-ordained hacking. Our intelligence and security agencies deploy their own persistent threats -- something we've done for years with minimal blowback. These calls for a cyber war by pundits and government officials aren't anything to be applauded. I don't think America really wants to get involved in another forever war -- one whose wins and losses can't be tallied with temporary "liberations" and body bag back orders.

Let's be cautious, says Jack Goldsmith. Better yet, let's be aware of the hypocrisy of the stance some government officials are demanding we take.

The lack of self-awareness in these and similar reactions to the Russia breach is astounding. The U.S. government has no principled basis to complain about the Russia hack, much less retaliate for it with military means, since the U.S. government hacks foreign government networks on a huge scale every day.

Turning a cyber war into a shooting war isn't just an overreaction. It's illegal under international law. That doesn't mean nothing should be done about it. It just means the US government can't pretend it doesn't engage in the same activities some now want to go to war over. What's happened here might be unprecedented in scale, but it's the same thing every government with enough resources has done for years. It's not a war waiting to happen. It's business as usual.

Peacetime government-to-government espionage is as old as the international system and is today widely practiced, especially via electronic surveillance. It can cause enormous damage to national security, as the Russian hack surely does. But it does not violate international law or norms.

In recent years, the US government has deployed more offensive weapons in hopes of deterring cyber attacks. It really hasn't worked. Meeting escalation with more escalation is unlikely to change the standard operating procedures of espionage, especially since the US government hasn't rolled back its offensive efforts in the wake of massive breaches.

But there may be a way forward -- one almost impossible to achieve but promising enough it shouldn't be dismissed out of hand.

[The US government] has not seriously considered the traditional third option when defense and deterrence fail in the face of a foreign threat: mutual restraint, whereby the United States agrees to curb certain activities in foreign networks in exchange for forbearance by our adversaries in our networks. There are many serious hurdles to making such cooperation work, including precise agreement on each side’s restraint, and verification. But given our deep digital dependency and the persistent failure of defense and deterrence to protect our digital systems, cooperation is at least worth exploring.

There's no moral high ground to claim here. And refusing to consider bringing some of our cyber boys back home leaves us with nothing but continuous escalation. This hack is raising uncomfortable questions about our own practices. Let's see if anyone in the White House is willing to honestly confront the consequences of our own actions and find another route towards safety and national security.

Filed Under: cyber war, cybersecurity, dhs, hacks, hypocrisy, nsa, russia, surveillance, us
Companies: solarwinds

Security Researcher Reveals Solarwinds' Update Server Was 'Secured' With The Password 'solarwinds123'

from the [checks-luggage-combination] dept

As was noted here earlier, up to 18,000 customers of globally-dominant network infrastructure vendor SolarWinds may have been compromised by malicious hackers. The hackers -- presumed to be operating on behalf of the Russian government -- deployed tainted updates (served up by SolarWinds) that gave them backdoors to snoop on internal communications and exfiltrate sensitive data.

The attack was so widespread and potentially catastrophic, the DHS's cyber wing issued an emergency directive that stated the only way to mitigate damage was to airgap devices and uninstall affected Orion software. Meanwhile, SolarWinds filed an update with the SEC detailing the extent of the damage. It was limited, but only if you consider 18-33,000 potential infections "limited." It's only a small percentage because Solarwinds's customer base is so large. The company boasts 300,000 customers, among them several government agencies and all five branches of the military. (It's not boasting much these days. It has memory-holed its "Customer" page during this trying time.)

Unfortunately, the directive from CISA was delivered a bit too late. CISA itself was compromised by the hack, something acknowledged by the DHS less than 24 hours after its dire directive was issued.

The fallout from this hacking -- which may have begun as early as March of this year -- will continue for a long, long time. But this latest news -- delivered by Zack Whittaker -- adds another layer of irony to the ongoing debacle. Orion is Solarwinds' one-stop shop for IT software. It promises to secure customers' IT infrastructure by bundling in the company's network security products.

No doubt the company claims to take security seriously. But while users are being subjected to password requirements that demand them to utilize most of the alphabet and multiple shift key presses, internal security isn't nearly as restrictive. Here's the "OMFG are you goddamn kidding me" news via Reuters, which first broke the news of the malicious hacking.

Security researcher Vinoth Kumar told Reuters that, last year, he alerted the company that anyone could access SolarWinds’ update server by using the password “solarwinds123”.

All five branches of the military. The NSA. The IRS. The USPS. DHS. The Treasury Department. Nearly every Fortune 500 company. All ten of the top ten telcos. The list goes on and on. And with this access, attackers could move laterally, using compromised credentials to eavesdrop on mutuals of targeted entities. And all of this "secured" by a password so simple an idiot could have created it.

We're fucked. And we're fucked by people making far more money than we are who take our security far less seriously than we do. Say what you will about the security ambivalence of the general public, but it's the "experts" who endanger us with lax security measures who do the most damage. If Joe Blow fails to secure his email account, he's probably only going to hurt himself. When a multinational vendor can't be bothered to gin up a decent password, entire government agencies become a plaything for malicious hackers.

Filed Under: dhs, hackers, infrastructure, passwords, security
Companies: solarwinds

ICE Withdraws Demand For Journalists' Sources After Having Its Unconstitutional Demand Outed By BuzzFeed

from the government-is-kindly-invited-to-go-fuck-itself dept

They say "sunshine is the best disinfectant." Sometimes, though, sunshine is the best RAID. When you've got government cockroaches (feel free to pronounce it like Tony Montana) trying to crawl all over your stuff, the best thing you can do is point all the wattage/candlepower you can on its indiscretions.

Earlier this month, ICE tried to pull some fucked up shit. It sent a subpoena -- one issued by its office, not a judge -- to BuzzFeed. It asked the journalists there to turn over information on their sources, apparently in hopes of closing the loop on internal investigations into leaked documents.

BuzzFeed refused. Even better, BuzzFeed posted the bullshit "request" ICE made -- one that asked the site's journalists to remain silent in the face of government overreach. The subpoena came with this request appended;

“You are requested not to disclose the existence of this summons for an indefinite period of time. Any such disclosure will impede this investigation and thereby interfere with the enforcement of federal law.”

BuzzFeed ignored this, along with the rest of the subpoena. Which it should. This was just internal paperwork masquerading as a government-sanctioned order. ICE has no legal right to demand information on BuzzFeed's sources. It seems highly unlikely any court would allow this incursion on First Amendment protections. Bypassing the court by issuing its own paperwork shouldn't be allowed. But somehow it is. Journalistic concerns know these requests are worth less than the paper they're printed on. The problem is that not everyone knows that and degenerates like ICE are counting on people being ignorant of their Constitutional rights and protections.

BuzzFeed knows what the government can and can't do without judicial blessing. So it published its refusal along with ICE's faux "demand" it remain silent about the agency's attempted Constitutional bypass. In response to its garbage being made public domain, ICE has rescinded its attempt to turn confidential sources into government witnesses/prosecution targets.

Immigration and Customs Enforcement officials said Wednesday that it would not enforce a subpoena issued last week demanding BuzzFeed News identify its sources, a retreat from its earlier, stunning attempt to interfere with a news outlet operating under the protections of the First Amendment.

By "won't," ICE means "can't." It would be the rare judge that would approve of ICE violating long-held First Amendment protections for journalists and their sources. Even if they found a compliant judicial pawn, any challenge by BuzzFeed would see this bogus subpoena tossed onto the trash heap of ICE's trash history by the next judge down the line.

The government cannot do this. And the government knows this. That ICE even tried indicates it's been huffing whatever the Trump administration has been shoving into its paper bags. Just because the outgoing Prez has a hard-on for booting brown people out of the country doesn't change the Constitutional calculus.

Filed Under: dhs, ice, journalism, protecting sources, sources, subpoena
Companies: buzzfeed

DHS Inspector General Is Going To Take A Look At The DHS's Purchase Of Cell Location Data From Data Brokers

from the it's-about-time-someone-other-than-Ron-Wyden-looked-into-this dept

DHS components are buying up cell location data from third parties to track down undocumented immigrants and whoever else ICE and CBP might be interested in. The IRS is doing the same thing. So is the Department of Defense.

The location data is harvested from dozens of phone apps. This data makes its way to a variety of data brokers -- often without the explicit knowledge of app users or developers -- who then sell access to government agencies. This access seems to violate the spirit of the Supreme Court's Carpenter decision (which erected a warrant requirement for cell site location info), if not the actual letter of ruling.

This has drawn the attention of a number of Senators, including Ron Wyden. In response to Senate questions, the Inspector General for the IRS has opened an investigation into the agency's practice of buying location data from private companies.

The DHS is now undergoing the same scrutiny.

The department’s inspector general told five Democratic senators that his office would initiate an audit “to determine if the Department of Homeland Security (DHS) and its components have developed, updated, and adhered to policies related to cell-phone surveillance devices,” according to a letter sent last week to Capitol Hill and shared with The Wall Street Journal.

The letter came in response to a request in October from Sens. Ron Wyden (D., Ore.), Elizabeth Warren (D., Mass.), Sherrod Brown (D., Ohio), Ed Markey (D., Mass.) and Brian Schatz (D., Hawaii) to probe whether the purchase of commercial cellphone data on Americans for law-enforcement purposes was lawful.

This is welcome news, considering no agency has offered up a legal rationale for dodging apparent warrant requirements by purchasing data from third party brokers -- brokers who are an additional hop away from the third parties who collected the data in the first place. When even app developers aren't sure whose buying their data, it's pretty difficult to argue anyone tracked via this method knowingly and voluntarily "shared" their location with the data brokers selling access to the government.

This won't be the only investigation either. The DHS IG is also looking into other "open source" intel gathering performed by DHS agencies. The guidelines for gathering intel from social media accounts and other publicly accessible internet services hasn't been explained sufficiently and/or examined by the DHS's Congressional oversight.

Unfortunately, this investigation may not lead to the termination of this data collection. The DHS's general counsel has already declared this to be legal -- something revealed by BuzzFeed earlier this year.

In an internal memo obtained by BuzzFeed News, the DHS's top attorney, Chad Mizelle, outlined how ICE officials can look up locations and track cellphone data activity to make decisions on enforcement.

Mizelle also believes the agency can use the data without obtaining a warrant or violating the Fourth Amendment, which protects the public against unreasonable searches and seizures.

That's the pitch the DHS is making. It hasn't made that pitch publicly, however. BuzzFeed's reporting covered a leaked memo. This claim hasn't been made on the record and, given the flexible contours of the Supreme Court's Carpenter decision, there's a good chance it won't hold up in court, much less under Congressional scrutiny. But, as it stands now, these agencies are still in the location data buying business until further notice.

Filed Under: 4th amendment, data brokers, dhs, inspector general, location data, privacy