Swiss Court Says ProtonMail Isn't A Telecom, Isn't Obligated To Retain Data On Users

from the neutral-good-remains-a-pretty-solid-alignment dept

ProtonMail offers encrypted email, something that suggests it's more privacy conscious than others operating in the same arena. But, being located in Switzerland, it's subject to that country's laws. That has caused some friction between its privacy protection claims and its obligations to the Swiss government, which, earlier this year, rubbed French activists the wrong way when their IP addresses were handed over to French authorities.

The problem here wasn't necessarily the compliance with local laws. It was Proton's claim that it did not retain this information. If it truly didn't, it would not have been able to comply with this request. But it is required by local law to retain a certain amount of information. This incident coming to light resulted in ProtonMail altering the wording on its site to reflect this fact. It no longer claimed it did not retain this info. The new statement merely says this info "belongs" to users and Proton's encryption ensures it won't end up in the hands of advertisers.

Proton's retention of this data was the result of a Swiss data retention law and, more recently, a revocation of its ability to operate largely outside the confines of this law. Terry Ang of Jurist explains the how and why behind Proton's relinquishment of IP addresses to French authorities, which resulted in its challenge of the applicability of the local data retention law.

The company lodged an appeal last month after the PTSS [Swiss Post and Telecommunications Surveillance Service) abruptly revoked Proton’s limited surveillance obligations in September 2020. Before that order, they were only required to provide IP addresses to surveillance departments in situations of “extreme criminal cases.” The company was also protected by article 271 of the Swiss Criminal Code, which means that data submission for surveillance purposes is supposed to be approved by the Swiss government.

But as a result of the sudden policy change, the company was forced to surrender IP addresses of climate activists, leading to several arrests by the French authorities. The company was also subjected to new data retention obligations for future surveillance purposes.

It's these retention obligations that have been challenged. These obligations undercut earlier promises made by Proton to its users -- the ones that resulted in a rewrite of its privacy guarantees as well as its cooperation with French authorities.

Fortunately for ProtonMail and its users, surveillance of the service will go back to being more limited. The Swiss Federal Administrative Court has sided with Proton, finding that it is not a service provider under the definitions included in the data retention law.

The Court on Friday concluded that email services are different from conventional telecommunication providers in Switzerland, and thus, should not be subject to the same kinds of data storage requirements. The Court followed a recent Swiss Supreme Court ruling in April that clarifies the status of instant messaging, video and telephone app services such as WhatsApp, Threema, Zoom and Skype. In that case, the Supreme Court stated that such applications and services are not considered telecom service providers, but classified as “over-the-top” (OTT) service providers.

This should allow ProtonMail to go back to offering users the privacy protections they thought they had until news reports indicated otherwise. But users should be aware that email services generate a lot more data and metadata than encrypted chat services, which means there's more stuff laying around for investigators (and oppressive governments) to demand or utilize should the opportunity arise. But it's still a significant win for the service -- one that also reaffirms that not all communication service providers are telecom service providers, and shouldn't be subject to the same data retention obligations.

Filed Under: data, data retention, email, law enforcement, logging, privacy, ptss, switzerland
Companies: proton mail

ProtonMail Turned Over French Activist's IP Address To Law Enforcement Following A Request From Swiss Authorities

from the vet-your-secure-providers,-folks dept

ProtonMail has long advertised itself as a particularly privacy-conscious email service. The free end-to-end encrypted email service promises more privacy and security than many of its competitors. But there are limits. ProtonMail operates out of Switzerland, making it subject to that country's laws (which, to be fair, are hardly draconian). It also (at least temporarily) retains a certain amount of information about users' emails -- metadata that can be used to verify accounts in the case of a lost password.

And while email between ProtonMail accounts is encrypted, the same protection isn't applied to emails between services, like communications sent to or from ProtonMail from other email services. This is an understandable limitation, which is why many seeking secure communications have moved to encrypted messaging services, rather than email offerings that collect metadata about communications.

These inherent weaknesses have been exploited by French law enforcement to obtain information about a French activist -- something it achieved with the assistance of Swiss authorities.

ProtonMail, a hosted email service with a focus on end-to-end encrypted communications, has been facing criticism after a police report showed that French authorities managed to obtain the IP address of a French activist who was using the online service. The company has communicated widely about the incident, stating that it doesn’t log IP addresses by default and it only complies with local regulation — in that case Swiss law. While ProtonMail didn’t cooperate with French authorities, French police sent a request to Swiss police via Europol to force the company to obtain the IP address of one of its users.

ProtonMail wasn't able to hand over much information due to its refusal to gather much information about its users. But it did hand over some, which made it clear that ProtonMail not only collects some email metadata, but will actively collect more metadata if forced to do so by local law. French law may not apply to the Swiss-based email company, but Swiss law certainly does.

Proton's founder, Andy Yen, offered up this explanation, which said local law supersedes the privacy ProtonMail claims it offers its users.

Proton must comply with Swiss law. As soon as a crime is committed, privacy protections can be suspended and we're required by Swiss law to answer requests from Swiss authorities.

And that's how foreign governments can extract information from an encrypted email service that gives users the impression that it's capable of protecting even the limited information it collects from nosy officials. The message going forward, however, is that ProtonMail is subject to the laws of multiple countries in the European Union and will comply with Europol orders if issued/forwarded by Swiss authorities.

As Karl Bode (hey, I know that guy!) points out in his article for Motherboard, there are two problems here. The first is that what's advertised appears to exceed what ProtonMail can actually guarantee its users. The other problem is the communication method itself, which generates a lot of information that other communication methods don't, creating a metadata paper trail that can be scooped up/gathered in bulk by law enforcement and intelligence agencies.

While ProtonMail does take some steps to protect user privacy better than other email service providers, the fact remains that email is inherently a protocol that requires a lot of information to be shared between parties, and is notoriously difficult to encrypt.

[...]

Ultimately, many of the security and privacy weaknesses are not necessarily ProtonMail's fault but are weaknesses with email itself. Security experts have pointed out that for highly sensitive communications, email is almost never the best option.

These unavoidable facts -- along with its cooperation with French and Swiss authorities -- have led ProtonMail to revise its claims about user data. It no longer claims it does not collect personal information to create accounts or log IP information "by default."

It now says simply:

ProtonMail is email that respects privacy and puts people (not advertisers) first. Your data belongs to you, and our encryption ensures that.

Well, except for when your data is subject to Swiss government demands for data, either directly or by proxy. User beware is the rule going forward now that this successful metadata grab has been exposed.

Filed Under: email, encryption, france, ip address, metadata, privacy, switzerland
Companies: protonmail

Texas Legislature Has Another Ridiculous And Unconstitutional Content Moderation Bill; Say Goodbye To Email Filters

from the it-does-what-now? dept

You may recall last month we wrote about how the Texas legislature -- even after seeing a similar Florida bill go down in the flames of Constitutional fire -- decided to launch a special legislative session solely to focus on passing culture war legislation that plays well with ignorant voters. The bill we saw last month was in the Senate and was SB5. Now there's another bill in the House called HB20, and it's really, really dumb.

First, it tries to just outright declare social media websites common carriers, despite them possessing basically none of the characteristics of a traditional common carrier. As a side note, I find it funny how Republicans these days are obsessed with this idea of randomly declaring companies "common carriers," as they spent decades fighting against any attempt to call broadband companies common carriers, and insisting that common carrier concepts were the root of socialism or something. But, apparently, when it comes to culture wars, things like principles, consistency, and just basic common logic go out the window in favor of nonsense.

Incredibly, this bill doesn't just talk about social media -- but sweeps up email services as well. Hope you enjoyed having email filters, because Texans, you can kiss those goodbye. The legislature thinks that not forcing junk you don't want into your account violates the spammer's rights apparently. I only wish I were joking, but an actual person in a legislature put this nonsense in a bill:

IMPEDING ELECTRONIC MAIL MESSAGES PROHIBITED. An electronic mail service provider may not intentionally impede the transmission of another person ’s electronic mail message unless:

(1) the provider is authorized to block the transmission under Section 321.114; or

(2) the message contains a computer virus, as defined by Section 33.01, Penal Code, obscene material, material depicting sexual conduct, or material that violates other law.

Now, 321.114 is Texas's anti-spam law, so there's a weird contradiction here. You can't block messages... except if you think it's spam. That'll be fun to sort out in court. Of course, there are all sorts of reasons for filters that have nothing to do with spam. I get a ton of email, so I use a special filtering service that routes my mail to different boxes -- including sending certain PR emails straight into the trash. As I read this bill, that would no longer be allowed in Texas.

And this includes monetary fines. So the PR folks who are mad that I never read their emails could sue for $10 for each message "unlawfully impeded" and $25,000 for each day that their emails are so impeded as well.

I mean, seriously, what the fuck does the Texas legislature think its doing here, trying to effectively ban email filtering?

Anyway, the rest of the bill is the usual garbage -- demanding a bunch of busywork about clearer explanations of terms of service and transparency reports, while making it possible for the Texas Attorney General to sue a website if it moderates in a way the Attorney General believes is unfair (hey, that's unconstitutional!).

The whole thing is garbage that is better off used for kindling in the next Texas ice storm, not as an actual bill. It would be an absolute nightmare for social media and email providers. And for what? Because some ignorant fools think they're being targeted for their edgy ideas, when the reality is that some websites just don't want to deal with assholes? Texans, stop being babies, and grow up.

Filed Under: 1st amendment, content moderation, email, section 230, social media, texas

Federal Judge Says FBI Obtained Twitter Employee's Emails Illegally

from the sliding-under-the-low-bar-of-probable-cause dept

In late 2019, the federal government indicted a Twitter employee, accusing him of acting as an agent of Saudi government. The allegations were pretty ugly.

Defendants Ahmad Abouammo, Ali Alzabarah, and Ahmed Almutairi were charged by Indictment on November 19, 2019 for acting as agents of the government of Saudi Arabia without notification to the Attorney General as required by law. Abouammo and Alzabarah, while employees at Twitter, accessed without authorization and provided to officials of the government of Saudi Arabia nonpublic information about Twitter users that were of interest to the government of Saudi Arabia, including dissidents and critics of the government.

No one needs to be helping the Saudi government hunt down dissidents. This is a government that has actually killed a journalist critical of the Saudi prince -- a killing followed by a dismemberment that occurred in the Saudi government's Istanbul consulate.

The accusations were that Abouammo used his position as media partner manager for Twitter's Middle East presence to access information about accounts the Saudi government wanted to spy on. The government has been pursuing a conviction for a couple of years now and has just been hit with a little bad news. It appears the FBI colored outside the constitutional lines while compiling evidence against Abouammo. Here's Nicholas Iovino with more details for Courthouse News Service:

In August 2016, the FBI seized Abouammo’s Google account records, which revealed that a Saudi foreign official had emailed the defendant around the same time Abouammo started suddenly and frequently accessing a prominent Saudi critic’s user account, according to federal prosecutors.

Prosecutors say the email exchange also coincided with Abouammo meeting the Saudi foreign official in London, receiving a $20,000 watch from that same official and having numerous phone conversations with the Saudi representative.

Abouammo asked U.S. District Judge Edward Chen to throw out that evidence, arguing the FBI failed to establish probable cause in a search warrant application before confiscating his personal data.

On Tuesday, Chen partly granted Abouammo’s request.

The ruling [PDF] says the FBI used a bit of guesswork in a warrant affidavit, allowing presuppositions to replace facts. That sort of thing doesn't comply with the Fourth Amendment.

Even assuming a deferential scope of review of the magistrate judge’s determination, see United States v. Wright, 215 F.3d 1020, 1025 (9th Cir. 2000), it is clear there was no probable cause to support the 2016 search. While there was probable cause to believe Defendant Ali Alzabarah accessed Twitter user information without authorization and that it was done at the behest of Foreign Official-1, there was no such probable cause with respect to Defendant Abouammo.

The indictment says one thing, but the affidavit the FBI used to obtain information says another.

There is no allegation that Defendant Abouammo, a U.S. citizen born in Egypt with no personal ties to Saudi Arabia, obtained unauthorized access to Twitter users, much less at the behest of the Saudi government. The circumstantial evidence of communications reveal little more than sporadic unremarkable communications with these subjects which does not fit any pattern with the illicit conduct of Defendant Alzabarah or Official-1.

And there may not even be any conspiracy… or at least none alleged sufficiently in the warrant affidavit seeking information from Google.

Other than being reciprocal Twitter followers, there is no evidence of any communication between Defendant Abouammo and Defendant Alzabarah. Similarly, there is little communication between Defendant Abouammo and Defendant Almutairi cited in the affidavit – i.e., two text messages in December 2014 prior to the alleged unlawful conduct of Defendant Alzabarah which started in January 2015.

From what the judge can see, there's hardly any connective tissue between the allegations made by the government and the justifications it put in its affidavit when seeking a search warrant.

Defendant Abouammo’s emails to other senior Twitter directors who were located in other countries (outside the U.S. and Saudi Arabia) in December 2015 and January and February 2016 also prove nothing. There is no allegation that these directors were involved in any unauthorized access to use accounts or were connected with Official-1 or the Saudi government. Furthermore, the emails were sent to these directors’ Twitter email accounts, hardly a way to solicit participation in an illicit scheme as the government now suggests. That certain Saudi officials (other than Official-1) were brought into conversations in email exchanges with one of the Twitter directors again proves nothing. The sporadic patternless communications described in the affidavit – which include no direct communications with Defendant Alzabarah and two early (2014) text messages with Defendant Almutairi – are insufficient to establish probable cause to believe Defendant Abouammo had accessed without authorization Twitter user accounts at the behest of the Saudi government.

The results of this search will be suppressed. The government simply doesn't have enough to justify this search. And the warrant is so deficient the court doesn't see how the government could say it relied on it in good faith. Everything derived from this search is suppressed.

But that doesn't mean Aboumammo is in the clear. Subsequent searches appear to have turned up other usable evidence and those still stand for the time being. The FBI's 2018 search warrant (and the results of that search) is still in play, even when everything derived from the 2016 search is stripped from the affidavit.

Given what's said in this short suppression order, it appears the FBI turned a hunch into a fishing expedition at Google HQ. If the government wants to prosecute federal crimes, it needs to remember all the rights it said were inalienable. Searches based on speculation aren't acceptable. And hey, FBI: maybe don't be evil.

Filed Under: 4th amendment, ahmad abouammo, ahmed almutairi, ali alzabarah, email, espionage, fbi, probable cause, saudi arabia, warrant
Companies: twitter

Appeals Court: Just Because Someone Used An Email Account To Send Threats Doesn't Make It An 'Interstate' Crime

from the is-that-a-federal-charge-in-your-pocket-or-are-you-just-happy-to-see-me dept

If you want to turn a local crime federal, all you need is the internet. This has been the federal government's M.O. for years: bring federal charges as often as you can because everyone uses the internet to communicate. A plethora of content servers located around the United States makes this easy for prosecutors to use and abuse. Almost every communication -- IM, email, or comment -- passes through a number of servers located miles away from the person now accused of violating federal law.

Taking a local crime federal means enhanced charges and longer sentences, often prompting accused citizens to sign plea deals that will keep them from paying a trial tax that now includes federal sentences for local actions.

A successful challenge to "well, now it's federal" assumptions about internet use has been raised by Michael Golightley -- a man accused of violating federal law for allegedly hacking and threatening his local broadband provider. Golightley, a Lenora, Kansas resident, decided to fight back when his internet service provider (Nex-Tech) removed his online sales listing for supposedly violating the intellectual property rights of unnamed third parties.

Golightley got mad. And got even. Incoherent threats were made. From the Tenth Circuit Appeals Court decision [PDF]:

take my ad down again when my description doesnt violate copy right, i will violate this site by bringing it offline, fix the ad. if u make me upset, i will retaliate, your choice, and im not making a threat im very capable of bringing down this website.

Seems harmless enough, especially considering Nex-Tech still held almost all the power in this relationship. His follow-up "threat" was no more comprehensible.

ip address 24.225.8.90 will be submitted at exostress.in for 24 hours if my demands are not met with in 12 hours, your choice, and remember, you have been warned..

Nex-Tech deactivated the accounts linked to these mostly incoherent threats. However, following a help desk call from yet another account Nex-Tech believed was linked to the earlier threats, Nex-Tech's classified ad service was taken down by a DDoS attack. This went on for the next few days, with DDoS attacks interrupting various Nex-Tech services.

Law enforcement traced the accounts back to Golightley. He was charged with a handful of computer crimes, but the feds made it their business by making claims about "interstate commerce." These charges were brought even though Golightley, a Kansas resident, allegedly targeted a Kansas internet service provider.

The court says the federal prosecutor's assumptions are wrong. There's nothing in this case that indicates any "interstate" communications took place.

Threatening to damage a protected computer in violation of § 1030(a)(7)(A) requires the government to prove, among other elements, that Golightley transmitted at least one of his two threats “in interstate or foreign commerce.” § 1030(a)(7). But Golightley argues that the government failed to present evidence that would allow the jury to reasonably infer that he transmitted any threat in interstate commerce. Instead, he argues, the government merely showed that he transmitted his threats over the internet, which is insufficient to prove the interstate-commerce element.

The government conceded that using the internet is not enough -- by itself -- to support allegations of interstate commerce violations. But that didn't stop the government from arguing the evidence it had actually supported these claims. The court sets it straight, benchslapping it for unjustified assumptions about evidence it didn't actually possess.

The government contends that Golightley sent these messages from his personal email address, ntcsucks@mail.com. Exhibit 5 shows automated correspondence from mail.com to Golightley that Golightley received after creating his ntcsucks@mail.com email address. At the bottom of the email from mail.com is the following trademark notice: Supp. R. 62.

[If you can't see the embed, a copyright notice at the bottom of the mail.com footer says Mail & Media is located in Pennsylvania and the "mail.com" trademark belongs to it.]

The government first suggests Exhibit 4A establishes that Golightley transmitted the threats via his personal mail.com email address. Next, the government suggests that the jury could infer, based on the trademark notice in Exhibit 5, that mail.com’s servers are located in Pennsylvania, or “in a [s]tate nearer Chesterbrook, Pennsylvania.” Lastly, the government builds on this inference, concluding the jury could infer that when Golightley transmitted his emails from his mail.com account, the emails traveled in interstate commerce via mail.com’s out-of-state servers.

There are a lot of government assumptions in play here -- most of them wrong. The Tenth Circuit continues its excoriation:

First, as Golightley correctly points out, the government assumes that the messages in Exhibit 4A came from his personal mail.com email address. But Exhibit 4A does not support the government’s assumption. The messages show that the sender used a form available on Nex-Tech Classified’s online help desk. This form is completed by the user and submitted to Nex-Tech directly from its website. Both threats sent by grass_is_green show that they were sent from the email address “info@nextechclassifieds.com.” And Golightley’s personal email address, ntcsucks@mail.com, appears only as the “Contact Email." As Golightley further notes, given that the sender’s email address is info@nextechclassifieds.com, the threatening messages appear to have originated from Nex-Tech’s own website— meaning that, as Golightley explains, he transmitted the threats by completing an online form on Nex-Tech’s website, and not by emailing Nex-Tech via his personal mail.com email address.

The fact that this communication did not originate from "out of the state" (and that's taking the government's word that a trademark registration from Pennsylvania is "evidence" of interstate commerce) is fatal to the government's arguments -- arguments contradicted by the government's own witness.

Further, the government’s expert witness—a federal forensics examiner who reviewed the digital evidence in this case—testified that someone using Golightley’s cell phone contacted Nex-Tech’s help desk at the time the threats were sent by visiting “the contact portion of the help page for Nex-Tech Classifieds.”

The court says the government needs facts to prove this argument. And it has brought none that support its "interstate commerce" conjecture.

Even when this evidence is viewed in the light most favorable to the government, no rational trier of fact could conclude that it shows Golightley sent the threats from his mail.com email address. And yet, the basic premise of the government’s argument is that the jury could infer the use of interstate commerce because of the use of the mail.com address. Given that this inference assumes facts not in evidence, the government did not produce sufficient evidence to show that Golightley transmitted his threats in interstate commerce.

An assignment of intellectual property rights is not the same thing as establishing originating location, much less a circuitous path through allegedly out-of-state email servers.

The government bases this inference on Exhibit 5’s automated trademark notice stating that the corporate owner of the mail.com trademark is located in Pennsylvania. But the government offers no explanation tethering the location of the corporate trademark owner to the location of its servers.

And there goes one of the feds' charges -- kicked to the curb by its deliberate (and convenient) ignorance about the nature of internet communications.

Because no reasonable juror could have determined that Golightley transmitted his threats in interstate commerce, we vacate his conviction for threatening to damage a protected computer.

And, because the prosecution's closing arguments led to jury instructions that misled jurors as to the nature of the alleged criminal activity and Golitghtley's supposed culpability under federal law, the Appeals Court says the multiple felony convictions can no longer stand. At best, they're misdemeanors. And the district court needs to reconsider and resentence.

Because the instructions did not require the jury to find that Golightley engaged in a course of conduct affecting one or more other computers, we are left with “substantial doubt that the jury was fairly guided” in reaching its verdict Gorrell, 922 F.3d at 1121–22 (quoting Little, 829 F.3d at 1181). We therefore vacate these seven convictions and remand to the district court with instructions to reclassify them as misdemeanors and to resentence Golightley accordingly.

What used to be several felonies is now several lesser crimes. The federal government overstepped, with its prosecutors believing they could lead a court into accepting felony charges just because the alleged criminal acts happened on the internet. They were wrong, which is good news for others facing trumped-up charges just because they did something dumb on the internet, a communication perhaps best known for the sheer quantity of dumb stuff it has enabled. That shouldn't be enough to convert misdemeanors into baseless felonies. And it's good to see a federal court reject the feds' opportunistic thinking.

Filed Under: doj, email, federal crime, internet, interstate threat, michael golightley

German Court Orders Encrypted Email Service Tutanota To Backdoor One Account

from the end-to-end-crypto-is-still-your-friend dept

A legal requirement to add backdoors to encrypted systems for "lawful access" has been discussed for many years. Last month, the EU became the latest to insist that tech companies should just nerd harder to reconcile the contradictory demands of access and security. That's still just a proposal, albeit a dangerous one, since it comes from the EU Council of Ministers, one of the region's more powerful bodies. However, a court in Germany has decided it doesn't need to wait for EU legislation, and has ordered the encrypted Web-email company Tutanota to insert a backdoor into its service (original in German). The order, from a court in Cologne, is surprising, because it contradicts an earlier decision by the court in Hanover, capital of the German state of Lower Saxony, and Tutanota's home town. The Hanover court based its ruling on a judgment by the Court of Justice of the European Union (CJEU), the EU's highest court. In 2019, the CJEU said that:

a web-based email service which does not itself provide internet access, such as the Gmail service provided by Google, does not consist wholly or mainly in the conveyance of signals on electronic communications networks and therefore does not constitute an 'electronic communications service'

Despite this, in the Tutanota case the Cologne court applied a German law for telecoms. Tutanota's co-founder Matthias Pfau explained to TechCrunch:

"The argumentation is as follows: Although we are no longer a provider of telecommunications services, we would be involved in providing telecommunications services and must therefore still enable telecommunications and traffic data collection," he told TechCrunch.

"From our point of view -- and law German law experts agree with us -- this is absurd. Neither does the court state what telecommunications service we are involved in nor do they name the actual provider of the telecommunications service."

Given that ridiculous logic, it's no surprise that Tutanota will be appealing to Germany's Federal Court of Justice. But in the meantime the company must comply with the court order by developing a special surveillance capability. Importantly, it only concerns one account -- allegedly involved in an extortion attempt -- that seems to be no longer in use. Moreover, as the TechCrunch article explains, the monitoring function will apply to future emails that the account receives. And even then, it will only deliver any unencrypted emails that are present, because Tutanota is not able to decrypt users' emails that apply end-to-end encryption, which is entirely under the user's control, not Tutanota's.

That means the practical effect of this court order is extremely limited: to future unencrypted emails of just one quiescent account. But independently of its real-life usefulness, this order sets a terrible precedent of a court ordering an Internet company to insert what amounts to a backdoor in an account. That's why it is vital that Tutanota's appeal prevails -- for both the company, and for the EU Internet as a whole.

Follow me @glynmoody on Twitter, Diaspora, or Mastodon.

Filed Under: backdoors, email, encrypted email, encryption, eu, germany, lawful access
Companies: tutanota

Suspected DNC & German Parliament Hacker Used His Name As His Email Password

from the opsec-yo dept

You may have seen the news reports this week that German prosecutors have issued an arrest warrant for Dmitry Badin for a massive hack of the German Parliament that made headlines in 2016. The reports about the German arrest warrant all mention that German authorities "believe" that Badin is connected to the Russian GRU and its APT28 hacking group.

The folks over at Bellingcat have done their open source intelligence investigation thing, and provided a ton of evidence to show that Badin almost certainly is part of GRU... including the fact that he registered his 2018 car purchase to the public address of a GRU building. This is not the first time this has happened. A few years back, Bellingcat also connected a bunch of people to the GRU -- including some accused of hacking by the Dutch government -- based on leaked car registration info.

There's much, much more in the Bellingcat report, but the final paragraph really stands out. Bellingcat also found Badin -- again, a hacker who is suspected in multiple massive and consequential hacks, including of email accounts -- didn't seem to be all that careful with his own security:

The most surreal absence of “practice-what-you-breach” among GRU hackers might be visible in their lackadaisical attitude to their own cyber protection. In 2018, a large collection of hacked Russian mail accounts, including user name and passwords, was dumped online. Dmitry Badin’s email — which we figured out from his Skype account, which we in turn obtained from his phone number, which we of course got from his car registration — had been hacked. He had apparently been using the password Badin1990. After this, his email credentials were leaked again as part of a larger hack, where we see that he had changed his password from Badin1990 to the much more secure Badin990.

Yes, the password for at least one of his email accounts... was apparently his own last name and the year he was born. The cobbler's kids go shoeless again.

Filed Under: apt28, dmitry badin, dnc, dnc emails, email, germany, gru, hacking, opsec, passwords, podesta emails, russia

Jared Kushner's Coronavirus Task Force Is Using Private Email Accounts To Conduct Official Business

from the only-illegal-if-Democrats-do-it dept

If you're a public official, your communications and documents are supposed to be accessible by the public. That's not me being an absolutist on open government. That's the law. And yet, here we are, watching an administration that rode into office on chants of "Lock her up!" once again conducting government business off the grid, using the same sort of private email accounts Trump repeatedly declared should have landed Hillary Clinton in the slammer.

Citizens for Responsibility and Ethics in Washington (CREW) has taken note of the latest violation of multiple laws by the Trump Administration and wants to know what the White House is going to do about it.

Jared Kushner’s shadow coronavirus task force appears to be violating both the Presidential Records Act (PRA) and Federal Advisory Committee Act (FACA) by using private email accounts with no assurance their communications are being preserved and by meeting in secret, according to a letter sent today by Citizens for Responsibility and Ethics in Washington (CREW). The failure of the White House to comply with any of the PRA and FACA requirements leaves the public in the dark about the work the shadow task force has done and the influence of private industries on the administration’s response to the coronavirus pandemic.

We the taxpaying people deserve to know what, if anything, Jared Kushner is doing to fight the spread of the virus. Kushner was put in charge of handling the business side of the pandemic response based on his impressive pandemic-fighting resume, which includes marrying Trump's daughter and spending several years as a slumlord. Sure, this isn't the first time important government work has been handed over to underqualified sycophants/relatives, but this time there's actually life and death on the line.

What's being done with our tax dollars by Kushner's task force is being hidden from view through its members' use of private email accounts. We all know history is written by the winners, but history can also remain unwritten by losers whose sole contribution to the effort appears to be making businesses feel better about endangering the lives of their employees and customers. Stashing away official communications on private email servers cuts the public out of the loop.

History is being unwritten as we speak. Here's a senior White House official's brutal summary of Kushner's task force:

We don’t know who these people are. Who is this? We’re all getting these emails.

At least they're getting the emails. It's still unclear whether any of us in the general public will. That's what CREW is trying to find out. Its letter to the White House's legal rep, Pat Cipollone, reminds the lawyer of the law and the obligation the White House has to the American people.

We recognize the extraordinary emergency our nation faces and the need for the federal government to act quickly and decisively. At the same time, however, the need for transparency could not be greater. Americans need to know that our government is acting in our best interests; they need the kind of reassurance that full transparency in how and what the White House is doing brings. Of equal importance, we must have access in the future to a full record of how the President and his staff handled this crisis to learn from any mistakes made and improve on how we address future pandemics. Now, more than ever, we must be vigilant in complying with laws like the PRA and the FACA that were enacted to protect our nation’s interest in transparency and a full historic record. We therefore respectfully request that you ensure that the shadow task force complies immediately and fully with its statutory requirements under the PRA and FACA.

This is CREW basically telling the White House Counsel, "Hey, we don't want to tell you how to do your job but, you know, do your damn job!" This would have been inexcusable even if the Trump administration hadn't used "but her emails" as a platform plank. It's unforgivable when it's these hypocrites standing knee deep in a swamp they never intended to drain, running a behind-the-scenes corporate welfare effort under the guise of keeping the nation's citizens alive and healthy.

Filed Under: coronavirus taskforce, email, jared kushner, pandemic response, secrecy, transparency

No, Google Isn't Hiding Elizabeth Warren's Emails To Promote Mayor Pete

from the not-how-it-works dept

Content moderation at scale is impossible. This time, it's email content moderation. This week a new publication called The Markup launched. It's a super smart group of folks who are doing deep data-driven investigative reporting of companies in and around the tech space -- and I'm very excited to see what they do. I was going to write about the project overall and its goals, but instead I'm going to write about one of its first stories, done in partnership with the Guardian, entitled Swinging the Vote?, and which looks at Gmail's filtering system, specifically as it regards political emails from Presidential candidates.

A few years back, Google added the "Promotions" tab to Gmail, as a way of hopefully, automagically sorting not-quite-spam emails, but general promotional emails that you probably don't want cluttering up your inbox. Personally, I don't use it, as I use a different filtering setup entirely that overrides Gmail's defaults. However, for many people it's proven to be quite useful. The reporters at The Markup conducted a worthwhile experiment:

The Markup set up a new Gmail account to find out how the company filters political email from candidates, think tanks, advocacy groups, and nonprofits.

We found that few of the emails we’d signed up to receive —11 percent—made it to the primary inbox, the first one a user sees when opening Gmail and the one the company says is “for the mail you really, really want.”

Half of all emails landed in a tab called “promotions,” which Gmail says is for “deals, offers, and other marketing emails.” Gmail sent another 40 percent to spam.

Very interesting! What was perhaps even more interesting was the chart -- which quickly rocketed around social media -- showing that some candidates had their emails go into the Primary Inbox at a much, much higher rate than others:

You'll notice a few standouts. 63% of Pete Buttigieg's emails made it to the Inbox, as did 47% of Andrew Yang's. Everyone else was much closer to 0% with quite a few -- including both Elizabeth Warren and Joe Biden -- at 0%.

The reporters at The Markup also published a companion piece that gives the details of how they went about doing this research and (yes!) they even provide the data and the code on Github. This is a fantastic and transparent way of doing such journalism -- and I applaud them for that.

However, the very framing of the original story itself... is problematic. It's one thing to be open about how you conducted the research. But starting with a title like "Swinging the vote" and highlighting the chart above almost immediately resulted in lots of people on Twitter assuming (or suggesting) that Google was doing this deliberately, and that they were purposely making the decision to tilt the playing field towards Buttigieg. This includes vocal big tech critic Roger McNamee, who declared this was evidence that "Gmail has its thumb in the scale." Another Google critic, who is fond of misleading conspiracy theories about the company, called it "election meddling" and claims that Google was giving certain candidates "special treatment."

Except... that's almost certainly not the case. No one at Google on the Gmail spam team is thinking about promoting one Presidential candidate over another. Instead, this is just yet another example of Masnick's Impossibility Theorem, but applied to email moderation, rather than social media. Content moderation at scale is impossible to do well and will always piss off some people.

Indeed, looking over the data, the most obvious and most likely solution is simply this: Buttigieg and Yang hired competent email marketers who know how to craft emails that are (1) less likely to trigger the algorithm, and (2) less likely to be clicked on as spam by users (an important signal that feeds back into the algorithm). The rest of the candidates... did not. And thus, their emails went to the promotions and spam folder because they had characteristics that are more closely associated with promotions and spam. And, yet, The Markup story doesn't bother to get into any of that -- and thus leaves the speculation wide open, allowing plenty of folks to leap in.

Again, I'm super excited about The Markup as a project and believe it will put out plenty of important and impactful journalism in the days, weeks, months and years to come. I recommend people read over The President's Letter from the site's President Nabiha Syed (a past podcast guest) and Editor's Letter from Julia Angwin -- both of which present a compelling vision of what The Markup will be.

But this story shows how important context is in presenting a story. This is a data driven story -- which is great. But if the necessary context is not provided, especially on a topic so fraught with speculation, people are going to rush in and jump to conclusions. The Markup itself did not directly say that Google was doing this deliberately, but its total failure to suggest why this might be happening, along with a cringe-worthy headline, opened the door for others to jump in and assume as much -- and that's a shame.

Filed Under: andrew yang, content moderation, content moderation at scale, elizabeth warren, email, gmail, pete buttigieg, political emails, promotions, spam
Companies: google