Hacker Tricked Robinhood Support Into Revealing Data Of 5 Million Users

from the whoops-a-daisy dept

When it comes to privacy and security, the weakest link continues to be of the human variety.

Trading app Robinhood last week announced in a blog post that somebody used social engineering to trick company support into handing over user login data. On November 3, said "hacker" convinced company support they were cleared to access “certain customer support systems.” From there they nabbed the email addresses of five million users, and the full names of a different group of two million users:

"At this time, we understand that the unauthorized party obtained a list of email addresses for approximately five million people, and full names for a different group of approximately two million people. We also believe that for a more limited number of people—approximately 310 in total—additional personal information, including name, date of birth, and zip code, was exposed, with a subset of approximately 10 customers having more extensive account details revealed. We are in the process of making appropriate disclosures to affected people."

Another subset of users had far more sensitive data exposed to the intruder. 310 users had their full names, dates of birth and ZIP codes exposed to the intruder, and 10 customers had "more extensive account details revealed" -- though the company doesn't specify which details they were. The company insists that no social security numbers were revealed and that nobody suffered any financial losses related to the attack:

"Based on our investigation, the attack has been contained and we believe that no Social Security numbers, bank account numbers, or debit card numbers were exposed and that there has been no financial loss to any customers as a result of the incident."

By "no financial loss" Robinhood means none of their users had money stolen directly via Robinhood. That doesn't mean those users won't suffer financial losses elsewhere, after being bombarded with phishing emails over the next few months using the email addresses, or compromised via the release of other personal data used elsewhere.

As with most revelations of this type, the scope of the breach is probably significantly bigger than what's currently understood. Also like most such breaches, nobody will remember it happened three months from now, and Robinhood won't be held meaningfully accountable for its exploitable customer service. In a country where most companies have lax security and privacy standards, there's no meaningful privacy law for the internet era, and FTC privacy enforcers that are routinely understaffed, under-funded, and simply outgunned, there's simply not very much incentive to make security and privacy a real priority.

Filed Under: breach, customer support, emails, hacker
Companies: robinhood

MAGA-Friendly Twitter Clone, GETTR, Coughs Up 90,000 User Email Addresses To Hackers

from the gettr-(un)done dept

GETTR, the Twitter clone created by former Trump advisor Jason Miller, seems to have rolled out just as smoothly as every other attempt to replace the social media service that's still inexplicably popular with people who claim to hate it for moderating their speech.

It's yet another "free speech" platform that claims it upholds the lofty ideals of allowing those banned from other, more functional sites to speak their minds… just as long as said mind speech does not include any of the following:

Without limitation, we may, but do not commit to, do so to address content that comes to our attention that we believe is offensive, obscene, lewd, lascivious, filthy, pornographic, violent, harassing, threatening, abusive, illegal, or otherwise objectionable or inappropriate, or to enforce the rights of third parties or these Terms or any applicable Additional Terms.

Just like Gab, Parler, and whatever the fuck the thing is that the MyPillow guy is doing, GETTR is finding out it has a host of moderation problems that can't easily be dealt with, especially when you've promised to not "censor" your users' speech.

On top of that, GETTR -- like the other platforms listed above -- seems to have been cobbled together somewhat incompetently and rolled out hastily, opening itself up to an unhealthy blend of toxic content, trolling (both expert and inexpert), and security stress testing from those interested in this new collection of user data.

GETTR, whose surprising surge of early users appears to be mostly a mirage created by the importation and deployment of Twitter data, is no exception to the Far Right Twitter Clone™ rule. Toxic content abounds, as do multiple trolling efforts that only add to the mess. And it appears that while GETTR claims it wants to protect speech, it doesn't care nearly as much about protecting speakers.

Hackers were able to scrape the email addresses and other data of more than 90,000 GETTR users.

On Tuesday, a user of a notorious hacking forum posted a database that they claimed was a scrape of all users of GETTR, the new social media platform launched last week by Trump’s former spokesman Jason Miller, who pitched it as an alternative to "cancel culture." The data seen by Motherboard includes email addresses, usernames, status, and location.

New platforms are often a bit leaky, usually thanks to the inexperience of those creating them. This is all part of the learning curve. But GETTR had some advance notice its uncensored ecosystem had some security problems, given that it was successfully breached on opening day.

On July 4, the day of the site' official launch, a hacker broke into and defaced some of the site's most prominent users, including its founder Jason Miller, former CIA director Mike Pompeo, former Trump advisor Steve Bannon, and pro-Trump congresswoman Marjorie Taylor Greene, as first reported by Insider.

Less than three days later, the platform was coaxed into coughing up user data. Not exactly a sign things are improving. The site's CEO says otherwise, claiming this scraping was related to the first breach, which allowed a hacker to deface several prominent accounts. Jason Miller claims the security hole has been closed and that GETTR "takes cybersecurity seriously."

Maybe so, but we'll see what happens. Alt-right Twitter also-rans Gab and Parler both gave up plenty of user data -- some of it proving instrumental in federal prosecutions -- and those sites had plenty of time to harden themselves against attackers. A quick patch of a service that seems to rely heavily on someone else's API to give the appearance the platform is heavily used is still a very tempting target, both for malicious hackers and those whose efforts are just another form of trolling. When your social media alternative is more performative than functional, little things like securing user data tend to be afterthoughts.

Filed Under: emails, hack, jason miller, scraping, security
Companies: gettr

Georgia Supreme Court Overturns Computer Crime Conviction For Man Who Copied Himself On Emails Sent To His Boss

from the one-for-you,-one-for-me dept

It's not just the CFAA that can be abused. This law -- recently trimmed a bit by the US Supreme Court -- has been abused for years to go after web scrapers, researchers, and information-wants-to-be-free activists. The recent ruling does narrow the scope of that law a bit, but the CFAA still has the potential to do serious damage when wielded carelessly or vengefully.

The state of Georgia has its own set of computer crime laws and they're just as capable of being interpreted by prosecutors to criminalize acts that shouldn't be criminal offenses. Fortunately, a state court has made a sensible reading of the law to overturn a conviction for computer trespass -- one that saw a former Norcross (GA) city employee hit with felony charges. (h/t Andrew Fleischman)

Jereno Kinslow was a city IT employee who had some problems with his new boss, Greg Cothran. Cothran criticized Kinslow's work performance, leading to a "loud outburst" from Kinslow. This apparently made Cothran concerned Kinslow might sabotage the city's network. Certain "safety measures" were put in place and Kinslow was eventually fired.

Before Kinslow was let go, he utilized his administrator-level access to forward copies of emails sent to Cothran to his own personal email account. This was discovered by Cothran months later when he received a bounce notification specifying Kinslow's email account. This alleged "criminal trespass" formed the basis for charges that resulted in Kinslow being convicted of a felony and sentenced to ten years of probation.

Kinslow challenged his conviction under this statute, claiming prosecutors did not present evidence that he had actually violated the law. The Georgia Supreme Court agrees [PDF] with Kinslow.

OCGA § 16-9-93 (b)(2) defines the offense of computer trespass, in relevant part, as “us[ing] a computer or computer network with knowledge that such use is without authority and with the intention of . . . [o]bstructing, interrupting, or in any way interfering with the use of a computer program or data.” Kinslow was charged with committing computer trespass by “us[ing] a computer network with knowledge that such use was without authority and with the intention of obstructing and interfering with data from a computer, by copying Greg Cothran’s e-mails and causing them to be forwarded to his own private e-mail account.”

The State thus was required to prove that Kinslow used a computer network knowingly without authority with the intention of obstructing or interfering with the use of data.We conclude that the evidence presented at trial was insufficient to prove that Kinslow’s use was done with the intention of obstructing or interfering with the use of data.

The court says the facts don't fit the charged crime. There was no "obstruction" of data when Kinslow intercepted copies of Cothran's emails.

Contrary to the State’s suggestion, the State presented no evidence that Kinslow’s e-mail forwarding scheme “blocked” or even “hindered” the flow of data in the form of e-mails to Cothran, who continued to receive those e-mails intended for him. Rather, the evidence showed only that Kinslow’s actions created an additional flow of data to another account.

There you have it: copying is not theft obstruction.

But wait, said the state, maybe it's an [re-reads statute]... um… "interruption?"

Nope, says the court:

“Interrupt” carries a similar definition of stopping or hindering, although “interrupt” often denotes a more temporary stoppage than “obstruct,” such as “to make a break in the continuity of.” Again, the State presented no evidence that Kinslow’s actions hindered the flow of e-mails to Cothran, either permanently or temporarily.

Making copies also doesn't "interfere" with the flow of data, the court decides. The flow of data was so unobstructed, uninterrupted, and un-interfered with that Kinslow's supervisor didn't even know it was happening until one of the emails bounced.

It's a short, solid ruling that forces the state to accept the fact that words have meanings, and those meanings cannot be distended to encompass the actions seen here.

The dissent, however, thinks the court should have broadened the law to encompass all sorts of innocuous behavior by using the very loosest definitions of the word "interfere."

Webster’s New Twentieth Century Dictionary (2d ed. 1983); “to interpose in a way that hinders or impedes: come into collision or be in opposition . . . to enter into or take a part in the concerns of others,” Webster’s Ninth New Collegiate Dictionary (9th ed. 1985); and “to come between so as to be a hindrance or an obstacle . . . to intervene or intrude in the affairs of others; meddle.” The American Heritage Dictionary of the English Language (3d ed. 1992). Black’s Law Dictionary (11th ed. 2019) primarily defines “interfere” as “[t]he act or process of obstructing normal operations or intervening or meddling in the affairs of others.”

So, under these definitions, shoulder-surfing someone else's Facebook account would be a criminal act. Sure, probably no one would attempt to criminally charge anyone for doing this, but that's the expansive reading the Chief Justice of this court thinks is correct.

This is a good ruling that clearly delineates what is or isn't covered by this computer crime law. And while Kinslow's actions may have been cheap, dishonest, and all-around lousy, they weren't criminal.

Filed Under: cfaa, computer crime, emails, georgia, greg cothran, hacking, jereno kinslow

Gag Order Lifted On Yet Another Trump DOJ Leak Investigation That Targeted Journalists

from the serving-the-president-is-more-important-than-serving-the-people-apparently dept

Another leak investigation that involves the DOJ going after journalists' communications has been revealed. This would be the third time since Biden took office that subpoenas targeting journalists have had their gag orders removed, allowing the public to see what the DOJ was up to during Trump's unceremonious reign as president.

The previous revelations involved journalists employed by the Washington Post and CNN. This one targets one of Trump's favorite media punching bags, the "failing" New York Times. This investigation dates all the way back to James Comey's last months as the head of the FBI, a position he was ousted from when he failed to show Trump the required amount of obeisance.

The letter this week disclosing the seizure of phone records involving the Times reporters — Matt Apuzzo, Adam Goldman, Eric Lichtblau and Michael S. Schmidt — had hinted at the existence of the separate fight over data that would show whom they had been in contact with over email.

[...]

The Justice Department has not said what leak it was investigating, but the identity of the four reporters who were targeted and the date range of the communications sought strongly suggested that it centered on classified information in an April 2017 article about how James B. Comey Jr., the former F.B.I. director, handled politically charged investigations during the 2016 presidential campaign.

The article not specifically mentioned in the government's subpoena dealt with an email or memo not found in the Clinton email dump released by the State Department and available to search at Wikileaks -- one that said then-AG Loretta Lynch would throttle the investigation into Hillary Clinton's private email server. Comey, however, reopened that investigation shortly before the election, something that may have played a part in Trump's election win.

This memo, however, most likely prompted Comey to take the case public back in 2016. Comey held a press conference announcing the results of the investigation -- one that did not include criminal charges for Clinton. This is generally the sort of thing the DOJ and FBI rarely do, especially when the target of an investigation is a presidential candidate. Comey shrugged off appearances of politically-motivated impropriety twice, but still failed to satisfy his new boss' desire to be surrounded by loyalists.

The Biden Administration has placed Merrick Garland in charge of the DOJ and appears to be doing some house cleaning. Questionable investigative efforts involving leaks and journalists have been stripped of their gag orders and made public. But there's a delay here that doesn't square with the new administration's statement that it respects the First Amendment and has no interest in targeting journalists. This one rolled on for a few months after Biden's election, allowing the DOJ to continue pursuing these journalists' communications while swearing their supervisors to secrecy.

While the Trump administration never informed The Times about the effort, the Biden administration continued waging the fight this year, telling a handful of top Times executives about it but imposing a gag order to shield it from public view, said the lawyer, David McCraw, who called the move unprecedented.

The gag order prevented the executives from disclosing the government’s efforts to seize the records even to the executive editor, Dean Baquet, and other newsroom leaders.

Mr. McCraw said Friday that a federal court had lifted the order, which had been in effect since March 3, freeing him to reveal what had happened.

The DOJ was ultimately unable to obtain the email records it requested from Google. The company fought the subpoena, refusing to hand over the requested information. And with other DOJ officials recommending the case be closed because it was unlikely to result in criminal charges, the DOJ abandoned this effort and finally allowed the gag order to be lifted.

But even the lifting of the gag order was inexplicably delayed. The DOJ claimed in January that any notification would jeopardize the investigation and give targets an opportunity to destroy evidence. And in March, the DOJ continued to press for secrecy, asking a judge for permission to tell NYT's legal team but refusing to allow the targeted journalists to be notified about the government's desire to collect their email records.

While it's good to see the new DOJ express its support of journalists and the First Amendment, we need to remember Biden served two terms under Barack Obama -- a president who set records for leak investigations and prosecuted whistleblowers. Cleaning up Trump and Barr's mess is the right thing to do but the DOJ will continue to serve whoever's in charge and is always willing to wave aside constitutional concerns if it's politically expedient to do so.

Filed Under: adam goldman, doj, emails, eric lichtblau, fbi, gag order, james comey, journalism, leaks, matt apuzzo, merrick garland, michael schmidt, records requests, whistleblowing

Leaked Emails Show Chicago PD Bought, Deployed Drones Using Off-The-Books Forfeiture Funds

from the forced-transparency-still-more-effective-than-voluntary-transparency dept

Thanks to the efforts of transparency activists Distributed Denial of Secrets (DDoS), residents of Chicago are learning more about the activities of their sworn protectors, the Chicago Police Department. Stuff the PD never wanted the public to see is now in the public's hands. The Chicago Sun Times has started digging into the stash provided by DDoS and has revealed the PD's secret drone program, paid for with off-the-books funds.

Details of the police department’s drone program were included in an email sent last summer by Karen Conway, director of police research and development. In the email, Conway told other high-ranking police officials that the department’s counter-terrorism bureau “utilized 1505 funds for a pilot Drone program that operates within the parameters of current laws.”

1505 funds are funds the city doesn't control or track. The funds belong solely to the Police Department -- something that happens shortly after the PD takes the funds from the people they used to belong to.

The department’s “1505” fund is made up of forfeiture proceeds — money and other assets seized in connection to criminal investigations. The money isn’t included in the department’s official budget and has reportedly been used in the past to purchase other controversial technology, like Stingrays, which mimic cell towers and send out signals to trick phones into transmitting their locations and other information.

Asset forfeiture is a great way to get cops the things they want without having to worry about oversight from either the city or its residents. Purchases are almost always "controversial" when they're made with funds that are all but invisible to outsiders.

And there's quite a bit of cash to be spent. The Chicago PD has taken in nearly $26 million in forfeiture funds in the last two years alone. It managed to spend nearly $8 million over that same period, some of it on "operating expenses," witness protection, and controlled drug buys. Some of that also went towards training programs and conferences, as well as their attendant expenses (travel, meals, lodging).

But some of it went towards new tech not specifically approved by the city. Emails included in the leaked documents suggest the PD wants its drones to participate in vehicle pursuits. One email references "Starchase" and "engine stop technology." This would allow pursuit vehicles to launch GPS trackers at pursued vehicles, allowing officers to stop chasing and start tracking. Drones would presumably be used to track vehicles from the air and put airborne eyes on suspects if and when the tracked vehicle is abandoned.

The only hang up appears to be the city's drone policies, which restrict how they can be used. The PD has obtained some waivers and relaxation of drone guidelines, but it appears this part of the program is still in the exploratory phase rather than in actual use at this time. However, other emails in the same stash claim the drones will be (or are being) used to search for missing persons, take crime scene photos, or assist in "terrorist-related issues."

But this isn't the only time the Chicago PD has expressed interest in airborne surveillance. While this email references vehicle pursuits (something the PD doesn't handle particularly well), there's no reason to believe the PD won't find other uses for the new eyes in the sky.

In 2018, the ACLU accused former Mayor Rahm Emanuel of being the heavy hand behind legislation in Springfield that would have allowed police officers to use drones equipped with facial recognition technology to monitor protests. Versions of the legislation passed both the state house and senate but a final bill was never signed into law.

“Given that the city not so long ago sought legislation to permit using drones to surveil public gatherings, including those engaged in First Amendment activity, it is worth questioning its motivations,” [ACLU spokesman Ed] Yohnka said of the new revelation.

The CPD may be looking at pursuit options but state law enforcement has its own drones and sent them skyward during protests last year sparked by the killing of George Floyd by Minnesota police officer Derek Chauvin. The Illinois State Police said the drones were launched to capture footage of "potential uses of force and arrests," but the same recordings could easily have been used to identify and track people engaged in protected First Amendment activity.

This is just one of many problems with asset forfeiture programs. Not only does the government take control of citizens' property with almost no justification, but the direct beneficiaries of these programs are often allowed to spend the funds however they want with almost no oversight. That's how the Chicago PD gets into the drone business without ruffling feathers downtown or feeling any obligation to inform the public about their latest surveillance plans.

Filed Under: asset forfeiture, chicago, chicago police department, drones, emails, leaks, surveillance

DRM Screws People Yet Again: Book DRM Data Breach Exposes Reporters' Emails And Passwords

from the was-that-really-worth-it? dept

I have a few different services that report to me if my email is found in various data breaches, and recently I was notified that multiple email addresses of mine showed up in a leak of the service NetGalley. NetGalley, if you don't know, is a DRM service for books, that is regularly used by authors and publishers to send out "advance reader" copies (known around the publishing industry as "galleys.") The service has always been ridiculously pointless and silly. It's a complete overreaction to the "risk" of digital copies of a book getting loose -- especially from the people who are being sent advance reader copies (generally journalists or industry professionals). I can't recall ever actually creating an account on the service (and can't find any emails indicating that I had -- but apparently I must have). However, in searching through old emails, I do see that various publishers would send me advance copies via NetGalley -- though I don't think I ever read any through the service (the one time I can see that I wanted to read such a book, after getting sent a NetGalley link, I told the author that it was too much trouble and they sent me a PDF instead, telling me not to tell the publisher who insisted on using NetGalley).

It appears that NetGalley announced the data breach back in December on Christmas Eve, meaning it's likely that lots of people missed it. Also, even though I'm told through this monitoring service that my email was included, NetGalley never notified me that my information was included in the breach. NetGalley did say that the breach included both login names and passwords -- suggesting that they didn't even know to hash their passwords, which is just extremely incompetent in this day and age.

So, from my side of things, this means that the company put me and my information at risk for what benefit? To make my life as a potential reviewer of a book more difficult and annoying, and limiting my ability to easily read a book? DRM benefits literally no one. And in this case, has now created an even bigger mess in leaking my emails and whatever passwords I used for their service (thankfully, I don't reuse passwords, or it could have been an even bigger problem). For those who say that the DRM is still necessary to avoid piracy, that's ridiculous as well. If the book is going to get copied and leaked online, it's going to get copied and leaked online. And once one copy is out, all the DRM in the world is meaningless.

Rather than focusing so much on locking stuff up and making it impossible to read, while putting people's personal info at risk, just stop freaking out, recognize that most people are not out to get you by putting your stuff on file sharing sites, and focus on getting people to want to buy your books, rather than putting their data and privacy at risk.

Filed Under: advance reader copies, data breach, drm, emails, galleys, hacked, passwords
Companies: netgalley

Twitter Suspends Reporter For 'Posting Private Info' That Is Merely Internal Deutsche Bank Email That Could Implicate Trump

from the content-moderation-at-scale dept

Once again, I need to refer you to Masnick's Impossibility Theorem, on how it is effectively impossible to do content moderation at scale well. The latest example? Twitter suspended the account of Scott Stedman, the founder of the investigative news site, Forensic News. A few weeks back, Forensic News had a pretty incredible scoop, highlighting how a Russian government-controlled bank, Gazprombank, sent over $500 million to the American subsidiary of Deutsche Bank, at about the same time that very same subsidiary was lending nearly $400 million to Donald Trump. Deutsche Bank has run into trouble for its handling of Russian government-connected money, including its role in helping the Russians launder money.

The new evidence appears to come from Val Broeksmit, the stepson of a former senior Deutsche Bank exec. Broeksmit's story -- as covered in the craziest NY Times article you'll ever read -- is quite incredible and worth reading up on, as it shows how he has access to all of this internal Deutsche Bank info. In this case, the key detail of interest was an internal "breach report" sent to the senior Broeksmit, showing that the bank's liabilities exceeded its assets. As the report goes on to note, an absolutely huge percentage of the American subsidiary of Deutsche Bank's liabilities were to Russia in 2013. As the article details, nearly $3 billion of its liabilities were Russian in origin, approximately triple the next largest creditor, Switzerland.

All that's very interesting, but what does any of it have to do with content moderation? Well... right after the Forensic News report went out, Stedman noted that his website was under attack, and it looks like someone went after his Twitter account as well, trying to report it. They were successful, as it turns out. At issue was one key piece of evidence that Forensic News used in its report: the emails about the "breach report." Stedman posted images of this email to show the basis of the story. And, it appears that enough people reported it to Twitter, that they suspended his account for "posting private information":

If you somehow can't see the embedded image, it shows the notice from Twitter saying that his tweet showing "the original email" about the breach report violated Twitter's rules for "posting private information... without their express authorization and permission." If you look for that original tweet now, you currently see this:

It is not difficult to see how this happened. It seems likely that a lot of folks who'd rather this story go away took to reporting various Stedman tweets to try to silence him. The reported tweets get reviewed by a content moderation staff, and one of the "rules" is no posting of private information. The evidence is someone's private email. And, so, a content moderator says "that violates the rules." Now, of course, there's supposed to be a "newsworthy exception" to content moderation practices, but is the harried outsourced moderation person, who has a giant queue to get through, going to take the time to understand that this revelation of an email was key to a pretty big news story? Of course not. There's some spam or whatnot to takedown next.

Obviously, it would be great if it were humanly possible to carefully investigate each of these reports, but if that happened, the queue would just get longer and longer and longer, and we'd hear complaints in the other direction, about how Twitter never responds to legitimate reports of tweets that violates its rules.

In the end, there's really no great answer -- though I will note that it's really only because of this effort to silence Stedman's reporting and evidence that I became aware of this story in the first place... There's some sort of name for that kind of thing, I think.

Filed Under: content moderation at scale, content moderation is impossible, emails, newsworthy, private info, scott stedman, val broeksmit
Companies: deutsche bank, forensic news, twitter

Caifornia Governor Vetoes Law That Would Have Mandated Retention Of State Government Emails

from the passing-the-savings-on-to-you! dept

California Governor Gavin Newsom has signed off on some significant wins for state residents. He approved a bill banning the use of facial recognition tech in law enforcement body cameras -- the first such statewide ban in the United States. Well… I guess that's it really. To be fair, he hasn't been in office all that long.

He also signed off on a mostly-worthless police use of force reform bill and Hancocked a bill that will prevent "hollowing out the middle class" by hollowing out the middle class -- namely, freelance writers who will find it almost impossible to make a living under the state's gig economy law.

To sum up, Governor Newsom may be doing more harm than good this year. Let's hope things improve. One week after signing a bill that would eliminate (some) excessive public record duplication fees by allowing residents to take pictures of documents with their cellphones (rather than pay a public servant an exorbitant amount of money to run a copier), Newsom has restored a bit more opacity to the halls of power. Matthew Keys has the details:

California Gov. Gavin Newsom vetoed a measure last weekend that would have required local governments to preserve copies of email records for disclosure under the state’s public records law.

The measure, Assembly Bill 1184, would have required local and state agencies to preserve communications sent by email for at least two years so that members of the public may inspect and copy them.

California government agencies have been arguing for years now that emails are not subject to the state's two-year retention period. Since they're not going to voluntarily retain records that many residents would certainly consider to be public records, the bill would have erased the faux confusion over government agency emails.

Instead of providing clarity, Governor Newsom went the other way, leaving it to individuals at individual agencies to make personal judgment calls on email retention… all in the interest of "striking a balance."

Expressing concern for the taxpayers he just screwed out of records, Newsom claims email retention is cost prohibitive.

Gov. Newsom said he was concerned that codifying a preservation requirement for email could require additional personnel and data management policies, the costs of which would be passed on to taxpayers.

But of course taxpayers would be expected to absorb the costs. This much taxpayers understand. They fund the agencies creating the records. They fund public records response efforts. They fund the creation of these emails -- the ones the governor has now decided they can't have access to.

With this veto, agencies have the official blessing to delete emails whenever they feel like it. They can alter policies and practices to ensure as many emails as possible are destroyed, putting them permanently out of reach. Transparency and accountability are great... but maybe they're just too expensive? This isn't logic. It's post hoc rationalization by a governor who's decided there should be a bit more distance between the government and governed.

Filed Under: california, emails, foia, gavin newsom, retention, transparency

Appeals Court: Stored Communications Act Privacy Protections Cover Opened And Read Emails

from the shouldn't-have-needed-to-be-said,-but-at-least-it-was-said-forcefully dept

The Fourth Circuit Court of Appeals has handed down an important decision [PDF] bolstering privacy protections for stored email. As we're painfully aware, unopened email older than 180 days is granted zero privacy protections, treated like unopened snail mail left at the post office. Opened email, on the other hand, would seem to carry an expectation of privacy, but a district court ruling came to exactly the opposite conclusion, prompting this appeal.

A lawsuit involving a pair of affairs and one party's decision to read someone else's emails surfaced a question not often posed without a government party involved. Here's the court's summary of the convoluted backstory that led to accusations of federal law violations:

From August 2011 to February 2015, [Patrick] Hately had an intimate relationship with Nicole Torrenzano (“Nicole”), with whom Hately has two children. During their relationship, Hately and Nicole shared login and password information for their email accounts—including Hately’s Blue Ridge College email account. But when, about March 2015, Nicole informed Hately that she also was involved in an intimate relationship with [Dr. David] Watts, who was her co-worker and married to Audrey Hallinan Watts (“Audrey”), Hately and Nicole separated.

Pertinent to this action, Hately did not change the password that he shared with Nicole for his Blue Ridge College email account. Watts and Nicole continued their personal relationship, and during the fall of 2015, Watts and Audrey initiated divorce proceedings. In an effort to help Watts in his divorce proceedings, Nicole told Watts that Hately and Audrey were having an affair. Nicole said she knew of emails between Hately and Audrey that Watts could obtain by using the password that she had to Hately’s Blue Ridge College email account.

This certainly doesn't make what Watts did OK, but he seemed to feel it at least made his actions legal.

Watts stated that he used the password Nicole gave him to browse through Hately’s emails but contended that he “did not open or view any email that was unopened, marked as unread, previously deleted, or in the [student email account]’s ‘trash’ folder.”

This bizarre defense of invading someone else's privacy convinced the lower court that Watts' actions were legally in the clear, even if they were clearly morally wrong. It dismissed his Stored Communications Act claims against Watts, stating that the SCA did not protect opened email. According to the lower court, the only email protected by the SCA is email still in transit. Once it's been downloaded and opened, it's apparently cool for other people to access and read, even if it's not their email account.

With this bizarre take, the lower court basically stated spam email routed directly to the trash has more privacy protections than direct communications between living, breathing persons. The appeals court points out this interpretation is off base by a long distance. A lengthy discussion of the SCA and Congressional intent -- along with a revival of Hately's state law claims -- takes up a great deal of the opinion's 55 pages.

Dr. Watts -- the email interloper -- argued the SCA did not protect these communications because the Blue Ridge College email server was not an "electronic communication service," but rather a "remote computing device." This argument hinged on the email system's construction, which used Google's services for transmitting and storing email. But the university also stored a copy of all Blue Ridge email on its own servers as a backup for users. This crucial fact restores the expectation of privacy, according to the appeals court, which points out Blue Ridge's backup server actually makes it both.

The district court's reasoning rests on the premise that, for purposes of the emails in question, Blue Ridge College's email service could not simultaneously function as both an electronic communication service and a remote computing service. But nothing in the plain language of the definitions of electronic communication service and remote computing service precludes an entity from simultaneously functioning as both.

There is no logical or technological obstacle to an entity "provid[ing] to users thereof the ability to send or receive wire or electronic communications"—i.e., functioning as an electronic communication service—while, and as part of the same service, "provi[ding] the public [with] computer storage or processing services by means of an electronic communications system"—i.e., functioning as a remote computing service. And the relevant legislative history expressly contemplates as much, stating that "remote computing services may also provide electronic communication services." S. Rep. No. 99-541, at 14; see also H.R. Rep. No. 99-647, at 64 ("[T]o the extent that a remote computing service is provided through an Electronic Communication Service, then such service is also protected [under Section 2701(a)].").

As the appeals court notes, it makes no sense to suggest email users consider opened email worthy of less protection than others they've sent directly to the trash without reading. Servers like the one used by Blue Ridge to back up the Google-based email system are the end result of users' desires. Users want to store emails for later reading or use. And Congress -- even with its horribly-outdated Stored Communications Act -- recognized the privacy inherent to these personal communications. This covers delivered and opened email, no matter where the original or its backup resides.

To read the law otherwise is to upend the personal nature of email communications, allowing almost anyone to access anyone else's email without permission and face zero consequences (at least under federal law) for doing so.

The district court’s construction of Subsection (B)—that previously delivered and opened emails stored by a web-based email service are not in “electronic storage” and therefore not actionable under Section 2701(a)(1)—would materially undermine these objectives. Potential users of web-based-email services—like Blue Ridge College’s email service—would be deterred from using such services, knowing that unauthorized individuals and entities could access many, if not most, of the users’ most sensitive emails without running afoul of federal law. Likewise, without the prospect of liability under federal law, unauthorized entities will face minimal adverse consequences for accessing, and using for their own benefit, communications to which they are not a party. The legislative history establishes that Congress did not intend such a result.

The district court’s interpretation of Subsection (B)—which would protect only unread emails stored in by web-based email service—also leads to an arbitrary and untenable “gap” in the legal protection of electronic communications.

Back the case goes to the lower court, reversed and remanded with instructions to reach a less illogical conclusion. And in doing so, the appeals court sets an important precedent that clarifies what the SCA actually covers.

Filed Under: 4th circuit, ecpa, emails, privacy, stored communications act

Wikileaks Refused To Publish Manafort Family Texts, So Someone Else Did

from the hypocrisy? dept

Update: A quick correction/clarification here. The hacked texts in questions were from Manafort's daughter, rather than Manafort himself, but included texts between Manafort and his daughter, as well as other texts about Paul that his daughter sent or received. Wikileaks, for its part, says it didn't publish the texts because they weren't verified. Except that multiple people confirmed the legitimacy of those texts including Paul Manafort himself. The point of the article still stands.

We just wrote about why it would be a dangerous move for press freedom for the DOJ to prosecute Julian Assange for publishing leaked documents. In that post, we noted that even if you think Julian Assange is a horrible human being and proactively trying to undermine US electoral sovereignty, the mere act of publishing leaked documents should not be criminal. But, that doesn't mean that Assange can't be hypocritical and one-sided. Obviously, during the 2016 election, when Wikileaks helped spread both John Podesta's emails and the DNC's emails, some wondered if Assange would have published similar messages from the Trump campaign. While publicly Assange insisted he disliked both campaigns equally, other reports and leaked (of course) chat messages certainly suggested otherwise, as did at least some of his apparent attempts to ingratiate himself with Trump insiders, including asking Don Jr. to leak his father's tax returns to Assange to "dramatically improve the perception of our impartiality."

Of course, when faced with an opportunity to post the equivalent of the Podesta emails on the Trump side, it appears that Assange decided not to do it. Public records-savant Emma Best recently chose to publish the entire collection of leaked Manafort family texts in a searchable database. These texts have long been out there and available if you knew where to look -- and had received widespread reporting in early 2017. However, beyond the excerpts, they were not fully available in a way that was searchable for most users.

Best communicated with Wikileaks, who admitted that it had the entire collection as well, but chose not to publish it -- which certainly can be read as hypocrisy on Assange's part, considering the similarities with the Podesta emails. As Best notes in discussing the decision to publish these in a more accessible format:

The public haven’t had access to the messages, and the press (including high profile and high budget outlets) haven’t had access to an easily searchable version – instead only to an unwieldy database.

This was nearly not the case, however – WikiLeaks had a copy of the database, but ultimately didn’t publish it, despite its newsworthiness and their willingness to publish unredacted information on the Democrats. Their unexplained decision not to put the database into a searchable format and make it public struck me as questionable at the time, but in light of the disclosure of their preference for the GOP it has become not only questionable, but hypocritical. WikiLeaks’ decision can no longer be trusted prima facie or viewed in terms of presumed good faith.

[....]

This noteworthy refusal, along with ongoing probes and charges filed against Manafort by the Special Counsel’s office, makes the text messages and their contents undoubtedly newsworthy. Their relevance to the general public may go beyond this, as the personal reality reflected in the messages presents the Manaforts as real people, rather than merely as abstract figures. This same reality is, of course, also relevant to news and current events, and to understanding the character and actions of those involved.

There may be reasons why Wikileaks chose not to publish these texts, but the fact that it eagerly published the Podesta emails, yet held back on publishing these texts should at least raise serious questions. Obviously, every publisher makes different decisions on what to publish and what not to publish. And there's no rule saying that you absolutely must publish every "equivalent" set of data or stories. But given all of the background here, and the high profile nature of this, it is noteworthy to point out the different approaches Wikileaks chose to take with two similar sets of data on different sides of the 2016 election.

Filed Under: emails, emma best, hypocrisy, john podesta, julian assange, paul manafort, texts, transparency
Companies: wikileaks