Ed Snowden Covered His Tracks Well; How Many Other NSA Staffers Did The Same?

from the gone-baby-gone dept

As we've seen, the NSA's story on "abuses" keeps changing. First there were no abuses at all, then there were a whole lot of abuses (but all unintentional) and now we know that there also were a bunch of intentional abuses. But here's the thing: these are only the abuses that the NSA caught. And, even then it's sketchy. As Marcy Wheeler has detailed, many of the "unintentional abuses" look like they were merely classified that way, when, in reality, they may have been intentional. Thanks to the magic of the NSA's special dictionary, they redefine abuses that exceed legal authority but are "performing the mission that the NSA wants them to perform" not as "abuses" but as "mistakes."

Either way, that only counts the abuses and "mistakes" that the NSA's audits discover. As we pointed out, it appears the NSA still has no idea what Ed Snowden took, which calls into question how good these so-called "audits" are. The latest reports coming out reveal that Snowden carefully bypassed or deleted the logs concerning his downloading actions:

The U.S. government's efforts to determine which highly classified materials leaker Edward Snowden took from the National Security Agency have been frustrated by Snowden's sophisticated efforts to cover his digital trail by deleting or bypassing electronic logs, government officials told The Associated Press. Such logs would have showed what information Snowden viewed or downloaded.

The government's forensic investigation is wrestling with Snowden's apparent ability to defeat safeguards established to monitor and deter people looking at information without proper permission, said the officials, who spoke on condition of anonymity because they weren't authorized to discuss the sensitive developments publicly.

Remember when Snowden claimed that, from his desk, he could run searches on anyone, and various NSA defenders like Rep. Mike Rogers scoffed at the idea and called him a liar? They claimed that any such searches would turn up in the audits. But, of course, if you can delete the log files, then those audits are meaningless.

And, if Snowden could do it, it's very, very likely that he's not the only one employed by the NSA or contracting for the NSA who knows how to cover their digital trail. And that leads to a very obvious question: sure, the NSA knows about thousands of unintentional violations and a bunch of intentional violations -- but what about all the violations it has no idea about because someone was able to bypass or delete the log files? Given that NSA employees almost certainly know that searches are audited, you'd have to imagine that nearly everyone who decided to willfully violate the law to, say, spy on a love interest (hello: LOVINT) or, perhaps, a personal enemy, would also seek ways to do so without leaving an incriminating log file. Snowden's efforts show that's possible -- meaning that it's likely others knew that as well.

And, given that it appears that top NSA brass may have been taken by surprise by this rather basic revelation (no audits are perfect, and smart folks like ones the NSA employs often know how to get around such things), it seems quite likely that the number of intentional NSA violations is much, much, much higher than is being reported, in part because the NSA itself still hasn't been able to figure out what happened.

Filed Under: abuses, audits, ed snowden, keith alexander, log files, nsa, nsa surveillance, violations

Judge In Grooveshark Lawsuit Orders Blog To 'Preserve' Logs That Had Already Been Deleted

from the dangerous-ruling dept

Earlier this month, we noted a problematic attempt by Grooveshark's parent company, Escape Media, to subpoena information on an anonymous commenter on the blog site Digital Music News. As we noted at the time, Universal Music had referenced that comment in its lawsuit against Grooveshark. It seemed bizarre to reference an anonymous comment, especially one that seemed like pure hearsay (it made claims about things Grooveshark employees had done). In the lawsuit between UMG and Grooveshark it seemed completely pointless (and, indeed, Grooveshark has been arguing as much in that particular lawsuit). Yet, at the same time, Grooveshark subpoenaed DMN in an attempt to find out who posted that comment. DMN resisted the subpoena, noting that it discards and overwrites its log files every few days anyway, and these files had been long gone already. It also pointed to California's shield law for journalists and the basic First Amendment protections for anonymous speech.

Unfortunately, the judge has ruled against Digital Music News, and ordered it to produce the information. The judge has indicated that he will not require this information during the appeal that DMN's lawyer indicated they would file... but did require "preservation" of the evidence during that time. Beyond the shield law and First Amendment issues raised here (we'll get to those), this raises a very, very troubling proposition for any website that regularly overwrites its log files. Escape Media had argued that even if DMN overwrote the log files, it should be required to hand over the information on the subpoena just in case the overwritten data was still available and could be recovered.

So, what do you do in this situation? Under the judge's order to "preserve" data that has already been deleted, what is a site to do? Do they have to immediately stop using their existing hardware and set up an entire clone -- hanging onto all of the original hardware for who knows how long, just in case a forensics expert can find a tiny piece of (useless for this case anyway) data that has been overwritten probably a hundred times already? That seems crazy. Paul Levy, from Public Citizen, who is representing DMN on this issue, highlighted many of the issues in his blog post about this:

The imposition of data preservation requirements on a journalist who is not a party to the litigation raises questions apart from the merits of the order. Journalists need to be able to discard data when they no longer have any of their own use for it.  Yes, “the public has a claim to every man’s evidence,” but don’t members of the public who are not involved in litigation have the right to discard information despite the fact that it might turn out to be useful evidence for somebody else’s case?  Does the public have a claim to heroic efforts on every man’s part?  Shouldn’t there be higher standards for subpoenas demanding intrusive searches for discarded data in the hands of third parties?

The problem is compounded when it is a journalist that has been subpoenaed.  To what extent does society have any entitlement to make journalists in particular take heroic measures, such as searching the nooks and crannies of their computer equipment for fragments of discarded data?  The judge was sensitive to the fact that our client here is a journalist, telling Escape Media that he was not prepared to allow it to make any general search of Digital Music News’ computers.  But an issue that we may have to pursue on appeal is whether a journalist should ever have to undertake such drastic preservation efforts in aid of a lawsuit in which he is not involved, particularly given the relative unlikelihood that fragments of identifying data remain on his computers somewhere.

Indeed, the problem is broader than just journalists.  Companies often keep log files with respect to server visits (and hosted comments), but there is little business justification for keeping those logs forever; so generally speaking they are discarded after a period of time (EFF's best practices recommendations are worth a look in this regard).  Does the mere act of discarding log files set a company up for the possibility of a demand for forensic examination of the underlying servers, in the hope that some fragment of the data might be recovered?  In this regard, the trial court's order has chilling implications for other California companies, even beyond the issue of journalists. 

Issues of how to preserve the data remain to be decided.  This is not like just leaving one of your file cabinets untouched for a period of time; it is not even as easy as making sure you don't delete any of your email.  Preserving the web site while creating a copy of the underlying servers is a complicated process, requiring the services of a forensic specialist, and the cost could be substantial.  The estimates that we have been given are well into the five figures; but even the cost of several thousand dollars would be an enormous imposition on this small company.

It really is quite a difficult issue, and if the ruling stands, could become a massive headache for any company in California.

Separately, we should not ignore the First Amendment and shield law issues. DMN is not a party in this case, and it's not even clear why this information is needed. Escape/Grooveshark can and should point out that the information contained in the comment is pure hearsay so it shouldn't have to deal with it in the original case. The company has not filed a defamation claim against the commenter and does not appear to have met the high bar required to unveil an anonymous commenter anyway. This is a pretty big concern for any journalist or blogger out there. Being dragged into a third party dispute because someone comments on your site can represent a pretty big problem for a lot of smaller sites.

While Grooveshark's legal fight against the major labels certainly raises some interesting copyright questions, it's disappointing to see them going down this path and potentially creating serious problems not just for Digital Music News, but tons of journalists and websites.

Filed Under: anonymous speech, evidence, first amendment, log files, subpoena
Companies: digital music news, grooveshark, universal music

Swedish Police Say Anti-Piracy Law Has Harmed Ability To Catch Criminals

from the consequences dept

We've pointed out many times in the past the "unintended" consequences of certain activities, and it looks like the entertainment industry's worldwide effort to push for more and more industry-favorable copyright laws is causing serious problems elsewhere. Apparently, Anders Ahlqvist, who runs the Swedish IT crime unit is noting that the response to the IPRED law in Sweden (pushed by the entertainment industry to crack down on unauthorized file sharing) means that it's now more difficult for him to do his job. Part of the issue, of course, is that various ISPs responded to the law by seeking to protect their users' privacy by deleting log files. Of course, that probably means it's only a matter of time before the industry pushes for new data retention laws, despite evidence that more data retention can actually make life trickier for law enforcement as well. Still, at some point people need to recognize that the entertainment industry's single-minded focus on "stomping out file sharing" rather than adding value through new business models has some serious costs elsewhere.

Filed Under: anti-piracy, encryption, log files, sweden, unintended consequences

US Subpoenaed All Visitor Logs From Online News Publication; Falsely Said Site Couldn't Tell Anyone

from the the-abuse-of-secrecy dept

We've seen it over and over again: when the government can hide behind the veil of secrecy, it can abuse its power. That's why we're supposed to have checks and balances on power, but all too often governments figure out ways to get around that. The latest example is that US attorneys issued a subpoena to the person hosting the news website Indymedia, demanding a logfile of all visitors from a particular day and ordered the woman not to reveal the existence of the subpoena itself. Indymedia doesn't keep its logfiles, so it simply had nothing to turn over, and after realizing this, the government withdrew the request. However, the requirement to stay silent about it still was there, and the woman asked the EFF for help. With the EFF involved, the government finally backed down and admitted that there was absolutely no legal basis for demanding that the woman not talk about the subpoena, and "chose not to go to court" over the matter, despite threatening to at an earlier time.

This is hardly the first time we've heard about the government using (and abusing) procedures like national security letters to not just demand all sorts of info, but also demand that the recipient not tell anyone about it. Every once in a while we're able to hear about these situations because a group like the EFF or the ACLU pushed back and were able to get the US government to back down, but that's likely only a fraction of the situations where this has happened. In many others, we likely don't even know at all, because the recipient gave in, either because they didn't realize their legal rights, or because it just wasn't worth the fight. But when the government thinks that it can demand certain data and cloak the demand behind a related demand for secrecy, it makes it way too easy for the government to abuse the process. It basically guarantees no oversight, so why not ask for way more than the law requires, knowing that most people won't push back and no one will ever find out about it?

Filed Under: log files, secrecy, subpoena
Companies: eff, indymedia

More Swedish ISPs Decide To Keep No Logs To Protect Users

from the consumer-demand... dept

We recently noted that a Swedish ISP was advertising the fact that it doesn't keep log files of its users, following the newly implemented Swedish law, IPRED, that requires ISPs to hand over log files if users are accused of copyright infringement online. It appears that the attention generated by that one ISP has now lead multiple Swedish ISPs to also promise to delete all user data, so that there would be nothing to turn over. As a representative from Tele2 noted: "It's a strong wish from our customers, so we decided not to store information on customers' IP numbers anymore." Between this and the new interest in encryption and VPN software in Sweden, you have to wonder why the entertainment industry was so excited about the IPRED law passing in the first place.

Filed Under: isps, log files, privacy, sweden
Companies: tele2

Swedish ISP Starts Deleting Log Files To Protect Users From IPRED Law

from the and-so-it-goes dept

There's been plenty of attention paid to Sweden's new IPRED law, which requires ISPs to hand over identifying information on those accused of file sharing -- but we've already noted that all the law is really doing is driving people to alternatives, such as encryption. And, now, it appears that even ISPs are recognizing that it just makes good business sense to better protect their users. Broadband Reports points out that a Swedish ISP, Bahnhof, has started destroying its own log files, rather than hand them over to authorities. The company's CEO notes that nothing in the law requires ISPs to keep log files -- but only to turn over what info has been retained. It seems likely that Bahnhof may have just convinced a bunch of folks to see if they can sign up for new broadband from the company. Any bets on how long it takes Sweden to pass a new law requiring ISPs to retain data for a certain period of time? Even the CEO admits that's likely -- but notes that it will show this is nothing more than a witch hunt by the entertainment industry:

"And then the legislators will have to step up and say they want to have data storage, not to catch terrorists but to help record companies and the movie industry in the hunt for file sharers."

Filed Under: ipred, log files, sweden
Companies: bahnhof

Search Engine Ditches All Log Files

from the searching-blind dept

There's been a silly, and mostly meaningless, one-upmanship lately in the search engine world, concerning how long the search engines retain log file info on things like the IP address of searchers. Some privacy advocates have claimed that this is a big privacy issue, though the "threat" is significantly overblown. However, it's still interesting to see a Dutch meta-search engine now announce that it's ignoring IP addresses entirely. The site, Ixquick, which has always promoted itself as being privacy friendly, used to dump log files after 48 hours, but is now ditching them completely. That's great, as an option, but it hardly means that others should do the same. It gives ixquick a way to differentiate itself in the market -- and those who really are worried about their IP addresses being watched (and haven't figured out how to use an IP-anonymizing service yet) can go use that search engine. But for those who actually find benefits in sharing some data with their search engine of choice, they should be free to do so.

Filed Under: log files, privacy, search engine
Companies: ixquick

Viacom Gets To Find Out What YouTube Videos You Watched

from the not-good dept

In the ongoing trainwreck that is Viacom's misguided lawsuit against YouTube (the one they would be better off losing) a judge has come out with a ruling on evidence that Google has to hand over to Viacom -- and it's being portrayed in the press as both a win and a loss for Google. On the "win" side, Google does not have to hand over the YouTube source code (or the source code of its filtering system). This makes sense, as the source code is rather meaningless here, and this request was clearly a reach from the start.

However, much more troublesome is the judge's ruling that Google does need to hand over log files including the IP address and usernames of people who viewed YouTube videos. This represents a huge violation of privacy and a clear violation of the Video Privacy Protection Act (VPPA). This was the law we were just discussing, due to a lawsuit concerning Blockbuster revealing rental info via Facebook's Beacon program. It was originally passed after the video rental history of Supreme Court nominee Robert Bork was released in the press. The idea is that what movies you rent should be private info not to be shared.

The court pretty much ignored this law, only mentioning it in a footnote, suggesting that it only applies to video tapes. But, as the EFF points out in the link above, the law actually says "prerecorded video cassette tapes or similar audio visual materials." But, more to the point, it is not at all clear why Viacom should need this specific information. If it wants to show numbers of people who viewed certain videos, it seems that aggregate info should be sufficient. Having Google hand over much more info doesn't seem to serve any purpose related to the legal questions involved in the case. Update: There are now claims that Viacom will be very limited in how the data can be used -- with the threat of a contempt of court charge if anyone other than the lawyers involved in the case and specific experts see the data, but that's really not sufficient for privacy purposes. There's no way to make sure the data only stays in those hands, and even so it's still a violation of the privacy of users.

Filed Under: lawsuits, log files, video rentals
Companies: google, viacom, youtube

MPAA Would Rather TorrentSpy Spy On Users Than Stop Offering Service?

from the motivations,-huh? dept

TorrentSpy and the MPAA have been involved in a legal fight for quite some time. TorrentSpy is basically a search engine for files that are offered for download via BitTorrent. However, because the MPAA views such BitTorrent as a tool for unauthorized use, it's trying to sue the search engine, rather than go after those who are actually responsible for sharing unauthorized content. There was a slightly troublesome ruling earlier this year, where a judge ordered TorrentSpy to spy on its users -- violating TorrentSpy's own privacy policy. Rather than do so, TorrentSpy decided to block access to US users. Now, you would think this would make the MPAA happy. After all, the site they were so worried about was no longer an issue for the entire US market. Instead, the MPAA is back in court claiming that this action is merely another illegal move by the company. Apparently, the MPAA would rather have TorrentSpy keep operating, but spy on its users, than block access. That doesn't make much sense if TorrentSpy is really such a huge problem. Unless, of course, the MPAA doesn't have any real evidence that TorrentSpy is doing anything wrong -- and this is about the only way it hopes to prove its case.

Filed Under: bittorrent, log files, search engines, trackers
Companies: mpaa, torrentspy