Former DHS Secretary Says We Can Make Airports Safer From Terrorists By Rearranging Security Checkpoints

from the another-security-theater-script-rewrite-in-the-works dept

Another terrorist attack somewhere in the world* has provoked another round of punditry from former government officials on how to protect America from future attacks. Over the coming weeks, there will be no shortage of stupid ideas, useless ideas and pointless discussions about "heightened security" at any place people gather.

*"World" = Western Europe only

None of it will matter. Security has never really been scaled back anywhere since the 9/11 attacks -- certainly not to the levels seen prior to September 2001. There's only so much security anyone can actually provide but endless off-Broadway productions of security theater to be explored.

Michael Chertoff -- head of the Chertoff Group and former Homeland Security secretary -- spoke to CBS This Morning about what might need to be done to make airports more secure. Chertoff is right about one thing: TSA checkpoints create a tempting target of massed humans -- all waiting for their chance to be probed, scanned and groped by government employees.

“Well I have to say this is something I’ve spoken to people about for some time. The actual portion of the airport before the checkpoint is not really controlled by the federal government, it’s controlled by the local authorities. And it has increasingly become vulnerable, because as people wait to go through security they actually congregate there.”

I'm not sure the local boys will appreciate this dig at their security skills. But Chertoff's "solution" is just a literal expansion of federal government territory.

“And so now there’s an effort I think on the part of TSA to start to move the airports into pushing the security envelope back. We’ve seen some of that in terms of not allowing you to park in front of the terminal, but I think we’re going to have to step that up.”

So… move the target. Instead of being deep inside the airport, it will be closer to the entrance. As Gawker's Alex Pareene notes, at some point you can't push the envelope back any further. And there's no expansion point that will magically protect fliers from terrorist attacks.

Ah. Of course. We’ll “push the security envelope back.” The old checkpoints created crowds, sure, but once we move the security checkpoints back, just a bit bit further (to just before you enter the airport, I guess), it will be much safer for everyone, at least once everyone gets past the new checkpoints. Maybe eventually we can push the security envelope back to before you get in your car to go to the airport—your garage door, maybe?

Push people closer to the entrance. Make them more vulnerable to car bombs/larger groups of attackers. Push the envelope all the way out to the connecting roads. Same problem but with the added bonus of intrusive vehicle searches for everyone heading to the airport, whether they're planning to fly or not. There's no point where traveler safety suddenly spikes. Every nudge of the envelope opens as many attack vectors as it shuts down.

That's the ridiculousness of the TSA. It has done almost nothing to make flying safer. The only thing anyone can say for sure is that the TSA has made flying more annoying.

Maybe they'll move the checkpoints. Maybe they won't. Airplanes aren't the target. People are. And people are everywhere. To paraphrase Abraham Lincoln, you can't save all of the people all of the time, but you can make most of them miserable most of the time. That's how the DHS works. Actions must always be followed by reactions specifically tailored to address the parameters of the last attack or perceived threat. Somehow, we'll be safer by staying one step behind and ceding control to the government.

Filed Under: brussels, checkpoints, dhs, michael chertoff, security, security theater, tsa

New Group Seeking Privacy/Security Balance Loads Up On Former Government Officials And RSA Employees

from the don't-get-your-hopes-up dept

"I helped to organize it [Digital Equilibrium Project] with McKinsey's help with the idea that people on various sides were talking past one another, often without the facts," former Executive Chairman of RSA Art Coviello told eWEEK. "Our participants bring significant networks and resources to bear from themselves and the organizations they work with, and we're confident we have the resources to execute on the mission."

[...]

"We hope to create a groundswell of thinking—not through acrimonious and emotional debate, but through active listening and fact-based dialogue so we can we make progress before it is too late," he said.

So says Art Coviello of his new project -- one that he hopes will bring some coherence to the balancing act between security and privacy.

This is the same Art Coviello who said anonymity is the "enemy of privacy." Why? Because it allows bad people to do bad things and get away with it -- a sentiment echoed by any number of law enforcement officials and intelligence agency heads.

Coviello's timing couldn't be better. Against the backdrop of the FBI's efforts to force Apple to help it break into iPhones, Coviello hopes a balanced discussion of the issues may result in workable common ground between parties he feels often "talk past each other."

But the Digital Equilibrium Project isn't going to be the balanced discussion Coviello is framing it as. The list of participants seems to indicate the discussion will result in severe inner ear damage, rather than equilibrium.

Stewart Baker
Former 1st Assistant Secretary of DHS General Counsel of the NSA

Michael Chertoff
Executive Chairman of The Chertoff Group
U.S. Secretary of Homeland Security (’05-’09)

Edward Davis
Former Boston Police Commissioner

Michael McConnell
Former Director of the NSA and
Director of National Intelligence
[and head of Booz Allen, which goes unmentioned on DEG page...]

JR Williamson
Corporate Chief Information Officer, Northrop Grumman

Richard Clarke
Former White House Advisor
Chairman and CEO, Good Harbor Security Risk Management
[Former "cybersecurity czar" to be more precise, one who has suggested the government "search" internet traffic travelling in and out of the US (to prevent theft by China{?}). On the plus side, he did sign a letter to the Administration stating that mandated encryption backdoors are a terrible idea.]

That's only part of the stacked deck, but what a hand! NSA, DHS, Boston PD, military-industrial contractor, a cybersecurity "czar…"

From there, it gets marginally better.

Tim Belcher
Former CTO, RSA
[RSA worked closely with the NSA to recommend an undermined encryption standard]

Jim Bidzos
Chairman and CEO, Verisign
[Verisign has worked with ICE and others to make site seizures easier, participated in global internet censorship]

Art Coviello
Former Executive Chairman, RSA
[See above]

Kasha Gauthier
Program Committee Co-Chair, NICE
Special Advisor, Boston College Cybersecurity Masters Program
[Not mentioned: Gauthier's position as Director of Academic and Community Alliances at RSA. Also serves as Director of Marketing and Strategy.]

It gets much better from there. Most of the remaining names on this list have a long history of protecting privacy and working towards enhancing security for all internet users, not just government agencies.

Dr. Ann Cavoukian, Ph.D.
Executive Director of the Privacy and Big Data Institute at Ryerson University
[Former Ontario Privacy Commissioner, who has stated that "encryption is freedom" and taken legal action against local law enforcement for sharing sensitive medical information with US law enforcement agencies.]

Larry Clinton
President and CEO, Internet Security Alliance
[The ISA is a trade alliance which lobbies on behalf of businesses. In light of FBI v. Apple, this is possibly a good thing. Clinton's statements indicate he feels the government's belief that "information sharing" will solve cybersecurity woes is largely unfounded.]

Brian Fitzgerald
Chief Marketing Officer, Veracode
[Veracode was founded by white hat hackers and routinely provides updates on the current state of cybersecurity in the nation. Just as routinely, it finds government agencies to be the worst at security.]

J. Trevor Hughes
President and CEO, International Association of Privacy Professionals
[IAPP is a non-profit, "non-advocacy" group, which would make it about as unbiased as anyone can get in this discussion.]

Nuala O’Connor
President and CEO,
Center for Democracy and Technology
[O'Connor was the DHS's first Chief Privacy Officer and did that job well enough to earn the praise of the ACLU and others -- a tough thing to do with the inherent limitations of the position, which did not allow her to publicly criticize the DHS's failures. Since then, she has headed up the Center for Democracy and Technology, which advocates for privacy, freedom of speech and surveillance reform.]

If the RSA insiders are "swing votes," this discussion could actually end up "balanced." But it seems unlikely to result in the common ground Coviello says he's seeking. He wants to break up "polarized, entrenched views" but a majority of those participating will likely advocate for positions that closely align with the government and its contractors.

Fortunately, this wasn't assembled by Congress or the administration, where it might do some actual damage. Some decent discussion may result from this blend of privacy advocates and former government officials, but the composition is still too one-sided to state this with any confidence.

Filed Under: ann cavoukian, art coviello, brian fitzgerald, consortium, edward davis, jim bidzos, jr williamson, kasha gauthier, larry clinton, michael chertoff, michael mcconnell, nuala o'connor, privacy, richard clarke, security, stewart baker, trevor hughes

Former NSA Directors Coming Out Strongly *Against* Backdooring Encryption

from the didn't-see-that-coming dept

Earlier this summer, we were taken a bit by surprise when both former NSA/CIA boss Michael Hayden, along with former DHS boss Michael Chertoff, came out fairly strongly against backdooring encryption at a time when their counterparts still in the government seemed to be leaning in the other direction and have been pushing proposals to mandate backdoors. And it appears they're not backing down. Hayden has now doubled down with further statements against backdooring encryption, according to Lorenzo Franceschi-Bicchierai at Vice's Motherboard.

Michael Hayden, the former head of the US top spy agencies, the CIA, and the NSA, thinks the US government should stop railing against encryption and should support strong crypto rather than asking for backdoors.

The US is “better served by stronger encryption, rather than baking in weaker encryption,” he said during a panel on Tuesday.

Later, he told Lorenzo that part of his thinking is that the intelligence community doesn't need such backdoors since it has other ways of getting that info:

“In retrospect, we mastered the problem we created by the lack of the Clipper Chip,” he said. “We were able to do a whole bunch of other things. Some of the other things were metadata, and bulk collection and so on.”

Hayden is being a bit snarky there. He knows that privacy advocates will take his words about backdooring encryption and celebrate them, so he's using it at the same time to argue in favor of the other problematic programs -- programs that Hayden is most closely associated with involving mass surveillance. He's also being disingenuous. The metadata and mass surveillance efforts generally give you access to a different kind of information. What Hayden leaves out, of course, is the real reason why backdoors usually aren't that important: because there are almost always ways to hack into encrypted data, though that also raises serious questions.

Meanwhile, another former NSA director, Mike McConnell, has joined with the other two Michaels in arguing against backdoors. This according to Kaveh Waddell at the National Journal:

“Don’t get in the way of pro­gress,” Mc­Con­nell said Thursday at a pan­el dur­ing an en­cryp­tion sum­mit hos­ted by The Wash­ing­ton Post. “Don’t get in the way of in­nov­a­tion and cre­ativ­ity, be­cause this is go­ing to hap­pen. Some­body’s go­ing to provide this en­cryp­tion.”

Mc­Con­nell’s po­s­i­tion is a com­plete de­par­ture from the per­spect­ive he rep­res­en­ted in gov­ern­ment, a shift he has pub­licly ac­know­ledged. When he ran the Na­tion­al Se­cur­ity Agency in the 1990s, Mc­Con­nell was a vo­cal sup­port­er of the Clip­per Chip, a device de­veloped by the NSA that al­lowed the gov­ern­ment to de­crypt elec­tron­ic com­mu­nic­a­tions.

Of course, what's mostly left out of this discussion is that both McConnell and Hayden are now in the private sector -- Hayden at the Chertoff Group with Michael Chertoff, and McConnell at defense contracting giant (and former Ed Snowden employer) Booz Allen Hamilton -- where both have economic reasons for supporting actual stronger security, rather than undermining such security. Either way, in this debate, it seems that those pushing for backdooring encryption are increasingly being marginalized entirely. Even their normally faithful supporters have moved on into the world of reality, where backdooring encryption only leads to trouble.

Filed Under: backdoors, encryption, michael chertoff, michael hayden, michael mcconnell, nsa, surveillance

Washington Post Publishes... And Then Unpublishes... Opinion Piece By Ex-Intelligence Industry Brass, In Favor Of Strong Encryption

from the what-happened? dept

Update: And... the article has been republished at the Washington Post's site with a note claiming that it was accidentally published without fully going through its editing process. Extra points if anyone can spot anything that's changed...

Earlier this week, we noted with some surprise that both former DHS boss Michael Chertoff and former NSA/CIA boss Michael Hayden had come out against backdooring encryption, with both noting (rightly) that it would lead to more harm than good, no matter what FBI boss Jim Comey had to say. Chertoff's spoken argument was particularly good, detailing all of the reasons why backdooring encryption is just a really bad idea. Last night, Chertoff, along with former NSA boss Mike McConnell and former deputy Defense Secretary William Lynn, published an opinion piece at the Washington Post, doubling down on why more encryption is a good thing and backdooring encryption is a bad thing.

Yes, the very same Washington Post that has flat out ignored all of the technical expertise on the subject and called for a "golden key" that would let the intelligence community into our communications. Not only that, but after being mocked all around for its original editorial on this piece, it came back and did it again.

Of course, you may note that I have not linked to this piece by Chertoff, McConnell and Lynn at the Washington Post... and that's because it's gone. If you go there now you get oddly forwarded to a 2013 story (as per the rerouted URL), with a 2010 dateline, claiming that "this file was inadvertently published." Of course, this is the internet, and the internet never forgets. A cached version of the story can be found online. The title really says it all: Why the fear over ubiquitous data encryption is overblown. Of course, technical experts have been saying that for decades, but it's nice to see the intelligence community finally coming around to this. And here's a snippet of what was said in the article before it disappeared.

We recognize the importance our officials attach to being able to decrypt a coded communication under a warrant or similar legal authority. But the issue that has not been addressed is the competing priorities that support the companies’ resistance to building in a back door or duplicated key for decryption. We believe that the greater public good is a secure communications infrastructure protected by ubiquitous encryption at the device, server and enterprise level without building in means for government monitoring.

First, such an encryption system would protect individual privacy and business information from exploitation at a much higher level than exists today. As a recent MIT paper explains, requiring duplicate keys introduces vulnerabilities in encryption that raise the risk of compromise and theft by bad actors. If third-party key holders have less than perfect security, they may be hacked and the duplicate key exposed. This is no theoretical possibility, as evidenced by major cyberintrusions into supposedly secure government databases and the successful compromise of security tokens held by the security firm RSA. Furthermore, requiring a duplicate key rules out security techniques, such as one-time-only private keys.

The op-ed also points out that "smart bad guys" will still figure out plenty of ways to use encryption anyway and all we're really doing is weakening security for everyone else. And, of course, it raises the fact that if the US demands such access, so will China and other companies.

Strategically, the interests of U.S. businesses are essential to protecting U.S. national security interests. After all, political power and military power are derived from economic strength. If the United States is to maintain its global role and influence, protecting business interests from massive economic espionage is essential. And that imperative may outweigh the tactical benefit of making encrypted communications more easily accessible to Western authorities.

These are the same basic arguments that experts have been making for quite some time now. What's also interesting is that the three former government officials also point out that the "threat" of "going dark" is totally overblown anyway. It raises the original crypto wars and the fight over the Clipper Chip, and notes that when that effort failed, "the sky did not fall, and we did not go dark and deaf."

But the sky did not fall, and we did not go dark and deaf. Law enforcement and intelligence officials simply had to face a new future. As witnesses to that new future, we can attest that our security agencies were able to protect national security interests to an even greater extent in the ’90s and into the new century.

This is an important bit of input into this debate, and one hopes that the Washington Post only "unpublished" it because it forgot to correct some grammar or something along those lines. Hopefully it is republished soon -- but even if it was published briefly, this kind of statement could be a necessary turning point, so that hopefully we can avoid having to waste any further effort on the wasteful idiocy of a second crypto war.

Filed Under: backdoors, encryption, going dark, james comey, jim comey, michael chertoff, michael mcconnell, mobile encryption, william lynn
Companies: washington post

Both Michael Hayden And Michael Chertoff Surprise Everyone By Saying FBI Is Wrong To Try To Backdoor Encryption

from the going-dark? dept

Well, here's one we did not see coming at all. Both former Homeland Security boss Michael Chertoff and former NSA and CIA director Michael Hayden have said that they actually disagree with current FBI director Jim Comey about his continued demands to backdoor encryption. Given everything we've seen in the past from both Chertoff and Hayden, it would have been a lot more expected to see them both toe the standard authoritarian surveillance state line and ask for more powers to spy on people. At the Aspen Security Forum, however, both surprised people by going the other way. Marcey Wheeler was the first to highlight Chertoff's surprising take:

I think that it’s a mistake to require companies that are making hardware and software to build a duplicate key or a back door even if you hedge it with the notion that there’s going to be a court order. And I say that for a number of reasons and I’ve given it quite a bit of thought and I’m working with some companies in this area too.

First of all, there is, when you do require a duplicate key or some other form of back door, there is an increased risk and increased vulnerability. You can manage that to some extent. But it does prevent you from certain kinds of encryption. So you’re basically making things less secure for ordinary people.

The second thing is that the really bad people are going to find apps and tools that are going to allow them to encrypt everything without a back door. These apps are multiplying all the time. The idea that you’re going to be able to stop this, particularly given the global environment, I think is a pipe dream. So what would wind up happening is people who are legitimate actors will be taking somewhat less secure communications and the bad guys will still not be able to be decrypted.

The third thing is that what are we going to tell other countries? When other countries say great, we want to have a duplicate key too, with Beijing or in Moscow or someplace else? The companies are not going to have a principled basis to refuse to do that. So that’s going to be a strategic problem for us.

He's right on all accounts, and does an astoundingly good job summarizing all of the reasons that many experts have been screaming about ever since Comey first started whining about this bogus "going dark" claim. But then he goes even further and makes an even more important point that bears repeating: it's not supposed to be easy for law enforcement to spy on people, because that has serious risks:

Finally, I guess I have a couple of overarching comments. One is we do not historically organize our society to make it maximally easy for law enforcement, even with court orders, to get information. We often make trade-offs and we make it more difficult. If that were not the case then why wouldn’t the government simply say all of these [takes out phone] have to be configured so they’re constantly recording everything that we say and do and then when you get a court order it gets turned over and we wind up convicting ourselves. So I don’t think socially we do that.

On top of that, he points out, as we and many others have, that even if you can't figure out what's in an encrypted message it does not mean you've really "gone dark." There are other ways to figure out the necessary information, and people always leave some other clues:

And I also think that experience shows we’re not quite as dark, sometimes, as we fear we are. In the 90s there was a deb — when encryption first became a big deal — debate about a Clipper Chip that would be embedded in devices or whatever your communications equipment was to allow court ordered interception. Congress ultimately and the President did not agree to that. And, from talking to people in the community afterwards, you know what? We collected more than ever. We found ways to deal with that issue.

Soon after that, at the same conference, Hayden spoke to the Daily Beast and more or less agreed (it is worth noting that Hayden works for Chertoff at the Chertoff Group these days). Hayden's denunciation of Comey's plan is not so detailed or thought out, and he admits he hopes that there is a magic golden key that's possible, but recognizing it's probably not, he thinks the damage may be too much:

“I hope Comey’s right, and there’s a deus ex machina that comes on stage in the fifth act and makes the problem go away,” retired Gen. Michael Hayden, the former head of the CIA and the NSA, told The Daily Beast. “If there isn’t, I think I come down on the side of industry. The downsides of a front or back door outweigh the very real public safety concerns.”

As the Daily Beast notes, this is -- to some extent -- a roll reversal between Hayden and Comey who famously clashed over Hayden's original warrantless wiretapping program after 9/11, with Comey actually arguing against some of the program (though what he argued against wasn't as complete as some believe). Still, it's quite amazing to see both Chertoff and Hayden point out what the tech sector has been telling Comey for months (decades if you go back to the original "crypto wars.") This isn't a question about "not wanting to do the work" but about the fact that any solution is inherently much more dangerous for the public.

Filed Under: encryption, going dark, james comey, jim comey, michael chertoff, michael hayden, mobile encryption

Ex-DHS Director Michael Chertoff: The Public Spying On Famous People With Their Smartphones Is A Bigger Issue Than NSA Spying

from the wanna-run-that-by-me-again? dept

Former director of Homeland Security (and current profiteer off of any "security" scare) Michael Chertoff has penned quite an incredible op-ed for the Washington Post, in which he argues that the real threat to privacy today is not the NSA spying on everyone, but rather all you people out there in the public with your smartphones, taking photos and videos, and going to Twitter to post things you overheard more important people say. Seriously. It starts out by claiming this is a "less-debated threat":

So it is striking that two recent news stories illustrate a less-debated threat to privacy that we as a society are inflicting on ourselves. Last week, a passenger on an Acela train decided to tweet in real time his summary of an overheard phone conversation by Gen. Michael Hayden, a former director of the National Security Agency (NSA) and the CIA (and my current business partner). The same day, a photo was published of Maryland Attorney General Douglas Gansler at a summer party where he was surrounded by underage youths who apparently were drinking.

But he then goes on to argue that this kind of thing is more troubling than the NSA revelations, which Chertoff suggests is no big deal:

Of course, the delicious irony is obvious: In one case, the former NSA chief becomes a victim of eavesdropping. In the other, a politician critical of teen drinking fails to intervene when he is surrounded by it. But both stories carry a more troubling implication. The ubiquitousness of recording devices ­— coupled with the ability everyone has to broadcast indiscriminately through Twitter, YouTube and other online platforms — means that virtually every act or utterance outside one’s own home (or, in Gansler’s case, inside a private home) is subject to being massively publicized. And because these outlets bypass any editorial review, there is no assurance that what is disseminated has context or news value.

It would appear that Chertoff seems to believe that there should be no expectation of privacy for the things you actually do in private -- generating metadata about who you call, where you go, what websites you visit, etc. But, stuff that you actually do in public should never be "broadcast" because it might embarrass famous people.

And, yes, it's the famous people being embarrassed that seems to most concern Chertoff:

If a well-known person has an argument with a spouse or child at a restaurant, should it be broadcast? If a business personality expresses a political opinion at a private party, should that opinion (or a distortion of it) be passed on to the rest of the world? If a politician buys a book or a magazine at an airport, should a passerby inform everyone?

See? Think of those poor well-known people, having people telling others about what they do. What a shame! Incredibly, he argues that it's this exposing of the public actions of famous people that creates real chilling effects -- and not the NSA's spying, which he calls "exaggerated."

Are we creating an informant society, in which every overheard conversation, cellphone photograph or other record of personal behavior is transmitted not to police but to the world at large? Do we want to chill behavior and speech with the fear that an unpopular comment or embarrassing slip will call forth vituperative criticism and perhaps even adversely affect careers or reputations? Do we need to constantly monitor what we say or do in restaurants, at sporting events, on public sidewalks or even private parties?

I don't know what clueless PR flack thought this was a good strategy, but the clear connotation is hard to miss: Look, we the powerful people get to spy on everyone, but the second you turn the tables and spy on us and the things we do in public, what a horrible shame! Something must be done!

Filed Under: famous people, michael chertoff, michael hayden, nsa, nsa spying, smartphones, surveillance, the public

Former DHS Head On Google Glass: Intrusive Surveillance Is Bad -- If It's A Corporation Doing It

from the you-know,-it's-completely-possible-that-BOTH-are-bad dept

With Google's eyewear seemingly headed to the general public in the not-too-distant future, many people have expressed concern about being recorded against their wishes. As Mike pointed out, there's a bit of a backlash/moral panic on display right now, which has resulted in a petition requesting the White House ban the devices. He also mentioned briefly that former DHS head Michael Chertoff had written an editorial about the privacy implications of Google Glass.

Chertoff analyzes some of the privacy implications raised by Google Glass but, considering his former position in the DHS and his current role as the head of The Chertoff Group, a "global security advisory firm," this editorial comes off as one-sided and tone deaf. Why would someone who seemingly has no concern about government intrusion into people's privacy care about a corporation's move onto the same turf? Bruce Schneier addresses this dissonance briefly in his post linking to Chertoff's editorial.

It's not unusual for government officials -- the very people we disagree with regarding civil liberties issues -- to agree with us on consumer privacy issues.

Deep down, we're all human, I suppose. Or, at the very least, we have common enemies. Chertoff is concerned about the potential of a corporation collecting and controlling this massive amount of data. But is his concern genuine? Schneier addresses that as well.

But don't forget that this person advocated for full-body scanners at airports while on the payroll of a scanner company.

Chertoff gets off on the wrong foot by comparing Google Glass with surveillance drones, referring to government and law enforcement's "acceptable" surveillance while trying to paint a horrific portrait of a sky filled with corporate surveillance.

Imagine a world in which every major company in America flew hundreds of thousands of drones overhead, 24 hours a day, seven days a week, 365 days a year, collecting data on what Americans were doing down below. It's a chilling thought that would engender howls of outrage.

Now imagine that millions of Americans walk around each day wearing the equivalent of a drone on their head: a device capable of capturing video and audio recordings of everything that happens around them. And imagine that these devices upload the data to large-scale commercial enterprises that are able to collect the recordings from each and every American and integrate them together to form a minute-by-minute tracking of the activities of millions.

There's really no need to imagine any part of this scenario. Law enforcement entities all over the US are purchasing drones and our government is using this same equipment to patrol borders and keep tabs on large crowds.

There are legitimate privacy concerns, but Chertoff's background distracts from his message, especially when he himself brings up drone usage that likely concerns Americans more than privacy invasions from Glass wearers.

So, who owns and what happens to the user's data? Can the entire database be mined and analyzed for commercial purposes? What rules will apply when law enforcement seeks access to the data for a criminal or national security investigation? For how long will the data be retained?

These are the questions that should be raised and Google and its competitors should probably seek some answers before turning interactive eyewear into a tool for second-hand government surveillance. More importantly, the government itself should probably answer a few of these questions. What are the rules that apply when law enforcement (or larger security agencies) seek to obtain this handily compiled data? As it stands right now, most of this process is shrouded in secrecy and attempts to pry some answers out of the government's hands have been rebuffed via claims of "national security" or in the form of redacted-to-abstraction FOIA "responses."

The length of data retention should be addressed as well. As Chertoff points out, Google will probably handle these questions with a lengthy Terms of Service agreement, one that most users will never read until something undesirable happens. A convoluted TOS is a company's best friend, but at least the information is freely available. The same can't be said for law enforcement and government entities.

Ubiquitous street video streaming will capture images of many people who haven't volunteered to have their images collected, collated and analyzed. Even those who might be willing to forgo some degree of privacy to enhance national security should be concerned about a corporate America that will have an unrestricted continuous video record of millions.

Yes, this is a definite downside to Google Glass. But Chertoff muffs this by worrying that even good citizens (those willing to "forgo some privacy to enhance [ha!] national security") won't be thrilled that any citizen could be "taping" them at any time. Once again, we're contrasting the actions of a corporation with the actions of government and law enforcement. But Chertoff fails to see how both can be undesirable. Instead, he frames Google's product as an encroachment but paints government surveillance as, at worst, a very necessary evil.

We need to consider what rights consumers have, and what rights nonparticipant third parties should have.

Sure, consumers should have rights, "nonparticipant third parties" especially. Unless they're American citizens being increasingly surveilled by the "good guys." This huge number of "nonparticipant third parties" doesn't even warrant a mention by Chertoff.

Chertoff has a suggestion for a fix, but it's nothing more than a power grab presented as a "solution."

Maybe the market can take care of this problem. But the likely pervasiveness of this type of technology convinces me that government must play a regulatory role.

A regulatory role does nothing more than give the government (and law enforcement) an opportunity to insert a "back door," either via coding changes or by placing themselves in a middleman position, much in the way they have with telcos and ISPs. There are a lot of unintended consequences and perverse incentives that go hand-in-hand with government regulation and no one should be in a hurry to unpack those.

Finally, Chertoff comes full circle back to his strained starting point: drones.

The new data collection platforms right in front of us are much more likely to affect our lives than is the prospect of drones overhead surveilling American citizens.

If there's a more noticeable effect from Google Glass, it's only because it's a consumer product the public can access (or be subjected to). Drones are an abstraction. The general public is severely limited in its response to state-deployed drones. A response to a consumer product can be felt immediately. If you feel uncomfortable around a Google Glass wearer, you have a few options (ask the wearer to take them off or leave/exit the "filming" area). If you feel uncomfortable being surveilled by eyes in the sky, well, you can set any number of lengthy plans in motion, but it's unlikely your concerns will be addressed, much less result in curtailed surveillance.

While it's nice to see Chertoff recognizes the privacy issues inherent in a consumer product like this, it's rather annoying to see him treat government/law enforcement surveillance as something far less problematic.

Filed Under: companies, google glass, government, michael chertoff, privacy, surveillance
Companies: google

Congress: The TSA Is Wasting Hundreds Of Millions In Taxpayer Dollars

from the oversight-indeed dept

The House Oversight Committee has come out with a report slamming the TSA for tremendous amounts of waste, specifically in the "deployment and storage" of its scanning equipment. Basically, it sounds like the TSA likes to go on giant spending sprees, buying up security equipment and then never, ever using it. A few data points

• As of February 15, 2012, the total value of TSA’s equipment in storage was, according to TSA officials, estimated at $184 million. However, when questioned by Committee staff, TSA’s warehouse staff and procurement officials were unable to provide the total value of equipment in storage.
• Committee staff discovered that 85% of the approximately 5,700 major transportation security equipment currently warehoused at the TLC had been stored for longer than six months; 35% of the equipment had been stored for more than one year. One piece of equipment had been in storage more than six years – 60% of its useful life.
• As of February 2012, Committee staff discovered that TSA had 472 Advanced Technology 2 (AT2) carry-on baggage screening machines at the TLC and that more than 99% have remained in storage for more than nine months; 34% of AT2s have been stored for longer than one year.
• TSA knowingly purchased more Explosive Trace Detectors (ETDs) than were necessary in order to receive a bulk discount under an incorrect and baseless assumption that demand would increase. TSA management stated: “[w]e purchased more than we needed in order to get a discount.”

Oh yeah, and it appears that the TSA isn't very good at tracking this stuff. When asked about the total cost of managing this equipment, the TSA was unable to provide an answer. And then it appeared to willfully mislead Congress about this:

• TSA intentionally delayed Congressional oversight of the Transportation Logistics Center and provided inaccurate, incomplete, and potentially misleading information to Congress in order to conceal the agency’s continued mismanagement of warehouse operations.
• TSA willfully delayed Congressional oversight of the agency’s Transportation Logistics Center twice in a failed attempt to hide the disposal of approximately 1,300 pieces of screening equipment from its warehouses in Dallas, Texas, prior to the arrival of Congressional staff.
• TSA potentially violated 18 U.S.C. Sec. 1001, by knowingly providing an inaccurate warehouse inventory report to Congressional staff that accounted for the disposal of equipment that was still in storage at the TLC during a site visit by Congressional staff.
• TSA provided Congressional staff with a list of disposed equipment that falsely identified disposal dates and directly contradicted the inventory of equipment in the Quarterly Warehouse Inventory Report provided to Committee staff on February 13, 2012.

One of the theories that was floated a few years ago when there was that big rush to rollout the nudie scanners, was that much of it was being driven by fear mongering from former government officials, like Michael Chertoff, who had economic relationships with the makers of the equipment. This report doesn't confirm any of that, but it sure seems to fit that narrative pretty perfectly. Fear monger away, have the TSA buy a ton of questionable equipment it doesn't actually need, and then have much of that equipment just sit in a warehouse. All on the taxpayers' dime.

Filed Under: congress, house oversight committee, michael chertoff, scanners, tsa, waste

Chris Matthews Says That Pointing Out Chertoff's Conflict Of Interest Over Rapiscan TSA Scanners Is Slander?

from the ah,-the-media dept

Michael Chertoff's conflict of interest over the Rapiscan full body "naked" scanners used by the TSA in airports is old news. It was reported on widely earlier this year, and again in the past few weeks. So it does seem kind of odd (as pointed out via Radley Balko) that MSNBC TV guy Chris Matthews appears to accuse someone of slander for pointing it out. Of course, if you watch the video, what Matthews does is even more insidious -- which is taking what Ginger McCall actually says, and twisting it to pretend she said something different. She points out -- accurately -- the conflict of interest, and he claims she's saying that the only reason we have these devices was because of corruption and "sweetheart deals" back when Chertoff was head of Homeland Security. But McCall was merely pointing out that there's a "revolving door" at these agencies, and machines are pitched by former government folks, with little evidence that they're effective. Matthews totally takes what McCall actually says and pretends (falsely) that she claimed he made a corrupt deal while still in power. This is what passes for journalism these days?

Filed Under: chris matthews, ginger mccall, michael chertoff, tsa
Companies: rapiscan

Feingold Points Out That DHS's Chertoff Is Misleading On Border Laptop Searches

from the reasonable-cause? dept

Following the release of Homeland Security's policies for searching laptops at the border, where the rules are, effectively, "anything goes," DHS boss Michael Chertoff claimed that laptop searches were only done when the border guard had a "suspicion" and placed that individual in "secondary inspection." However, Senator Russ Feingold has now hit back, pointing out that the official DHS policies say absolutely nothing about there needing to be a suspicion or that laptop searches only happen on secondary inspection. If Chertoff were being honest, why wouldn't those things be in the official policy? And, if Chertoff insists that DHS will only do searches when there is a real suspicion, what's wrong with following the "probable cause" standard that it insists it should be allowed to ignore? It's nice to see Senator Feingold asking these questions.

Filed Under: border searches, customs, homeland security, laptops, michael chertoff, russ feingold, senate