New EARN IT Act Creates An Insane New Dilemma: Either Encrypt All Or Spy On All

from the this-seems-counterproductive dept

Last week, as predicted, the Senate Judiciary Committee voted unanimously to replace the original EARN IT Act, with a new one. As part of the markup, they also voted to approve Senator Patrick Leahy's amendment which some might read to say that EARN IT cannot be used to block encryption -- but the reality is a lot more complicated. As I'll explain, this new bill is terrible in a different way than the old bill: it will create a new dilemma in which internet services will either feel compelled to encrypt everything or in which the only way you'll be able to use any internet service is if you hand over a ton of personal information to the service provider -- potentially putting your privacy at extreme risk.

First lets acknowledge an oddity about this new bill. Both bills involve the creation of a commission to come up with "best practices" in trying to stop "child sexual abuse material" or CSAM (the concept formerly known as child porn). In the old bill, if sites didn't follow the commission's best practices, they could lose their Section 230 protections. This resulted in fears that the commission would outlaw encryption as a "best practice." The new bill retains the commission, but for no recognizable purpose. Instead, it does away with the pretense and just says that a bunch of sites should lose Section 230 protections no matter what. It seems quite odd to first say "we need a commission to determine best practices" and then on a second pass say that before the commission has done anything we're just going to make massive changes to Section 230 based on... nothing at all. No evidence saying that this would create better outcomes. No evidence that Section 230 is a problem with regards to CSAM. Just... nothing.

Specifically, the new bill makes a change to Section 230 that looks similar to the change that was made with FOSTA, saying that you don't get 230 protections if you advertise, promote, present, distribute, or solicit CSAM. But here's the thing: CSAM is already a federal crime and all federal crimes are already exempted from Section 230. On top of that, it's not as if there are a bunch of cases anyone can trot out as examples of Section 230 getting in the way of CSAM prosecutions. There's literally no evidence that this is needed or will help -- because it won't.

As we've detailed before, the real scandal in all of this is not that internet companies are facilitating CSAM, but that the DOJ has literally ignored its Congressional mandate to go after those engaged in CSAM production and distribution. Congress tasked the DOJ with tackling CSAM and the DOJ has just not done it. The DOJ was required to compile data and set goals to eliminate CSAM... and has just not done it. That's why it's bizarre that EARN IT is getting all of the attention rather than an alternative bill from Senators Wyden, Gillibrand, Casey and Brown that would tell the DOJ to actually get serious about doing its job with regards to CSAM, rather than blaming everyone else.

But digging into the details, the real problem here is that, as structured, the new EARN IT Act would be a disaster in trying to achieve the goals the sponsors have set out for it. First off, thanks to the addition of Senator Leahy's Amendment, some may see the bill as one that effectively requires encryption to avoid liability for CSAM. Even that's not totally clear, however. While you can read Leahy's amendment to say that encryption is protected, the actual structure of the final bill punts many issues to state law, and that means having to comply with 50 different state laws. Some, like Illinois, have lower standards for the mens rea regarding CSAM, and the worry is that we won't know whether or not offering end-to-end encryption would be seen as violating state laws until long and costly cases go through their lengthy process.

Either way, this weird CSAM carveout from Section 230 is somewhat equivalent to the moderator's dilemma that other attempts to change Section 230 create. Because most of those other reforms put in place a "knowledge" standard, it gives many sites a reason to never look at the content on their platform. In this case, due to the explicit call out saying that encryption isn't impacted, that would effectively say that if you want to keep 230 protections, you should encrypt absolutely everything. Which, ironically, is the exact opposite of what Attorney General Bill Barr has been asking for.

But, as with the moderator's dilemma, there's also a flipside (if you don't want to ignore everything, then you have to greatly restrict what you allow through). Under the new EARN IT, the flipside is that the government more or less says that you are now responsible for being able to track and identify anyone on your service who is not using encryption -- meaning you would need to carefully verify every user of your platform. No more simple signups. No more anonymity. And, incredibly, this would mean that sites would need to collect a ton of data on every user. Want to use this new service? First submit your phone number, driver's license, etc.

At a time when people are saying they trust big internet companies less and less with their data, why would Senators Graham, Blumenthal, Feinstein, and Hawley (HAWLEY!?!?) be encouraging websites to collect even more (and more intrusive) data on all their users?

Since this is somewhat different than the traditional moderator's dilemma, it might be called the "censor's dilemma" or possibly the "middleman's dilemma," in that this is even more tied to the government's demand that websites block certain content entirely, which puts them in the role of a government middleman or censor (which, not coincidentally, would raise serious constitutional issues with the EARN IT Act turning private entities into state censors).

Either way it is difficult to see how these two outcomes are what Congress (or, for that matter, the DOJ) actually wants:

• Much greater encouragement for websites to encrypt everything
• Much greater encouragement for websites to demand much more personal and private information on users.

And yet, thanks to Congress' standard bungling, that's what we have with the current EARN IT Act. And while it might be nice if the law actually did encourage more encryption, don't pin your hopes on that. As noted above, it's not entirely clear that it really does lead to that outcome, and we might not know until after a whole bunch of litigation. Furthermore, if that is is the end result, it will almost certainly lead to a different kind of backlash and support for even worse laws that seek to blow up encryption through other methods.

In short: the EARN IT Act is bad. At best it might encourage more encryption, but it would also create a whole host of unintended consequences, including much less privacy and no more anonymity on many websites. It's difficult to see how that accomplishes any of the goals of the bill's supporters.

Filed Under: censor's dilemma, data, dilemma, earn it, earn it act, encryption, lindsey graham, middleman's dilemma, moderator's dilemma, patrick leahy, privacy, richard blumenthal, verification

Election Security Has Become A Partisan Issue As Senate Votes Down Funding

from the bad-ideas dept

It shouldn't matter which party you belong to (or if you belong to no party at all): fixing our totally broken election security should be a priority. This is a topic we've written about on Techdirt for nearly 20 years. The broken system of electronic voting has always been a security disaster, and now with more direct attempts to influence elections happening, it should be even more of a priority. And yet, following the lead in the House, this week the Senate voted down an amendment from Senator Patrick Leahy providing more funding for election security.

The vote was almost exactly along partisan lines, with only one crossover (Senator Bob Corker was the only Republican who voted for the amendment). While there were some arguments made against the bill, they don't make much sense:

Sen. Blunt said that states are responsible for running their elections, not the federal government, and that providing more funds would give the impression of federal overreach.
Sen. Lankford said on the floor Wednesday, referencing the omnibus funds, “the $380 million amount is what was needed for the moment," and indicated he didn't want to fund states beyond that right now.

There can be reasonable questions in how this money is being spent, and what's being done to actually secure elections, but the fact that this seems to be becoming a partisan issue should worry us all. And, I know some of you will be tempted to do this, but claiming that Republicans are against this because insecure technology helps them get elected is not a serious response. That's not only cynical, but almost certainly incorrect.

However, at a time when Congress (including many of the Senators who voted against this) have been grandstanding about tech companies being used to influence elections, the fact that they would then not really care that much about our woefully undersecured voting infrastructure just seems ridiculous. For years, we've argued that when tech policy issues get partisan, they get stupid, and it would be a real shame for election security, of all topics, to become stupidly partisan.

Filed Under: election security, funding, partisanship, patrick leahy, senate

Senate To Vote Tuesday On Surveillance Bill; Four Senators Try To Rally Others To Oppose

from the say-bye-to-the-4th-amendment dept

Following yesterday's bizarre vote in the House, in which many members who opposed President Donald Trump and warn about his abuses of office voted to give him much greater surveillance capabilities, the issue quickly moved to the Senate. Senate Majority Leader Mitch McConnell made a procedural move to ensure no amendments are added, and the bill the Senate will vote on will be basically the awful bill in the House.

On top of that he put out a misleading statement, playing up the usual fear mongering about Section 702 and even name-checking 9/11.

“Republicans and Democrats agree that we must not deprive the men and women who protect our country of this important tool. Five years ago, a reauthorization of Section 702 passed the Senate with overwhelming bipartisan support. Al Qaeda, ISIL and associated terror groups remain intent on striking our people, and those serving us overseas. I look forward to renewing the bipartisan consensus on this issue now that the time has come to approve a new extension.”

“With each day that passes since this nation was attacked on September 11th, 2001 it seems that the concern over terrorism has waned. That is in part due to the success of our defense and intelligence community in preventing another attack. And they rely upon section 702 to accomplish that mission. But as we know, Al Qaeda, ISIL and associated terror groups remain intent on striking our people, and those serving us overseas.”

Of course, this ignores that Section 702 didn't even show up until almost a decade after 9/11 -- so really wasn't responsible for most of the intelligence work that McConnell is giving it credit for. And, on top of that, it ignores the widespread abuse of Section 702 programs that we now know about. It also ignores that in some ways this new bill expands the power to conduct surveillance on Americans without a warrant and to use that surveillance for law enforcement, rather than intelligence purposes.

An intellectually honest debate about this would address these issues. But McConnell does not appear interested in an intellectually honest debate, preferring to scream "9/11!" and demand Senators vote to approve the plan. There is a group of four Senators pushing back against this: Senators Rand Paul, Ron Wyden, Mike Lee and Pat Leahy have sent a powerful letter to their colleagues, detailing the many problems with the bill.

This bill allows an end-run on the Constitution by permitting information collected without a warrant to be used against Americans in domestic criminal investigations. It endorses the possibility that the government will resume “about” collections on Americans, a practice that the government was actually forced to abandon last year due to significant non-compliance with privacy protections ordered by the FISA Court. And it does nothing to protect innocent Americans from expanding warrantless surveillance.

• Continuing the “backdoor” loophole: The bill does nothing for the thousands of Americans whose private communications are searched without a warrant every year, including those who are not even the subject of an investigation. Nor would it prevent unlimited searches for Americans’ information, even for non-national security purposes. The so-called “warrant requirement” reform in the bill applies only to criminal suspects, and then only to the government’s access to their information at the final stage of an investigation, a situation that, according to the most recent annual data from the Director of National Intelligence, has occurred once. This means that the bill actually treats those suspected of a crime better than innocent Americans.
• Restarting “About” collection: The bill, for the first time, would statutorily recognize the possibility of the government restarting “about” collection, essentially by default, which would necessarily include warrantless collection of communications to and from Americans for whom there is no suspicion at all. The government was forced to abandon this problematic form of collection last year due to extensive compliance problems, and should not be allowed to resume it without specific Congressional approval.
• Unreviewable end use: The bill grants new, unchecked powers to the Attorney General to allow data collected without a warrant to be used in domestic criminal prosecutions of Americans. The Attorney General merely has to determine that a criminal proceeding “affects, involves, or is related to the national security of the United States” or involves a “transnational crime.” Alarmingly, the bill explicitly prohibits any challenge to the Attorney General’s decision.

To be clear, FISA’s purpose is to collect foreign intelligence, but without additional meaningful constraints, Congress is allowing the government to use information collected without a warrant against Americans in domestic court proceedings. We have introduced two separate bills which preserve the government’s ability to pursue terrorists abroad and protect the country from foreign threats while also making the necessary reforms to protect the Fourth Amendment rights of Americans here at home.

The FISA Amendments Reauthorization Act, however, further expands the risks of unconstitutional spying on innocent Americans, and we encourage you to join us in opposition to this bill. We believe that a clean, short-term extension would be markedly preferable to this legislation. Section 702 was last extended for the length of the Continuing Resolution; if Leadership does not allow any amendments to the FISA Amendments Reauthorization Act and it does not pass this coming week, then Section 702 authorities can be extended again on the next Continuing Resolution to allow the Senate to fully debate how to appropriately reform this powerful surveillance tool.

It would be nice if other Senators actually paid attention and listened to these four... but the fact that it is just these four (and they tend to be the most reliable four Senators talking about protecting the 4th Amendment) suggests that McConnell knows that he has enough votes to pass the bill and allow the NSA and domestic law enforcement to increase their warrantless surveillance of Americans. This also means that it might be a good time to call your own two Senators and make sure they're voting against this. Fight for the Future is crowdfunding to buy billboards advertising against some Senators who vote for the bill, but the more these Senators hear from constituents saying that this bill obliterates our 4th Amendment rights, the better.

Filed Under: mike lee, mitch mcconnell, nsa surveillance, patrick leahy, rand paul, ron wyden, section 702, senate

The Senate Summoned The Wrong Time Warner To Talk About AT&T Merger

from the really-guys? dept

The big news earlier this week, of course, was AT&T's announced plans to purchase Time Warner. As we, and plenty of others, were careful to point out, Time Warner is a different and totally separate company from Time Warner Cable (which Comcast famously tried to takeover not that long ago). Yes, at one time they were the same company, but that was a long, long time ago. They've been separate since 2009. And yet, lots of people still get them confused. In fact, soon after the announcement of the deal, AT&T had to do a special filing with the SEC to clarify which Time Warner it was buying. Really. Apparently, the Senate didn't get the memo (literally). The Senate Judiciary Committee's top four members (from both parties) put out a press release from the antitrust subcomittee, saying that it was going to hold hearings on the merger, and that the CEOs of both companies would be testifying. But they named the CEO of Time Warner Cable, not Time Warner.

Despite striking an $85.4 billion deal with AT&T Inc. over the weekend, [Time Warner CEO Jeff] Bewkes was unceremoniously left out of a release from the Senate Judiciary Antitrust Subcommittee, which said the CEOs of both companies would testify at a hearing on the proposed deal.

The reason? The four top Republicans and Democrats leading the Senate Judiciary Committee and its antitrust subcommittee accidentally invited Time Warner Cable’s former CEO Rob Marcus instead.

“Both Randall Stephenson, the CEO of AT&T, and Robert Marcus, the CEO of Time Warner, will testify,” the release said. The hearing announcement was sent by Sen. Chuck Grassley, Sen. Patrick Leahy, Sen. Mike Lee and Sen. Amy Klobuchar.

You'd think someone would have checked that.

Oh, and it's even worse than it seems, because Rob Marcus isn't CEO of either Time Warner or Time Warner Cable. He left Time Warner Cable after Charter Communications completed its deal.

And this is why so few people trust Congress. Congress is quick to opine on stuff that it regulates without doing even having the most basic understanding of what's going on. Summoning the wrong CEO of the wrong company is a pretty impressive flub.

Filed Under: amy klobuchar, antitrust, chuck grassley, confusiong, jeff bewkes, merger, mike lee, patrick leahy, randall stephenson, rob marcus, senate, senate judiciary committee
Companies: at&t, time warner, time warner cable

Kudos To Senator Leahy: Fighting To Keep Privacy & Civil Liberties Board From Being Hobbled

from the keep-at-it dept

While I think that Senator Patrick Leahy has been ridiculously and dangerously wrong on copyright issues for years, he's actually quite good on a number of other issues that are of interest to us here at Techdirt. In particular, he's been a strong supporter of civil liberties on the internet and protecting the 4th Amendment (it's unfortunate that he doesn't see how his desired copyright policies might undermine some of that, but that's another post for another day). Thankfully, his latest move is to push back against a plan by the Senate and House Intelligence Committees to strip the federal government's Privacy and Civil Liberties Board (PCLOB).

Back in May, we wrote about this effort, whereby Congress appeared to be deliberately stripping powers from the PCLOB in order to limit the board's ability to actually make sure that the intelligence community wasn't abusing its powers. Senator Leahy has now sent a fairly direct letter to Senate Intelligence chair Senator Richard Burr and vice chair Senator Dianne Feinstein calling out how terrible this plan is.

The letter calls out the "pattern" that has been put in place by both the House and Senate Intelligence Committees to one by one by one strip powers from the PCLOB. After giving a bunch of examples of this playing out, with the language stripping the powers being agreed upon in secret (of course), Leahy notes:

The PCLOB has served a valuable role in reviewing government surveillance programs and recommending reforms that have largely been implemented by the executive branch. It is particularly inappropriate to debate and report legislation in a closed markup that is designed to diminish the authority of a public, independent oversight board. Congress should b enhancing its role, not undercutting it.

It then asks them to remove these PCLOB-undermining provisions from the intel re-authorization bill. Of course, Feinstein and Burr want to hobble the PCLOB because they've long been cheerleaders for widespread surveillance, and have actively fought against any real or significant oversight. There's a reason why these riders undermining the PCLOB keep showing up, and it's because Senators like Feinstein and Burr are deliberately trying to protect the intelligence community from oversight. So unless some bigger force comes along, it's doubtful this letter will have much of a direct impact. But, even so, kudos to Leahy for sending the letter as a starting point. Hopefully he follows through and continues to keep the pressure up.

Filed Under: congress, dianne feinstein, oversight, patrick leahy, pclob, richard burr

Patent Reform Bill A Good Step, But Still Falls Way Short Of Fixing A Broken System

from the it's-a-start dept

As was widely expected, earlier this week, a bunch of high-profile Senators introduced a big patent reform bill, known as the Protecting American Talent and Entrepreneurship (PATENT) Act. It's backed by Senators Chuck Grassley, Patrick Leahy, Chuck Schumer and John Cornyn, and has a decent chance of becoming law. From a quick look at the bill itself, it looks an awful lot like what we expected to show up last year, right before Senator Harry Reid stepped in and killed the bill. With the Republicans taking over in Congress, however, Reid no longer has the power to do that. Meanwhile, Schumer, who has long been supportive of patent reform and is basically taking over Reid's leadership position as Reid prepares to retire, has declared that this time the bill is getting done.

That's all good. The bill is a good start. But, unfortunately, it's not nearly enough. It does target some of the symptoms of the problems of the patent system, but does little to fix the underlying causes. The bill targets the worst of the worst: the patent trolls who thrive on shaking down companies. Specifically, the bill aims to do a few key things:

1. Fee shifting on ridiculous lawsuits: It would allow for attorneys' fees to be awarded if the patent holder was not "objectively reasonable" in filing the lawsuit. The Supreme Court has already made it easier for courts to award attorneys' fees, but this would slide the scale over a bit in a helpful way. This certainly increases the risk for patent trolls who have no real case.
2. Limiting discovery: Defending a patent lawsuit is crazy expensive. We often hear stories of it costing like a million dollars just to get to trial. And one big expense is "discovery," in which the patent holder gets to ask for all sorts of information from the company its suing -- emails, plans, source code, etc. This process is super expensive and there's not much you can do about it. It often starts pretty quickly after a lawsuit is filed as well. This new bill would put limits on early discovery, allowing those sued to seek motions to dismiss the case altogether or to transfer venues. That could decrease the early cost, taking away some of the pressure on defendants to just settle, and giving them more ability to fight back against bogus claims.
3. Limits vague demand letters: The patent troll's weapon of choice is often to send totally vague demand letters, insisting companies infringe without telling them how. It also makes it easier for the FTC to go after those who send such bogus threat letters.
4. Protecting some end users: We've highlighted plenty of cases where patent holders sue those who make devices or software, and then sue a variety of end-users as well. This bill, in a fairly limited way, would put those kinds of lawsuits on hold until the manufacturer can fight the infringement in court. But this only counts if the troll also has sued the manufacturer. So it's a bit limited.
5. Transparency: The bill would make it harder for trolls to hide behind shell companies. This is a fairly big deal, as many patent trolls have a series of shell companies, and often you have no idea who really owns the patent. The bill will also require actual lawsuits to be a lot more clear in terms of what they're actually suing over and why the defendant infringes (and what it infringes).

These are all good things, but it's unlikely to truly be enough. Missing, unfortunately, is the expansion of a program that would allow the patent office to do a faster review of crappy patents, known as the covered business method (CBM) process. This is too bad -- as this was an idea that Schumer had been a strong champion for, but which Microsoft and IBM pushed back very hard on, as they HATE the idea that the USPTO might start invalidating their crappy patents with a quick review.

Yet, as Schumer knows well, this CBM tool has proven tremendously effective in dumping a bunch of crappy financial services patents. Hell, just this week, DataTreasury, a massive trolling operation that has received over $350 million in settlements had its key patents invalidated via a CBM review. It's too bad that program couldn't have been expanded. Blame Microsoft and IBM.

But there are a lot of other problems that the new bill doesn't touch at all. Yes, it may shut down the worst of the worst in trolling, but will still allow plenty of bad situations to flourish. Bad patents will still get through and be used to hinder innovation. The new bill does absolutely nothing to address the situation with independent invention either, and that's a major problem in the patent space.

Either way, even with this incremental fix, it's likely we'll see a bunch of ridiculous claims that the above changes in patent law will somehow harm inventors, though, I can't see how that's true. As long as you're transparent and upfront with how the infringement happens, and don't file "objectively unreasonable" lawsuits, it seems like patents are still a powerful tool to demand money from companies.

Filed Under: cbm, chuck grassley, chuck schumer, covered business method, fee shifting, john cornyn, patent act, patent reform, patent trolls, patents, patrick leahy, transparency
Companies: datatreasury

New Version Of USA Freedom Surveillance Reform Bill To Hit The House This Week

from the more-improvements,-but-a-few-worrisome-concessions dept

The USA Freedom Act is back in another attempt to rein in the NSA -- one that was sabotaged twice last year. A bill under this name was first introduced in the House, which actually passed out of committee, but only after being gutted in response to pressure from the administration. A much better version was introduced by the Senate, but this one never managed to make it out to the floor for a full vote -- held back by NSA defenders who portrayed its Section 215 reforms as somehow more damaging to privacy than an unrestrained NSA.

This House bill heads into committee with only a few weeks remaining before certain provisions of the Patriot Act are due to expire, including the Section 215 bulk records program. Sen. Mitch McConnell has done what he can to lower this bill's chance of success. Shortly before USA Freedom was to be introduced into Senate, he delivered a bill that would authorize a "no questions asked" renewal of these provisions until the end of 2019. Thanks to his position as Majority Leader, he was able to bypass the committee vote and bring it straight to the floor.

This version of USA Freedom is obviously a vast improvement over the previously-eviscerated House bill, but there are still concerns on both sides of the issue. NSA defenders will probably oppose it because it supposedly goes too far. Civil liberties defenders will oppose it because it doesn't go far enough. The ACLU has already expressed its concerns about the pending legislation.

“The disclosures of the last two years make clear that we need wholesale reform. Congress should let Section 215 sunset as it’s scheduled to, and then it should turn to reforming the other surveillance authorities that have been used to justify bulk collection,” said Jameel Jaffer, the group’s deputy legal director.

What the bill does do is fix a lot of what was broken on its last trip through. The legislation would end the Section 215 bulk records collection and force the NSA to perform targeted requests for phone metadata from telcos. It would also provide an avenue to challenge the use of this data in court by adding a requirement to serve notice to those whose records were accessed. In addition, it would make National Security Letter gag orders challengeable by those companies served with one and require a "periodic review" of outstanding non-disclosure orders to ensure they're still valid.

What it doesn't do is actually end Section 215. It would end the bulk collection but "emergency" requests could still be made to circumvent the additional search restrictions USA Freedom imposes. It also preserves the NSA's ability to deploy roving wiretaps.

Sen. Ron Wyden says he's not in love with the new bill, but he'll support it.

"I obviously want it to go further, closing the backdoor search loophole and the like," the Oregon Democrat said. "But I think Sen. Leahy's effort to end the collection of all of this personal information ... are very important and I'm in support of it."

Considering McConnell's last-minute maneuvering to save Section 215 from alteration or expiration, there will probably be others who will throw their support behind this bill rather than see the bulk records collection remain intact for the next half-decade. If nothing else, it's at least a step towards serious surveillance reform.

Filed Under: bulk collection, mass surveillance, nsa, patrick leahy, patriot act, privacy, ron wyden, section 215, surveillance, surveillance reform, usa freedom act

Can Some Internet Memes Finally Get Congress To Pass New Legislation To Protect Your Privacy Online?

from the the-last-time-we-reformed-our-privacy-laws... dept

For many, many years, we've been talking about the need for ECPA reform. ECPA -- the Electronic Communications Privacy Act -- is an incredibly outdated piece of legislation from the 1980s that governs law enforcement's ability to access email and other electronic communications. This was the era before the internet was anywhere close to the mainstream (though it did exist). Among the various weird parts of the law, it says that any communication that is over 180 days old and still on a server is considered "abandoned" so that the government can access it without a warrant. Think about that in this era when you keep all your communications online. It was written when lawmakers thought people would "download" the messages off a server. That's just the most noteworthy problem -- there are all sorts of different definitions based on messages that have been opened or not opened and other oddities as well, almost none of which make sense.

Last year we noted that more than half of the House was co-sponsoring a bill put forth by Reps. Kevin Yoder and Jared Polis to reform ECPA in a big way. But even with so many supporting the law, it failed to move. A big hurdle? Both the IRS and SEC (note: not your standard law enforcement agencies) like the fact that they can use ECPA to snoop through electronic communications (without a warrant -- which those agencies can't get on their own anyway).

Yoder and Polis are back again with another attempt, and it's matched by a similar legislation in the Senate from Senators Patrick Leahy and Mike Lee. To get attention for the bill, Yoder, Polis and some other supporters took to Twitter in a bit of a meme fest, highlighting some historical facts to demonstrate just how long it's been since ECPA became law. It's worth scrolling through them all (though, there are a lot), because some are pretty funny:

At this point, it's a complete travesty that such a bill hasn't become law. People have explained the need for it for well over a decade, and more than half of Congress was signed on to co-sponsor it in the last Congressional term. Already this new bill has 228 additional co-sponsors in the House and another 6 co-sponsors in the Senate. The IRS and SEC's objections are simply ridiculous. Having more convenient access to someone's emails is no excuse for not better protecting the privacy of our online communications.

Of course, this isn't the only effort going on to protect privacy. Reps. Zoe Lofgren, Ted Poe and Suzan DelBene have also introduced a bill to update ECPA. It's pretty clear that Congress knows that the law needs to be updated, and it's time to get past whatever objections there are and actually start protecting our privacy.

Filed Under: communications, ecpa, ecpa reform, email, irs, jared polis, kevin yoder, memes, mike lee, patrick leahy, privacy, sec, suzan delbene, ted poe, zoe lofgren

Senators Leahy & Grassley Quiz DOJ & DHS About Secret Fake Phone Towers Intercepting Calls

from the good-for-them dept

We've written plenty about Stingrays and other "IMSI Catcher" devices that allow law enforcement to set up what are effectively fake cell phone towers, designed to intercept calls and locate certain individuals. These devices are deployed in near total secrecy, often by law enforcement who got them from the federal government. There is little to no oversight over how these are used (and abused). The attempts to keep the details a total secret represent really egregious behavior from all involved. As we've covered, police have claimed that non-disclosure agreements with the manufacturers (such as Harris Corp.) prevent them from getting a warrant to use the devices. The DOJ, somewhat famously, had a whole plan for how to mislead judges about the use of these devices, with official documentation telling DOJ officials to be "less than explicit" and "less than forthright" to judges about how the tech was being used. In some cases, the US Marshals have stepped in and seized documents from local police forces to block them from being released in response to FOIA requests.

In short, law enforcement really doesn't want how it uses these devices revealed. And yet, reporters and activists keep digging up more information, including the WSJ finding out that the US Marshals (them again!) have been putting airborne versions of these devices, called DRT boxes, on airplanes and flying them over cities, likely scooping up information on tons of innocent people with no warrant.

At least some in our government are concerned about this. Senators Patrick Leahy and Chuck Grassley have been pressing government officials on this, and before the holidays sent a letter to Attorney General Eric Holder and Homeland Security Boss Jeh Johnson demanding answers. One very interesting tidbit is that in response to some of this public disclosure, the FBI now, at least, gets warrants before using the technology -- but the Senators would like more details:

We wrote to FBI Director Comey in June seeking information about law enforcement use of cell-site simulators. Since then, our staff members have participated in two briefings with FBI officials, and at the most recent session they learned that the FBI recently changed its policy with respect to the type of legal process that it typically seeks before employing this type of technology. According to this new policy, the FBI now obtains a search warrant before deploying a cell-site simulator, although the policy contains a number of potentially broad exceptions and we continue to have questions about how it is being implemented in practice. Furthermore, it remains unclear how other agencies within the Department of Justice and Department of Homeland Security make use of cell-site simulators and what policies are in place to govern their use of that technology.

But, still, the Senators would like a few more details:

The Judiciary Committee needs a broader understanding of the full range of law enforcement agencies that use this technology, the policies in place to protect the privacy interests of those whose information might be collected using these devices, and the legal process that DOJ and DHS entities seek prior to using them.

For example, we understand that the FBI’s new policy requires FBI agents to obtain a search warrant whenever a cell-site simulator is used as part of a FBI investigation or operation, unless one of several exceptions apply, including (among others): (1) cases that pose an imminent danger to public safety, (2) cases that involve a fugitive, or (3) cases in which the technology is used in public places or other locations at which the FBI deems there is no reasonable expectation of privacy.

We have concerns about the scope of the exceptions. Specifically, we are concerned about whether the FBI and other law enforcement agencies have adequately considered the privacy interests of other individuals who are not the targets of the interception, but whose information is nevertheless being collected when these devices are being used. We understand that the FBI believes that it can address these interests by maintaining that information for a short period of time and purging the information after it has been collected. But there is a question as to whether this sufficiently safeguards privacy interests.

The specific questions being asked:

1. Since the effective date of the FBI’s new policy:

a. How many times has the FBI used a cell-site simulator?
b. In how many of these instances was the use of the cell-site simulator authorized by a search warrant?
c. In how many of these instances was the use of the cell-site simulator authorized by some other form of legal process? Please identify the legal process used.
d. In how many of these instances was the cell-site simulator used without any legal process?
e. How many times has each of the exceptions to the search warrant policy, including those listed above, been used by the FBI?

2. From January 1, 2010, to the effective date of the FBI’s new policy:

a. How many times did the FBI use a cell-site simulator?
b. In how many of these instances was the use of a cell-site simulator authorized by a search warrant?
c. In how many of these instances was the use of the cell-site simulator authorized by some other form of legal process? Please identify the legal process used.
d. In how many of these instances was the cell-site simulator used without any legal process?
e. In how many of the instances referenced in Question 2(d) did the FBI use a cell-site simulator in a public place or other location in which the FBI deemed there is no reasonable expectation of privacy?

3. What is the FBI’s current policy on the retention and destruction of the information collected by cell-site simulators in all cases? How is that policy enforced?

4. What other DOJ and DHS agencies use cell-site simulators?

5. What is the policy of these agencies regarding the legal process needed for use of cell-site simulators?

a. Are these agencies seeking search warrants specific to the use of cell-site simulators?
b. If not, what legal authorities are they using?
c. Do these agencies make use of public place or other exceptions? If so, in what proportion of all instances in which the technology is used are exceptions relied upon?
d. What are these agencies’ policies on the retention and destruction of the information that is collected by cell-site simulators? How are those policies enforced?

6. What is the Department of Justice’s guidance to United States Attorneys’ Offices regarding the legal process required for the use of cell-site simulators?

7. Across all DOJ and DHS entities, what protections exist to safeguard the privacy interests of individuals who are not the targets of interception, but whose information is nevertheless being collected by cell-site simulators?

Anyone taking bets on how few of these questions will actually be answered?

Filed Under: chuck grassley, drt boxes, imsi catchers, patrick leahy, privacy, stingray, stingrays, us marshals, warrants
Companies: boeing, harris corp.

Despite Racking Up Three Consecutive Unanimous Votes, FOIA Reform Bill Killed Off By Rep. John Boehner

from the BEHOLD-THE-SYSTEM-IN-ACTION dept

FOIA reform is now truly dead. Earlier this week, it looked as though Sen. Jay Rockefeller might be the one holding the murder weapon. Despite passing unanimously through the House and the Senate Judiciary Committee, Rockefeller placed a hold on the bill, citing nebulous concerns by two regulatory agencies (FTC, SEC -- neither of which were willing to go on the record about their problems with the bill) and something about "law enforcement agencies" being faced with "needless litigation" that would be a drain on their bottom lines. Of course, this ignores the fact that plenty of litigation involving law enforcement agencies is "needless" (because why be proactive about misconduct and abuse when you can just settle later?) and that any agency fighting the War on Drugs/Terror has generally been able to secure funding and equipment with a minimum of hassle.

Rockefeller's hold provoked a deluge pro-FOIA reform phone calls and emails, leading to Rockefeller releasing his hold and the bill moving on with unanimous Senate consent. This booted it back to the House where it ran headlong into Speaker of the House John Boehner, who immediately tabled it.

Newsweek's coverage of Boehner's "opaque" move concludes with this paragraph:

But these improvements may never see the light of day, as Boehner has tabled the bill. In a press conference on Thursday morning, a journalist asked Boehner about the fate of the FOIA reform bill to which he replied, “I have no knowledge of what the plan is for that bill.” If the bill does not make the House’s calendar by the end of the day, the bill dies.

The guy who made the plan for the bill (1. Do nothing) claimed he had no idea what the plan was. If the plan was to kill the reform bill, mission accomplished. Death by Rockefeller was narrowly averted only to result in Death by Boehner -- despite the fact that the FOIA reform sailed through the House earlier with a 410-0 vote.

The Hill performed a brief autopsy.

Sen. Patrick Leahy (D-Vt.) on Thursday night officially declared reforms to the Freedom of Information Act (FOIA) dead this year as the House gaveled out of session.

And he blamed House Speaker John Boehner (R-Ohio) for its death.

"And Boehner kills #FOIA improvements," Leahy tweeted at a reporter a little before midnight after the House finished its work on the "cromnibus" government funding bill — the last item of its agenda for the year.

The wonders of our political system continue. Something that received unanimous support -- not only on both sides of legislative branch, but on both sides of the partisan divide -- was dismantled by one man. One man who stood in front of a House that had passed the bill 410-0 and said, "Whatever."

Chances are it was one man swayed by the same regulatory agencies and the industries regulated by them. Transparency advocates suggest Wall Street made a last-minute push to thwart the legislation.

The suspicion among transparency groups is that the financial industry is working to fortify federal open-records exemptions for Wall Street which also exist in states and cities across the country. Those groups also fear the financial industry is aiming to prevent government regulators from erring on the side of transparency when faced with open-records requests for information about the financial industry.

“The negotiation process for this bill has been going on for six months now,” said Amy Bennett, the assistant director of OpenTheGovernment.org and the point person for a coalition of transparency groups working to pass the bill. “But the banks only started raising objections in the last week. Wall Street’s lobbyists are going to their allies on Capitol Hill and are asking them to delay it. But Wall Street just wants to kill the bill.”

Both Sen. Tim Johnson (who argued against the bill before its last-minute Senate passage) and John Boehner have received large amounts of funding from industries tied to Wall Street, according to information gathered by OpenSecrets.org. Boehner stopped the bill in its tracks by keeping it out of Congress' hands during the final moments of the lame duck session. Boehner's implicit message is that the good of the special interests outweighs the good of the many. Thanks to this, government agencies are still free to abuse FOIA exemptions and force the truly tenacious to take their chances in the federal court system if they hope to get their hands on documents the government would rather keep buried.

Filed Under: foia, foia reform, john boehner, patrick leahy