Perhaps The NSA Should Figure Out How To Keep Its Own Stuff Secret Before Building A Giant Database

from the just-saying... dept

Apparently, the brilliant minds at the NSA are completely bewildered as to how Ed Snowden had access to everything he had access to. They don't think it's possible.

Among the questions is how a contract employee at a distant NSA satellite office was able to obtain a copy of an order from the Foreign Intelligence Surveillance Court, a highly classified document that would presumably be sealed from most employees and of little use to someone in his position.

A former senior NSA official said that the number of agency officials with access to such court orders is “maybe 30 or maybe 40. Not large numbers.”

And, according to other reports, Snowden delivered much, much more to reporters:

Mr. Snowden has now turned over archives of “thousands” of documents, according to Mr. Greenwald, and “dozens” are newsworthy.

In other words, more leaks are to come. But, considering that people are already scrambling to see how one pretty junior IT guy could have access to such things, it's making people wonder just how screwed up the NSA is if information could leak out this way -- and conversely, why should we trust them with our data?

Edward Snowden sounds like a thoughtful, patriotic young man, and I’m sure glad he blew the whistle on the NSA’s surveillance programs. But the more I learned about him this afternoon, the angrier I became. Wait, him? The NSA trusted its most sensitive documents to this guy? And now, after it has just proven itself so inept at handling its own information, the agency still wants us to believe that it can securely hold on to all of our data? Oy vey!

Or, as Farhad Manjoo notes later in that same article:

The scandal isn’t just that the government is spying on us. It’s also that it’s giving guys like Snowden keys to the spying program. It suggests the worst combination of overreach and amateurishness, of power leveraged by incompetence. The Keystone Cops are listening to us all.

And, on top of that, people are pointing out that if Snowden could walk out with that much supposedly secret information, you have to wonder who else has done so as well, perhaps with much more nefarious intent, such as selling the information to a foreign power or group. Conor Friedersdorf points out that having the NSA collect so much data makes it a key target for the Chinese:

Even assuming the U.S. government never abuses this data -- and there is no reason to assume that! -- why isn't the burgeoning trove more dangerous to keep than it is to foreswear? Can anyone persuasively argue that it's virtually impossible for a foreign power to ever gain access to it? Can anyone persuasively argue that if they did gain access to years of private phone records, email, private files, and other data on millions of Americans, it wouldn't be hugely damaging?

Think of all the things the ruling class never thought we'd find out about the War on Terrorism that we now know. Why isn't the creation of this data trove just the latest shortsighted action by national security officials who constantly overestimate how much of what they do can be kept secret? Suggested rule of thumb: Don't create a dataset of choice that you can't bear to have breached.

And, yet, that's exactly what we've done. If Snowden had access, then it seems only reasonable to assume that he wasn't the only one. Meaning that plenty of others also had access to the same information, and there's a decent chance that it's already leaked to others. The NSA is supposed to be the best of the best, but they don't even seem to know how to keep their secrets secret.

Filed Under: database, ed snowden, it, leaks, nsa, nsa surveillance, risks

Google Caves To Hollywood Pressure: Will Now Punish Sites That Get Lots Of 'Valid' DMCA Notices

from the whose-master? dept

For quite some time the RIAA and MPAA have been going on and on about how Google can just "fix" its search results by either removing or punishing sites that are deemed as "pirate" sites. We've explained why this is not as easy as the entertainment industry thinks it is, but it appears that the pressure has gotten to Google... and they've just announced that they will, in fact, be punishing sites that they deem as bad players, based on the data they have of how many "valid copyright removal notices" a site gets:

We aim to provide a great experience for our users and have developed over 200 signals to ensure our search algorithms deliver the best possible results. Starting next week, we will begin taking into account a new signal in our rankings: the number of valid copyright removal notices we receive for any given site. Sites with high numbers of removal notices may appear lower in our results. This ranking change should help users find legitimate, quality sources of content more easily—whether it’s a song previewed on NPR’s music website, a TV show on Hulu or new music streamed from Spotify.

Since we re-booted our copyright removals over two years ago, we’ve been given much more data by copyright owners about infringing content online. In fact, we’re now receiving and processing more copyright removal notices every day than we did in all of 2009—more than 4.3 million URLs in the last 30 days alone. We will now be using this data as a signal in our search rankings.

The company notes that it's just one signal of many and that they will only demote the results, but not remove those sites from the index. In fact, they point out, correctly, that "Only copyright holders know if something is authorized, and only courts can decide if a copyright has been infringed; Google cannot determine whether a particular webpage does or does not violate copyright law."

As I understand it, the plan is that for people who search for, say, "watch dark knight rises free online," Google will try to push results that are likely to be unauthorized down the list, and try to have more "authorized" results higher up in the list (though, with a search query like the one above, there may not be any "authorized results" that provide what the person is searching for).

It's that last point where this gets to be troubling. Part of the reason people are searching for such things is that there isn't an easy and legitimate way to get that content. The best result would be for Hollywood to get its act together, realize that its whole windowing procedure is a disaster from the consumers' perspective, and provide more of what consumers want. Instead, the end result is going to be that people do these searches and just get equally frustrated. I don't see how that's good for Hollywood or for Google.

My other concern is that things things that later turn out to be quite legitimate and massive opportunities for authorized and legitimate content, are quite frequently demonized as tools of piracy early on. Imagine an equivalent of this announcement today in the early days of the VCR, when the MPAA insisted that it was evil and infringing. Imagine if when you went into a store to buy a VCR, the store instead pointed you to the movie theater down the road. That might be what Hollywood thought it wanted, but the end result would have been a much smaller home movie market -- not a market that ended up being bigger than the box office market just a few years after Hollywood insisted it was illegal.

Same thing with the first MP3 players. The RIAA sued the Diamond Rio as being a tool for infringement. Imagine if when you went to buy an MP3 player, stores decided to instead tell you you should buy some cassette tapes instead. It enforces an older way of doing business, rather than a new way.

And this applies online as well. Obviously, there's still an ongoing lawsuit against YouTube for copyright infringement, and YouTube certainly gets a ton of "valid copyright removal notices." Would Google demote search results to YouTube based on this? In the past, Google has punished the search results for other parts of its own business, for violating its rules, so it's entirely possible that YouTube results could get demoted under this system -- though I would imagine that Google believes that the many other "signals" it uses to determine legitimacy would minimize the likelihood of this being an issue.

But... that might not apply to a new up and coming site. Take, for example, the cases of Veoh and MP3Tunes. What both of those companies did was deemed legal by the courts, but both companies went bankrupt due to massive legal fees from being sued by the legacy entertainment industry. Imagine if, on top of that, Google also demoted the results from those sites at the same time. Already, Google is facing antitrust scrutiny for what some companies claim was a policy that demoted Google search results to their pages. While I think those claims are pretty bogus, is Google just opening itself up to a similar antitrust attack on that point?

I recognize that Google has a tricky balancing act here -- trying to keep the entertainment industry off its back, and the governmental pressure that comes with that, while still providing the "best" search results for its users. And I'm sure that Google has tried to use an approach that minimizes the concerns I raise above. But we've already seen, quite clearly, how Google's automated systems often fail when it comes to copyright issues, and the risk for both abuse and bad results seems quite high. At the very least, it's going to bear very close scrutiny to see how Google handles legitimate sites, who get swept up in claims of infringement when they're actually providing legitimate services.

Filed Under: abuse, copyright infringement, dmca notices, innovation, rankings, risks, search results
Companies: google, mpaa, riaa

Obama Talks Toxic Clouds And Runaway Trains, But The Real Cybersecurity Solution Is Still Simple And Obvious

from the and-what's-blocking-that-now? dept

Even as we're encouraged by the direction of the latest cybersecurity bill (with significant caveats), lots of folks have been asking from the beginning for two things: an end to "Hollywood-style" FUD claims of planes falling from the skies, and a clear statement on what existing laws make the kind of information sharing the government desires impossible today. President Barack Obama took to the Wall Street Journal Op-Ed pages today to explain why we need cybersecurity legislation... and unfortunately he failed on both accounts. The opening part is positively cinematic:

Last month I convened an emergency meeting of my cabinet and top homeland security, intelligence and defense officials. Across the country trains had derailed, including one carrying industrial chemicals that exploded into a toxic cloud. Water treatment plants in several states had shut down, contaminating drinking water and causing Americans to fall ill.

Our nation, it appeared, was under cyber attack. Unknown hackers, perhaps a world away, had inserted malicious software into the computer networks of private-sector companies that operate most of our transportation, water and other critical infrastructure systems.

He goes on to point out that some of the things mentioned have "already happened," except that's not quite true. It is true that some hackers accessed systems they shouldn't have had access to, but it's not clear if they were ever able to actually do any damage. Here's Obama's summary of the details:

Last year, a water plant in Texas disconnected its control system from the Internet after a hacker posted pictures of the facility's internal controls. More recently, hackers penetrated the networks of companies that operate our natural-gas pipelines

What's amusing is that the story in Texas came about because a hacker was trying to show that the feds were ignoring and downplaying threats to critical infrastructure. From the details, it looks like the system was vulnerable because of poor password choices, and the stupid decision to connect the system to the internet. So the fact is that "disconnect its control system from the Internet" is the solution. Not more laws. Meanwhile, the story about targeting natural-gas pipelines involved some basic social engineering (spear phishing) rather than any technical hackery. In both cases, the issue appears to be the same: critical infrastructure like that which controls the functioning of water treatment plants and gas pipelines shouldn't be connected to the internet.

But do we need a 211-page law to share information just to recognize that?

The bigger problem is that while the President's Op-Ed highlights how we want to avoid the cinematic story he tells at the beginning, where it fails is that it never explains why the kind of information sharing he's talking about is blocked today. Which rules and regulations are blocking that from happening? No one seems to want to say. Instead, we get legislation that just assumes there must be regulations blocking information sharing and wipes them all away.

We appreciate that Obama says that he'll veto any bill that doesn't include strong privacy and civil liberties protections, but we should never be passing legislation based on made up scary stories.

Filed Under: cybersecurity, internet, obama, privacy, regulations, risks, threats

A Look At Three Popular Sites That May Be In Trouble Under SOPA

from the collateral-damage dept

The EFF is taking a look at some websites that may face serious legal questions and liability should SOPA become law, specifically looking at Etsy, Flickr and Vimeo. These are three extremely popular and useful sites, which most people certainly believe are and should be perfectly legal. But under SOPA, they could be declared "dedicated to theft of US property," thanks to the broad definitions under the law. Take Etsy, for example:

Etsy is an online marketplace for handmade goods, where users can set up a storefront and create listings for things they’ve made.  There are over 800,000 active “shops” filled with these handmade goods — far too many for Etsy to monitor manually. Further, because of the eclectic nature of goods listed, it’s difficult to technically filter through the objects listed.

All that means that it’s not feasible for Etsy to proactively prevent listings that may be perceived to violate US copyright or trademark law.  That’s a problem, because  under SOPA, anybody who is a “holder of an intellectual property right harmed by the activities” of even a portion of the site, could serve Etsy’s payment processors with a notice that would require them to suspend Etsy’s service within 5 days. That means that a trademark violation in one of the storefronts could lead to payment suspension across the entire site. Unlike DMCA notices, which should be targeted to specific infringements, payment provider suspensions will likely target entire accounts.  And even if Etsy protests, the bill's vigilante provisions, which grant them immunity for choking off a site if they have a "reasonable" belief that a portion of a site enable infringement, give the payment processors a strong incentive to cut them off anyway.

The SOPA defenders in our comments will insist that Etsy should have picked a business model that doesn't rely on infringement. Kinda shows the disconnect here, doesn't it? Etsy's business model has nothing to do with infringement... and that's the problem with SOPA.

Flickr, of course, is one of the most popular photo hosting sites. But under SOPA, it's at risk:

Like Etsy, Flickr takes copyright issues seriously, and complies with DMCA safe harbor requirements by taking down photos when it gets a valid complaint, establishing a repeat infringer policy, etc.. But it doesn’t proactively monitor its user-generated content for copyright infringement. The language of SOPA is vague enough that an individual or corporate rightsholder could claim this lack of monitoring as “taking … deliberate actions to avoid confirming a high probability of the use of the … site to carry out acts that constitute a violation.” Flickr uses an ad network to place advertisements, and accepts payments for premium accounts. Both of those revenue streams could be suspended in a matter of days by a single complaint, and the process of reactivating them could be long and complex.

Vimeo is a really interesting one, since that company was sued by EMI for "inducing" infringement by having popularized "lipdub" videos. As EFF points out, that's more than enough to have them completely shut down under SOPA.

Of course, it's unlikely that rightsholders will go after any of these sites now under SOPA. They're all big enough -- and can afford lawyers. But there's a real fear that the next generation of such sites will get shut down... or, worse, won't even start up at all, due to the massive potential liability.

Filed Under: liability, risks, sopa
Companies: etsy, flickr, vimeo