Declassified Documents Shows The CIA Is Using A 1981 Executive Order To Engage In Domestic Surveillance

from the bypassing-checks,-balances,-and-oversight-with-Executive-power dept

When most people think of the CIA (Central Intelligence Agency), they think of a foreign-facing spy agency with a long history of state sponsored coup attempts (some successful!), attempted assassinations of foreign leaders, and putting the US in the torture business. What most people don't assume about the CIA is that it's also spying on Americans. After all, we prefer our embarrassments to be foreign-facing -- something that targets (and affects) people we don't really care about and governments we have been told are irredeemable.

An entity with the power to provoke military action halfway around the world has periodically shown an unhealthy interest in domestic affairs, which are supposed to be off-limits for the nation's most morally suspect spies. The CIA (along with the FBI) routinely abuses its powers to perform backdoor searches of foreign surveillance stashes to locate US-based communications. It also has asked the FBI to do its dirty secondhand surveillance work for it in order to bypass restrictions baked into Executive Order 12333 -- an executive order issued by Ronald Reagan that significantly expanded surveillance permissions for US agencies.

Perhaps most significantly -- at least in terms of this report -- the order instructed other government agencies to be more compliant with CIA requests for information. Since its debut in December 1981, the order has been modified twice (by George W. Bush) to give the government more power.

That's the authority the CIA has been using to spy on Americans, as a recent PCLOB (Privacy and Civil Liberties Oversight Board) report shows. The PCLOB performed a "deep dive" in CIA domestic spying at the request of Senators Ron Wyden and Martin Heinrich. After its completion, the senators asked for an unclassified version of the PCLOB's report. That report has arrived. And, according to Ron Wyden's statements, it shows the CIA is utilizing EO 12333 to spy on Americans and bypass the protections (however minimal) the FISA court provides to Americans.

“FISA gets all the attention because of the periodic congressional reauthorizations and the release of DOJ, ODNI and FISA Court documents,” said Senators Wyden and Heinrich in response to the newly declassified documents. “But what these documents demonstrate is that many of the same concerns that Americans have about their privacy and civil liberties also apply to how the CIA collects and handles information under executive order and outside the FISA law. In particular, these documents reveal serious problems associated with warrantless backdoor searches of Americans, the same issue that has generated bipartisan concern in the FISA context.”

Wyden and Heinrich called for more transparency from the CIA, including what kind of records were collected and the legal framework for the collection. The PCLOB report noted problems with CIA’s handling and searching of Americans’ information under the program.

Even if the spying isn't direct, the outcome is pretty much identical to direct targeting. With EO 12333, the CIA obtains the compliance from other federal agencies envisioned by Ronald Reagan back in 1981 as his administration ran headlong into the CIA-implicating Iran-Contra scandal.

Domestic data is supposed to be "masked" if incidentally acquired by foreign-facing surveillance collections. Sometimes this simply doesn't happen. Sometimes unmasking occurs without proper permission or oversight. The FBI uses this to its advantage. So does the CIA. But the FBI handles domestic terrorism. The CIA does not. That makes the CIA's abuse possibly more egregious than the FBI's numerous violations of the same restrictions placed on domestic surveillance via foreign interception of communications by the NSA.

The PCLOB report [PDF] shows the CIA has obtained bulk financial data from other sources, possibly without proper masking of incidentally-collected US persons data. According to the CIA's response to the report, the only thing separating CIA analysts from US persons' data and communications is a pop-up box warning them that access may be illegal. This is only a warning. It does not (nor could it) prevent analysts from obtaining data they shouldn't have access to without explicit permission.

How extensive this "incidental" collection is remains to be seen. And there's a good chance no one will ever know how often this pop-up was ignored to collect data generated by US citizens and residents. Much of the report is redacted and what was shared with the PCLOB was limited to whatever the CIA felt like sharing. The oversight of programs like these is deliberately limited by the Executive Order -- one that made the assumption some things (like national security) are too important to be done properly or overseen directly.

The report does note that the CIA has internal processes to limit abuse of backdoor searches. But it also points out the CIA has read EO 12333 and its modifications to mean it can do what it wants when it wants without worrying too much about straying outside of the generous lines drawn by this Executive Order.

The limits include a requirement to use the “least intrusive collection techniques feasible within the United States or directed against United States persons abroad.” Annex A implements E.O. 12333’s “least intrusive collection technique” requirement regarding activities outside of the United States involving U.S. persons. Given that the Executive Order’s restriction only applies to activities in the United States or activities directed against U.S. persons abroad, the CIA interprets the language of Annex A to only apply to collections directed against USPs abroad. Annex A does not require [redacted] to apply the least intrusive collection technique to collections covered by this report, which are generally not directed against USPs.

There's the exploitable loop: the EO only applies to collections "directed" at US persons. Since all information is pulled from foreign-facing surveillance collections that "incidentally" collect US persons data, the resulting collection the CIA has access to is completely legal. Analysts access these collections specifically to find US persons' data, but because no agency deliberately targeted US persons, it's all above board.

This is the exploitation of foreign bulk collections to obtain information about Americans. While some may argue the damage is minimal because it only accesses information (financial records) unlikely to have an established expectation of privacy, people obviously know their financial institutions track their purchases, but that's not the same thing as people assuming the government should be able to access records -- which may contain sensitive information -- using nothing more than an Executive Order that was ostensibly written to strengthen foreign surveillance efforts.

And that's only what can be observed from this redacted release. This isn't the CIA's only attempt to hoover up info on US persons via side channels. Wyden's letter hints at FISA reforms, which likely refers to domestic phone records the NSA used to collect in bulk -- a program that was specifically targeted by Congress following the Snowden revelations. What's contained in this report is a narrow examination of one part of the CIA's exploitation of bulk collections to obtain US persons data. And if it feels this confident about its nearly unrestricted ability to perform these backdoor searches, examinations of other aspects of this program are likely to find other domestic data is ending up in the hands of CIA analysts who are supposed to be focused on foreign activities.

Filed Under: cia, domestic surveillance, eo 12333, executive order, pclob, ron wyden, surveillance

Even Officials In The Intelligence Community Are Recognizing The Dangers Of Over-Classification

from the apparently-we-can't-trust-the-people-that-have-granted-the-government-this-p dept

The federal government has a problem with secrecy. Well, actually it doesn't have a problem with secrecy, per se. That's often considered a feature, not a bug. But federal law says the government shouldn't have so much secrecy, what with the FOIA being in operation. And yet, the government feels compelled to keep secrets from its biggest employer: the US taxpayers.

Over-classification remains a problem. It has been a problem ever since long before a government contractor went rogue with a massive stash of NSA documents, showing that many of the government's secrets should have been shared or, at the very least, more widely discussed as the government turned 9/11 into a constitutional bypass on the information superhighway.

Since then, efforts have been made to dial back the government's proclivity for classifying documents that pose no threat to government operations and/or government security. In fact, the argument has been made (rather convincingly) that over-classification is counterproductive. It's more likely to result in the exposure of so-called secrets rather than secure the blanket-exemption-formality that keeps secrets from the general public.

Efforts have been made to counteract this overwhelming desire to keep the public locked out of discussions about government activities. These efforts have mostly failed. And that has mainly been due to vague and frequent invocations of national security concerns, which allow legislators and federal judges to shut off their brains and hammer the [REDACT] button repeatedly.

But ignoring the problem hasn't made the problem go away, no matter how many billions the federal government refuses to throw at the problem. Over-classification still stands between the public and information it should have access to. And it stands between federal agencies and efficient use of tax dollars. The federal government generates petabytes of data every month. And far too often, the agencies generating the data decide it's no one's business but their own.

It's not just legislators noting the widening gap between the government's massive stockpiles of data and the public's ability to access them. It's also those generating the most massive stashes of bits and bytes, as the Washington Post points out, using the words of an Intelligence Community official.

The U.S. government is drowning in its own secrets. Avril Haines, the director of national intelligence, recently wrote to Sens. Ron Wyden (D-Ore.) and Jerry Moran (R-Kan.) that “deficiencies in the current classification system undermine our national security, as well as critical democratic objectives, by impeding our ability to share information in a timely manner.” The same conclusions have been drawn by the senators and many others for a long time.

As this letter hints at, over-classification doesn't just affect the great unwashed whose power is generally considered to be far too limited to change things. It also affects agencies and the entities that oversee the agencies -- the latter of which are asked to engage in oversight while being locked out of the information they need to perform this task.

If there's any good news here, it's that the Intelligence Community recognizes it's part of the problem. But this is just one person in the IC. It's unlikely every official feels this way.

The government is working towards a solution, but its work is being performed at the speed of government -- something further hampered by the back-and-forth of periodic regime changes and their alternating ideas about how much transparency the government owes to its patrons.

The IC letter writer almost sees a silver lining in the nearly opaque cloud enveloping agencies involved in national security efforts.

So far, Ms. Haines said, current priorities and resources for fixing the classification systems “are simply not sufficient.” The National Security Council is working on a revised presidential executive order governing classified information, and we hope the White House will come up with an ambitious blueprint for modernization.

The silver lining is "so far," and the efforts being made elsewhere to change things. The rest of the non-lining is far less silver: the resources aren't sufficient and the National Security Council is grinding bureaucratic gears by working with the administration to change things. If it doesn't happen soon, changes will be at the discretion of the next administration. And the next administration may no longer feel streamlining declassification is a priority, putting projects that have been in the on-again, off-again works since Snowden's exposes on the back burner yet again.

Our government will never likely feel Americans can be trusted with information about the programs their tax dollars pay for. But perhaps a little more momentum -- this time propelled by something within the Intelligence Community -- will prompt some incremental changes that may eventually snowball into actual transparency and accountability.

Filed Under: avril haines, classification, foia, jerry moran, over classification, ron wyden, secrecy, transparency

IRS Says It Will Move Away From Requiring ID.me Facial Recognition

from the good-move dept

Last month, we wrote about how the IRS and other federal agencies were starting to require the use of private facial recognition from a somewhat sketchy private company, for people to access their own government's services. The main company in question, ID.me, had made some... questionable decisions that raised serious questions about why the government was forcing people to make use of such a private service.

Earlier this morning, Senator Ron Wyden sent a letter to the Treasury Department calling on them to drop the facial recognition requirement, and within hours the Treasury Department told Wyden it would be "moving away" from that plan, and then the IRS put up a more official statement:

The IRS announced it will transition away from using a third-party service for facial recognition to help authenticate people creating new online accounts. The transition will occur over the coming weeks in order to prevent larger disruptions to taxpayers during filing season.

During the transition, the IRS will quickly develop and bring online an additional authentication process that does not involve facial recognition. The IRS will also continue to work with its cross-government partners to develop authentication methods that protect taxpayer data and ensure broad access to online tools.

"The IRS takes taxpayer privacy and security seriously, and we understand the concerns that have been raised," said IRS Commissioner Chuck Rettig. "Everyone should feel comfortable with how their personal information is secured, and we are quickly pursuing short-term options that do not involve facial recognition."

The transition announced today does not interfere with the taxpayer's ability to file their return or pay taxes owed. During this period, the IRS will continue to accept tax filings, and it has no other impact on the current tax season. People should continue to file their taxes as they normally would.

Last week the Treasury Department had said it was "reviewing" the matter, but today's announcement is a big deal. It's rare to see a government agency move this fast, so kudos to Treasury/IRS for acting quickly (though, it can be argued that it never should have gotten this far in the first place). But also kudos to Wyden for helping make this happen as well.

Filed Under: facial recognition, irs, privacy, ron wyden, security, treasury department
Companies: id.me

Senator Wyden: EARN IT Will Make Children Less Safe

from the exactly-right dept

Earlier this week we wrote about the problematic reintroduction of the EARN IT Act and explained how it will make children a lot less safe -- exactly the opposite of what its backers claim. Senator Ron Wyden has now put out a statement that succinctly explains the problems of EARN IT, and exactly how it will do incredible harm to the very children it pretends to protect:

“This sadly misguided bill will not protect children. It will not stop the spread of vile child exploitation material or target the monsters that produce it. And it does not spend a single dollar to invest in prevention services for vulnerable children and youth or help victims and their families by providing evidence-based and trauma-informed resources. Instead, the EARN IT Act threatens the privacy and security of law-abiding Americans by targeting any form of private, secure devices and communication. As a result, the bill will make it easier for predators to track and spy on children and also harm the free speech and free expression of vulnerable groups,” Wyden said. “I have spent my career in the Senate fighting to protect kids and aid victims of abuse, and I will do everything in my power to ensure every single monster responsible for exploiting children or spreading horrific CSAM materials is prosecuted to the fullest extent of the law. But this bill does nothing to turn around the Justice Department’s tragic failure to prioritize child welfare and abuse cases.”

As Wyden notes, he introduced a bill that would put $5 billion towards actually fighting child sexual abuse, but for whatever reason that bill is going nowhere, while EARN IT is on the fast track.

Only one of those bills (Wyden's) actually moves us towards really fighting against child sexual exploitation. The other one grandstands and makes children less safe because it fails to understand technology or the law. Yet which one is Congress gearing up to support?

Filed Under: csam, earn it, ron wyden

ICE Loses Access To Sensitive Utility Customer Records Following Pressure By Senator Ron Wyden

from the and-now-we'll-wait-for-the-law-enforcement-pushback dept

Another one of ICE's (Immigration and Customs Enforcement) data spigots has been shut off. Don't cry too many tears for poor old ICE. It still has plenty of options. It's still hoovering up location data from app developers who either don't know or don't care that this data is buyable through data brokers. It also still has plenty of privileges, thanks to laws and judicial decisions that say most constitutional rights are null and void within 100 miles of our nation's ports of entry (borders, coasts, and -- making this far more concerning -- any domestic airport offering international flights).

Plenty of data can still be had (and plenty of brokers willing to sell it), but ICE has just lost access to one source of data it uses to track down immigrants: utility bill information gathered, packaged, and sold to government agencies by third parties like Equifax and Reuters.

Equifax gathers this information ostensibly to assess the creditworthiness of United States residents. (It also leaks this information on occasion.) Thomson Reuters uses the same information (called "utility header data") in its CLEAR database, which contains "billions of data points" and "leverages cutting-edge public records technology." Its potent combination of bulk data and profit-seeking is sold to whoever wants access, which includes US law enforcement agencies.

ICE no longer has access to this data through CLEAR. At least the "utility header data" part of it. So have the nation's law enforcement agencies. Following pressure from Senator Ron Wyden, utility companies will no longer allow this data to be resold by Equifax to private entities like Reuters. (Possible paywall ahead. Alternate link.)

A nationwide group of utility companies that provided sensitive data from millions of Americans’ cable, phone and power bills to U.S. Immigration and Customs Enforcement and other government agencies has agreed to end the practice in response to concerns the information was being misused to track the general public.

Wyden's pressure on the National Consumer Telecom & Utilities Exchange (NCTUE) prompted change. The NCTUE told Equifax to stop selling this data. This means the data no longer flows to Reuters' CLEAR database, which means agencies like ICE no longer have access to it.

But Reuters isn't the only player in the data market. There are plenty of third parties purchasing data and selling it to government agencies and other third parties. That's why Wyden is now demanding the Consumer Finance Protection Board start doing its job and start regulating the sale of Americans' data.

Wyden, a longtime critic of government surveillance, called on the CFPB to further rein in a data-broker industry that he said had spun “out of control” due in part to “vague and undefined regulations.” He urged the agency to aggressively investigate how data gathered for commercial purposes was ending up in the hands of law enforcement without court approval or oversight.

“Selling personal information that people provide to sign up for power, water and other necessities of life, and giving them no choice in the matter, is an egregious abuse of consumers’ privacy,” Wyden wrote. “The personal privacy of hundreds of millions of people should not depend upon the goodwill of corporations worried about negative headlines.”

Currently, it's third parties on top of third parties, buying data from wherever it can be purchased and repackaging it for sale to others. This has led to consumers being misled about everything, from the data being collected to how the data is being used. Boilerplate about sales or licensing to third parties doesn't make it clear information collected to open and maintain necessities of life (like utility services) will ultimately be part of "billions of data points" accessible without a warrant by law enforcement.

As of right now, the data Wyden is concerned about is bought and sold in a gray market -- one not directly affected by regulation. That's what Wyden hopes to change.

The sale of credit payment histories and related data is closely regulated under federal law. But government agencies can access credit header data because the regulations do not clearly outline how the revealing information can be used. Wyden urged CFPB to clarify the law and investigate how the data is sold.

Government agencies and data brokers have long preyed on the disconnect between public perception and the far uglier reality of data harvesting. Customers and consumers understand utility companies need to collect information to provide service and collect payment. They may also make the small logical leap that payment histories will be forwarded to companies that assess credit ratings. What they almost never assume is that all this data -- which includes names, addresses, social security numbers, and plenty of contact info -- can be accessed at will by US law enforcement agencies.

Many data fire hoses are still in operation. But this move slows one form of data to a drip -- one that travels to Equifax but goes no further. It's a start, but as Sen. Wyden clearly realizes, there's a long way to go before Americans can trust the entities that collect data from us.

Filed Under: clear, data, data brokers, ice, nctue, privacy, ron wyden, utility bills
Companies: reuters

Publishers Want To Make Ebooks More Expensive And Harder To Lend For Libraries; Ron Wyden And Anna Eshoo Have Questions

from the end-of-ownership dept

Techdirt has noted in the past that if public libraries didn't exist, the copyright industry would never allow them to be created. Publishers can't go back in time to change history (fortunately). But the COVID pandemic, which largely stopped people borrowing physical books, presented publishers with a huge opportunity to make the lending of newly-popular ebooks by libraries as hard as possible.

A UK campaign to fight that development in the world of academic publishing, called #ebookSOS, spells out the problems. Ebooks are frequently unavailable to institutions to license as ebooks. When they are on offer, they can be ten or more times the cost of the same paper book. The #ebookSOS campaign has put together a spreadsheet listing dozens of named examples. One title cost £29.99 as a physical book, and £1,306.32 for a single-user ebook license. As if those prices weren't high enough, it's common for publishers to raise the cost with no warning, and to withdraw ebook licenses already purchased. One of the worst aspects is the following:

Publishers are increasingly offering titles via an etextbook model, via third party companies, licensing content for use by specific, very restricted, cohorts of students on an annual basis. Quotes for these are usually hundreds, or sometimes thousands, times more than a print title, and this must be paid each year for new cohorts of students to gain access. This is exclusionary, restricts interdisciplinary research, and is unsustainable.

Although #ebookSOS is a UK campaign, the problem is global, as publishers try to change the nature of ebook lending everywhere. Ron Wyden and Anna Eshoo have noticed that it's happening in the US, and seem unimpressed by the publishing industry's moves, as a letter to the CEO of Penguin Random House (pdf) makes clear:

Many libraries face financial and practical challenges in making e-books available to their patrons, which jeopardizes their ability to fulfill their mission. It is our understanding that these difficulties arise because e-books are typically offered under more expensive and limited licensing agreements, unlike print books that libraries can typically purchase, own, and lend on their own terms. These licensing agreements, with terms set by individual publishers, often include restrictions on lending, transfer, and reproduction, which may conflict with libraries' ability to loan books, as well as with copyright exceptions and limitations. Under these arrangements, libraries are forced to rent books through very restrictive agreements that look like leases.

The letter asks for answers to nine detailed questions about any restrictions imposed on ebook use, the pricing of both physical and digital books, as well as information about any legal actions that have been taken in response to things like multiple checkouts of digital texts, interlibrary loans, controlled digital lending, and institutions making digital copies of physical books they own.

This is a hugely important battle, since it's clear the publishing world sees it as a unique chance to redefine what libraries can do with ebooks. It's part of the much larger, very troubling trend to turn everyone into renters, and to bring about the end of ownership.

Follow me @glynmoody on Twitter, Diaspora, or Mastodon.

Filed Under: anna eshoo, ebooks, libraries, publishers, ron wyden

If Courts Won't Protect People's Phones At The Border, Congress Needs To Act Now

from the it's-time-to-move-past-'but-the-border-tho' dept

Invasive searches of people's phones at border crossings and international airports have become standard operating procedure for US border control agencies. The usual justifications have been made: national security and preventing contraband from crossing the border.

Those claims may have some merit, but it doesn't explain why the number of invasive searches has exploded over the past few years, even though the number of border crossings hasn't. It also doesn't explain why agencies like Customs and Border Patrol (CBP) continue to claim the program is too important to be curtailed, yet somehow not important enough to be competently supervised or quantified.

For the most part, courts have agreed with the government's assertions that searching devices without warrants or (in many cases) articulable suspicion is just good national security work. Only one court has pushed back, requiring searches to be limited to rooting out suspected contraband, rather than just examining phone contents until agents find something to get reasonably suspicious about.

The Supreme Court said warrants are needed to search the contents of cell phones. Unfortunately, our nation's borders have long been considered blanket warrant exceptions -- an exception that extends 100 miles inland from every border and international airport. It also limited this to searches "incident to an arrest," and in many cases, people whose devices are searched at the border are never arrested.

This ruling tends to work well away from the border, since seizures of phones without an arrest is generally considered an obvious violation of rights, which makes any subsequent searches illegal. But this phrase doesn't do much to limit searches at the border where rights are assumed to be mostly waived, making the initial seizures lawful, paving the way for warrantless searches that may violate the Fourth Amendment, but in a place where courts have said violating the Constitution is cool and good.

And so the courts, having abdicated their checks and balances mandate, tell plaintiffs "hey, if this bothers y'all, maybe ask Congress to get it changed." Because if Congress says it's ok to waive all rights near the border, who are the courts to decide direct Supreme Court precedent applies to border phone searches?

Well, maybe the courts need to do a little local application because Congress can't be arsed. A bill to restore the Fourth Amendment at the border has been submitted and denied in the past. It's back again. Maybe this time -- given the increasing distrust of law enforcement and federal border control efforts -- it will get further than it has in the past.

Here's the EFF's summary of Ron Wyden's "Protecting Data at the Border Act," which (against all sanity) offers up the novel idea that the federal government should respect people's rights.

Unfettered border searches of electronic devices pose a significant threat to personal privacy. That’s why we urge Congress to pass the Protecting Data at the Border Act, a bill recently re-introduced by Sen. Ron Wyden (D-OR) and Sen. Rand Paul (R-KY) that would create a warrant requirement for these types of searches, thereby protecting our constitutional rights at the border.

As the EFF points out, this is the third attempt to restore the Fourth Amendment in the federal government's gray area -- the large parts of the United States known unofficially as the "Constitution-Free Zone." The bill wouldn't go so far as to enact a warrant requirement, but it does add a bunch of protections that currently don't exist.

Consent must be obtained in written form. No more Google Translate or pidgin Spanglish from border control officers who will take consent even if it's expressed with upside down question marks. And it's not all of the Fourth Amendment, but it's more than we have now: border control officers need to have probable cause someone committed a felony before seizing their device. If they don't have that, any post-seizure search would be a de facto rights violation.

There are also reporting requirements that mandate more transparency from border control agencies on searches and seizures of devices. And agencies are forbidden from retaining communications and data that can't be shown to be related to criminal investigations or charges.

It's not perfect but it's far more than we have now. And, if enacted, would curb CBP's thirst for warrantless searches, forbidding it from getting the boys in the boat to sail out on fishing expeditions just because. This is the third try for Wyden's bill. Let's hope it's the charm.

Filed Under: 4th amendment, border, border exception, border searches, cbp, device searches, protecting data at the border act, ron wyden

CIA, NSA Block Ads Network-Wide To Protect Agencies. Ron Wyden Says Rest Of Gov't Should Do The Same.

from the [glaring-pointedly]-they're-not-wrong dept

Not everyone uses an ad-blocker. But most people do. And no matter how much online publications claim ad blocking is the same thing as stealing, it really isn't. If they're bent out of shape about it, it's because they assault users with ads, burying content behind a wall of uncurated virtual salesmen. If it bleeds, it leads, the old saying goes, but now it refers to readers' processing power and data allotments.

Far too many online publications consider processing the check on the ad buy to be the end of their responsibility. But ad servers get hijacked. Other ad companies get purchased by ad pushers with more malleable morals. Everyone collects reams of data on every site visitor. The end user of sites seems to be the last concern for ad brokers and the people who sell to them, so it's no surprise more people are deploying ad blockers, seeing as readers of even supposedly-reputable sites have been hit with malware, spyware, and auto-playing video when just trying to access some content.

Ads can be dangerous. They can compromise systems and hijack browsers. The general public definitely knows this. Enjoy this shade thrown at ad saturation and website design overcompensation:

The government knows this as well. And it should, although it really shouldn't be a trailing indicator on abusive ad deployment. The spyingest agencies of the Intelligence Community don't just suggest employees should use ad blockers. It mandates them. Here's Joseph Cox for Motherboard:

Lots of people who use ad blockers say they do it to block malicious ads that can sometimes hack their devices or harvest sensitive information on them. It turns out, the NSA, CIA, and other agencies in the U.S. Intelligence Community (IC) are also blocking ads potentially for the same sorts of reasons.

The IC, which also includes the parts of the FBI, DEA, and DHS, and various DoD elements, has deployed ad-blocking technology on a wide scale, according to a copy of a letter sent by Congress and shared with Motherboard.

The letter [PDF], written by Senator Ron Wyden, suggests the rest of the federal government follow the NSA's lead and implement "network-based ad-blocking technologies" at all federal agencies.

While the intelligence community has acted to protect its personnel and computers from malvertising based threats, many other federal agencies have not, and are unlikely to until they are required to do so. To that end, as OMB [Office of Management and Budget] finalizes its recently released draft Federal Zero Trust Strategy, detailing the specific actions that OMB is requiring federal agencies to take to secure their systems from hackers, I urge OMB to also require agencies to implement the CISA and NSA guidance to block ads.

"Zero trust." That sounds like an accurate court of the trust most online advertisers have earned. It's a cesspool out there and publications looking for the easiest way to convert readers to dollars have proven willing to splash around in it under the assumption they'll always be able to blame the foul odors on their ad partners. But that assumes people will be willing to forgive continuous abuse as long as they can access "free" content. That's a risky assumption.

And it doesn't have to be this way. Techdirt has experimented with a blend of ads and direct connection with readers to pay the bills. As ad providers have become less trustworthy and old standbys (like Google's AdSense) have become increasingly erratic with their policy enforcement, Techdirt has dropped ads completely. There are no Google ads on Techdirt and no analytics trackers logging reader info for data brokers who not only help serve up "targeted" ads but also sell data in bulk to government agencies. Techdirt runs clean and is almost entirely reader-supported. Very few sites are willing to give up money to ensure the safety and privacy of their readers and that's why ad blocking has never been considered a threat to Techdirt's business model.

Ad blocking is a must-have these days, even for the federal government. Too much abuse and too little oversight has turned a nicety into a necessity. And if online publications don't like the current state of affairs, they really have no one but themselves to blame.

Filed Under: ad blocking, cia, cybersecurity, intelligence community, nsa, ron wyden

You Can't Be Tough On Big Tech While Killing Off Alternatives To It

from the decentralized-tech-can-help dept

The Biden administration has been talking a big game about being "tough on Big Tech" and Silicon Valley monopolies. But right now they're quietly defending a provision in the must-pass Infrastructure Bill that targets software developers who are building alternatives to the exact Big Tech systems the administration decries.

The administration has been pushing a "pay-for" measure in the bipartisan Infrastructure Bill that would expand US government surveillance of cryptocurrency-related or decentralized projects. The Electronic Frontier Foundation, Fight for the Future and 14 other civil society organizations have expressed grave concerns for the “vague and dangerous” digital currency provision of the bill.

This digital currency provision has been sold as being about taxes. But it's so poorly written that it would create reporting requirements demanding people like software developers and even volunteers within decentralized tech projects hand over data or conduct surveillance of their users. There are plenty of valid concerns around cryptocurrencies & ensuring that everyone pays their fair share of taxes. However, the provision in the Infrastructure Bill would demand data from people who don't have it—effectively crushing a wide range of decentralized projects under misguided regulations.

Destroying decentralized projects would be a disaster for global human rights, freedom of expression, and democracy. Cryptocurrencies and decentralized tech projects are among the most promising potential solutions to address the harms of Big Tech. Decentralization could help end the era of surveillance capitalism.

If the Biden administration is serious about taking on Big Tech, it shouldn't be actively trying to shut down communities of developers, volunteers, people who run nodes, and other participants in the very software projects that could one day help us escape the clutches of Facebook, Amazon, and Google. The original cryptocurrency provision in the Infrastructure Bill amounts to a dramatic expansion of government surveillance tacked on to a must-pass piece of legislation at the last minute. Policy that impacts human rights & the future of the Internet shouldn't be made this way.

Fortunately, Senators Wyden, Lummis, and Toomey have introduced an amendment that would fix the problematic language in the Infrastructure Bill. This amendment is a win-win: it ensures actual crypto brokers like Coinbase pay their taxes, but clarifies the measure can't be abused for broader surveillance or oppression of smaller decentralized projects. Now even Senator Portman, who teamed up with the White House to draft the original cryptocurrency surveillance proposal in the Infrastructure Bill, is supporting this common sense amendment. Sadly, Senator Portman, who teamed up with the White House to draft the original cryptocurrency surveillance proposal in the Infrastructure Bill, pulled his former support for this common-sense amendment and introduced his own amendment that is even worse than the original provision itself.

Weirdly, the Biden administration seems to still be pushing the original language and opposing this amendment to the law that would clarify small players won’t be targeted. The administration simultaneously claims two opposing facts:

First, that the current language doesn't target "small players" in the decentralization ecosystem at all.

Contrarily, the administration also states that the Wyden amendment would "put a dent" in the tax revenue generated—even though the amendment would just clarify that onerous reporting requirements don't apply to people who wouldn't even possess the surveillance data that this law would require to be turned over.

The White House can’t have it both ways on this. Either the language only targets actual cryptocurrency brokers, in which case the Wyden amendment would have no impact on the tax revenue generated—or the admin's "pinky swear" that it won't use this law to go after small players like software developers making wallets is false.

We can and should have real conversations about what types of policies should be in place to protect people, especially low income folks and communities vulnerable to surveillance, from cryptocurrency scams. We also need to ensure that giant corporations and millionaires pay their fair share of taxes. But if the Biden administration really cares about holding Big Tech companies accountable and giving people alternatives to Silicon Valley giants, they need to start getting smarter about how technology actually works, and advance policies that actually accomplish stated goals.

More than 10,000 people have called the Senate because the cryptocurrency surveillance provision in the Infrastructure Bill is a huge mess and a huge threat to digital innovation and human rights. The Wyden amendment will fix it. Democratic senators and the Biden administration should back off their hypocritical stance that calls for reining in Big Tech while also stifling any innovation that could replace it.

Evan Greer is an Executive Director and Lia Holland is Campaigns and Communications Director at Fight for the Future, a digital rights organization with 3 million members celebrating 10 years of defending human rights on the internet from malicious corporate interests and ill-informed legislators.

Filed Under: big tech, cryptocurrency, distributed computing, infrastructure, joe biden, ron wyden, surveillance

Senator Wyden Tells The DOJ It Needs To Stop Going After Journalists During Leak Investigations

from the if-they-aren't-a-target,-don't-target-them dept

Earlier this month, it was revealed the DOJ -- while headed by Bill Barr and an extraordinarily leaky White House -- decided it would be cool and constitutional to demand journalists' phone and email records while supposedly investigating leaks pertaining to Trump's first impeachment.

The DOJ apparently did manage to get the phone records. For whatever reason, it never bothered to collect the email metadata, despite having obtained a court order to do so. Nearly four years after this occurred, the Washington Post journalists were finally notified about the government's interest in their communications.

The Justice Department's statement was less than satisfactory. It claimed that this sort of First Amendment-troubling activity was "rare" and that it followed all of its internal guidelines when targeting journalists' communications. It also claimed it was ok because the journalists weren't the target of the investigation. All the DOJ wanted were their sources.

That's not ok no matter what internal guidelines are followed. If the DOJ has a leak to investigate, it needs to confine itself to the end doing the leaking, not the recipients of the leaks. Just because it might be easier for investigators to work their way backwards from journalists' communications to identify the source of leaks doesn't make it acceptable. The ends don't justify the means -- not when the means wander across the constitutional lines.

Now the DOJ has (yet again) angered Senator Ron Wyden. Wyden has sent a letter [PDF] to Attorney General Merrick Garland, demanding he revamp the internal rules to make this sort of thing far less likely to reoccur. Wyden is also asking for full reports on any surveillance of journalists the DOJ engaged in over the last couple of years.

As Wyden points out, using subpoenas and court orders to sniff out journalists' sources may be less disruptive than subjecting them to the justice system, but the end result is the same breach of trust and Constitutional protections.

In years past, the government would often attempt to force journalists to reveal their sources, by dragging them into court, where many chose to spend time in jail for contempt of court, rather than violate their oath to keep their sources' identities hidden. Now that most Americans carry always-on, always-recording smartphones, the government prefers to go to telecommunications companies, hoping that records of calls and texts might reveal the source. While certainly more convenient for the government, using subpoenas and surveillance orders to pry into a journalist‘ communications history is no less invasive and destructive than forcing a journalist to reveal their source.

From there, Wyden goes on to note he's working to introduce stronger protections for journalists. And with that in mind, he asks the new Attorney General to start repairing some of the damage done by the previous administration.

[T]he Biden Administration has the opportunity to voluntarily leave behind the thuggish and Orwellian abuses of power of the last administration, and stand up as a world leader for press freedoms. [...] Simply put, the government should not collect journalists' communications records unless it's investigating them for a crime or as part of an investigation into foreign espionage, in which case it should get a warrant.

That's far more restrictive than the DOJ's current standards, which seem pretty low for something with the word "justice" in it that operates in a nation that has held itself out to be the standard-bearer for personal freedoms. Hopefully, AG Garland will decide it's time for the DOJ to respect the rights all government employees swear to uphold.

Filed Under: 1st amendment, 4th amendment, doj, intimidation, journalists, ron wyden