Clearview Says Section 230 Immunizes It From Vermont's Lawsuit Over Alleged Privacy Violations

from the assuming-the-judge-will-call-this-theory-'novel'-which-isn't-a-compl dept

Clearview is currently being sued by the attorney general of Vermont for violating the privacy rights of the state's residents. As the AG's office pointed out in its lawsuit, users of social media services agree to many things when signing up, but the use of their photos and personal information as fodder for facial recognition software sold to government agencies and a variety of private companies isn't one of them.

[T]he term "publicly available" does not have any meaning in the manner used by Clearview, as even though a photograph is being displayed on a certain social media website, it is being displayed subject to all of the rights and agreements associated with the website, the law, and reasonable expectations. One of those expectations was not that someone would amass an enormous facial-recognition-fueled surveillance database, as the idea that this would be, permitted in the United States was, until recently, unthinkable.

Thus, when an individual uploads a photograph to Facebook for "public" viewing, they consent to a human being looking at the photograph on Facebook. They are not consenting to the mass collection of those photographs by an automated process that will then put those photographs into a facial recognition database. Such a use violates the terms under which the consumer uploaded the photograph, which the consumer reasonably expects will be enforced.

This is somewhat the same point multiple companies have made with their (ultimately ineffective) cease-and-desist orders: we have not agreed to allow Clearview to harvest data from our sites and sell that collected data to others.

Whether or not selling this scraped collection to law enforcement agencies is unlawful in Vermont remains to be seen. But Clearview is fighting back in court, raising a truly questionable Section 230 defense against the AG's lawsuit.

Clearview is represented by Tor Ekeland, who has been truly useful in defending people against bogus prosecutions. But Ekeland appears to believe Section 230 is a net loss for the public, so it's interesting to see him raise it as a defense here.

Clearview's motion to dismiss [PDF] compares Clearview to Google, claiming its bots crawl the web and cache images (and other data) on servers. However, Clearview claims it collects "far less data" than comparable search engines. According to its filing, Clearview does not collect any identifying info either -- at least not intentionally. It only harvests photos and their metadata. The company says only 10% of the photos in its 4-billion photo database have any metadata attached.

However, this doesn't mean the software can't compile a staggering amount of information on a person and return this long list in response to an uploaded facial photo. To comply with California data privacy laws, Clearview has given state residents the opportunity to see what Clearview has gathered on them. It's a lot.

The depth and variety of data that Clearview has gathered on me is staggering. My profile contains, for example, a story published about me in my alma mater’s alumni magazine from 2012, and a follow-up article published a year later.

It also includes a profile page from a Python coders’ meetup group that I had forgotten I belonged to, as well as a wide variety of posts from a personal blog my wife and I started just after getting married.

The profile contains the URL of my Facebook page, as well as the names of several people with connections to me, including my faculty advisor and a family member…

Clearview's assertions about the personal information it intentionally gathers are meant to head off the Vermont AG's claims that the company is violating state privacy laws. It's also meant to portray Clearview as no more damaging to privacy than search engines like Google and no more nefarious than a Google search. The problem is cops are less likely to trust a Google search and more likely to trust a company that says it has 4 billion images and 600 law enforcement "partners," even if the search results are equally questionable.

But on to the Section 230 argument, which is kind of amazing in its audacity.

Clearview is entitled to immunity under the CDA because: (1) Defendant is an interactive computer service provider or user; (2) Plaintiff’s claims are based on “information provided by another information content provider;” and (3) Plaintiff’s claims would treat Defendant as the “publisher or speaker” of such information.

These are the base claims. There's more to it. But this is a company raising a defense afforded to service providers who host third party content. Here, there is no third party content -- at least not in the sense that we're used to. The "third parties" Clearview deals with are government agencies, who contribute no content of their own and only search the database of scraped photos using uploaded images.

In addition, the Vermont AG is not seeking an injunction against Clearview because of any particular content in its database. For example, the lawsuit is not predicated on defamatory content a user created. Instead, it's suing Clearview because its method of database compilation ignores the state's privacy laws. It's hard to imagine how Section 230 fits this particular action, but this filing attempts to do exactly that.

First, Clearview asserts it's a search engine just like Google. And if Google can't be sued for violating privacy rights of users of other sites whose personal photos/information show up in Google searches, neither can Clearview.

The Attorney General seeks to prohibit Clearview from accessing or using publicly distributed photos, none of which Clearview AI created. Clearview AI's republication of third-party content is the result of its search engine algorithm, which in this instance happens to be a biometric facial algorithm. The underlying technology does not transform Clearview into an information content provider that would be ineligible for CDA immunity. The CDA protects the publication of search engine results.

[...]

Clearview's publication of its biometric facial algorithms results does not make it an information content provider any more than Google becomes one when it publishes its search algorithm results. Simply put, “[i]f a website displays content that is created entirely by third parties, ... [it] is immune from claims predicated on that content.”

If Clearview did not create the content, it cannot be held responsible for its use of it -- even if end users never specifically agreed to be part of a database accessible by law enforcement.

The motion also says Clearview cannot be viewed as a publisher, since all it has done is created (with scraped content) a searchable database of third-party content.

Vermont’s complaint cannot change the fact that it is targeting Clearview for performing the exact same functions as corporations like Google and Microsoft. Vermont claims that, “at a minimum, Clearview ‘must obtain the other party’s consent before’ using consumers’ photos from any website.” Google, in contrast, is said to “respect the Terms of Service of the websites they visit." But Google searches are filled with information that individuals wanted to remain private, such as nonconsensually distributed intimate images. Nevertheless, Google has repeatedly been protected by §230 because courts have correctly viewed it as a publisher.

[...]

Clearview’s use of a complex algorithm does not negate the fact that it is performing the traditional role of a publisher. The Second Circuit emphatically rejected a claim that Facebook’s “matching” algorithm deprecated its status as a publisher. The Second Circuit has stated that, “we find no basis in the ordinary meaning of ‘publisher,’ the other text of Section 230, or decisions interpreting Section 230, for concluding that an interactive computer service is not the ‘publisher’ of third-party information when it uses tools such as algorithms that are designed to match that information with a consumer's interests."

The state has responded [PDF] to Clearview's Section 230 assertions and has made the obvious point: this legal action isn't being brought over content generated by third parties that would normally be met with immunity arguments. It's being brought over Clearview's acquisition and use of third-party content that state residents never agreed to being harvested/used by the facial recognition tech company.

The injurious information that Clearview claims gives it Section 230 immunity are the photographs that it screen-scraped. But the photographs themselves, as they were posted on the internet by their owners, are not injurious, and do not give rise to any of the State’s claims. Put another way, the State’s cause of action is not properly against millions of individuals who posted anodyne photographs on the internet.

The State’s claims are not based on the specific information at issue. The photographs themselves do not give rise to any of these claims. The State’s claims are for unfairness, deception, and fraudulent acquisition of data. Compl. ¶¶ 76-86. Specifically, Clearview’s conduct in acquiring the photographs through fraudulent means (see Section VI infra, discussing use of term “fraudulent”), storing them without proper security, applying facial recognition technology in a manner meant to violate privacy and infringe civil rights, and providing access to the database to whomever wanted it without concern for the safety or rights of the public, give rise to the State’s claims.

The state's counter-argument hinges on a close reading of Section 230 -- one that turns on a certain voluntary action by third parties.

Section 230 requires that the information at issue be provided by the third-party content provider. Again, the common thread in Section 230 cases is that the Information Content Provider posted the offensive information on the defendant’s servers. Here, no Vermont consumer could have intentionally provided any photographs to Clearview’s servers, because prior to the discovery in January of this year that Clearview had 3 billion photographs in a New York Times exposé, the general public did not know that Clearview existed.

It also points out how Clearview differs from the search engines it tries to compare itself to favorably.

Clearview is not a search engine like Google or Bing. Clearview’s App does something that no other company operating in the United States, including search engine companies, has ever done. In fact, search engine companies that are capable of creating a product like Clearview’s refused to do so for ethical reasons.

The state isn't impressed by Clearview's arguments and sums everything up with this:

For the fact pattern to apply, the photographs themselves would have to somehow be unfair or deceptive and the State’s claims would more properly be brought against the individuals.

In essence, the lawsuit isn't about objectionable content hosted by Clearview, but objectionable actions by Clearview itself. That's why Section 230 doesn't apply. I'm not sure how the local court will read this, but it would seem readily apparent that Section 230 does not immunize Clearview in this case.

Filed Under: facial recognition, privacy, scanning, section 230, vermont
Companies: clearview, clearview ai

Clearview Sued By Vermont Attorney General For Violating The State's Privacy Laws

from the engineering-its-own-downfall dept

For the second time in a little over 30 days, odious facial recognition tech supplier Clearview is being sued. Unlike the first lawsuit, which is a proposed class action over violations of Illinois' biometric privacy law, this one [PDF] is being filed by a government agency. The Attorney General of Vermont is seeking to permanently ban Clearview from collecting info about state residents or sell access to the info it's already collected.

The complaint alleges that Clearview AI has been collecting photos of Vermonters available on the internet – called “screen scraping” – and using artificial intelligence to “map” individual’s faces. Private businesses, individuals, and law enforcement use this data via an app that allows a user to identify a person within seconds using only a photograph. No Vermont state or local law enforcement agencies have used the app. Clearview AI collects the facial recognition data of Vermont children, as well as adults, without their notice or consent.

The complaint also alleges that Clearview AI violated Vermont’s new Data Broker Law by fraudulently acquiring data through its use of screen scraping.

The method used to compile Clearview's database of three billion images is going to make it very difficult for the company to dodge lawsuits like these. Scraping sites may be mostly legal, but Clearview doesn't provide any way to opt out of this collection. Scraping images from sites where users have granted the platform permission to publish their information doesn't mean the TOS agreement the user made with the platform magically migrates with the scraped data.

From the lawsuit:

[T]he term "publicly available" does not have any meaning in the manner used by Clearview, as even though a photograph is being displayed on a certain social media website, it is being displayed subject to all of the rights and agreements associated with the website, the law, and reasonable expectations. One of those expectations was not that someone would amass an enormous facial-recognition-fueled surveillance database, as the idea that this would be, permitted in the United States was, until recently, unthinkable.

Thus, when an individual uploads a photograph to Facebook for "public" viewing, they consent to a human being looking at the photograph on Facebook. They are not consenting to the mass collection of those photographs by an automated process that will then put those photographs into a facial recognition database. Such a use violates the terms under which the consumer uploaded the photograph, which the consumer reasonably expects will be enforced.

Clearview's database compilation relies on its violating website terms of service en masse. Sites have begun pushing back but at this point their legal options are limited to being angry about it. But some state-by-state litigation may actually have an effect, since it seems almost impossible for Clearview to comply with privacy laws governing the collection of biometric data. Selling access to the data makes it even more difficult, since there's no way for those packaged up in Clearview's database to request removal or limit access to the scraped data.

It's too late for Clearview to salvage its reputation by claiming it controls access carefully and sells only to law enforcement agencies to assist in solving crimes. That cat walked right out of the bag and over to BuzzFeed, which reported Clearview is selling its tech to private companies and governments engaged in ongoing human rights abuses. Claiming to serve a higher purpose while behaving like a bottom feeder doesn't do anything for anyone, least of all a company that hoped it would fly under the radar long enough to capitalize fully on a bunch of free photos it found scattered around the internet.

Filed Under: data broker law, facial recognition, privacy, privacy law, vermont
Companies: clearview, clearview ai

Vermont's Revenge Porn Law Ruled Constitutional... With An Incredibly Confused Ruling

from the not-how-it-works dept

Revenge porn -- or, more accurately, "non-consensual pornography" -- is unquestionably bad. We've spent plenty of time mocking the jackasses who have been involved in these awful sites, and have been happy to see them flail around as the stench of their association with these sites sticks.

However, we have not supported the attempts by a small group of legal academics to criminalize running such a site for a variety of reasons. First, such an action would make plenty of protected speech illegal causing massive collateral damage to speech and internet platforms. Second, as we've repeatedly documented, these revenge porn sites don't seem to last very long, and those involved with them have a fairly permanent stain on their reputations. Third, in many cases, the type of people running these sites often seem to have already violated other laws, for which law enforcement is able to go after them.

In recent years, the Supreme Court has made it pretty clear that it has little interest in expanding the categories of speech that are exempted from the First Amendment. I've often pointed to lawyer Mark Bennett's 2014 blog post entitled First Amendment 101 in which he details out the very short list of speech that is not protected by the First Amendment. That post is actually about attempts to outlaw revenge porn and claims that it's not protected by the First Amendment, but the list is a useful one to point to any time anyone suggests that this or that speech shouldn't be subject to the First Amendment.

Some people insist that revenge porn would clearly be exempt from the First Amendment because it's so bad. But they ignore that, in recent years, the Supreme Court has made it clear that such awful content as video depictions of cruelty to animals and picketing military funerals with truly hateful signs is protected under the First Amendment. The Supreme Court has it's very short and narrow list of exceptions, and hasn't shown any indication that it's ready to expand that list.

Indeed, the very same Mark Bennett, earlier this year, helped get a Texas revenge porn law declared unconstitutional, as the court there recognized that the law ran afoul of the First Amendment, in that it was criminalizing a new category of speech not currently exempted, and was unable to survive strict scrutiny, as per the Supreme Court, for any legislation that includes content-based restrictions.

But Mark Bennett is now reasonably perturbed that the Supreme Court of Vermont has decided that that state's revenge porn law is constitutional. And part of the reason he's so perturbed is that the ruling is truly bizarre. It accurately notes that revenge porn does not fall into one of the delineated exceptions to the First Amendment... but (surprisingly) that it still can withstand strict scrutiny:

For the reasons set forth below, we conclude that “revenge porn” does not fall within an established categorical exception to full First Amendment protection, and we decline to predict that the U.S. Supreme Court would recognize a new category. However, we conclude that the Vermont statute survives strict scrutiny as the U.S. Supreme Court has applied that standard.

That's... very strange. Usually, once a court recognizes that something is not in an exempted bucket, it finds the law to be unconstitutional. Here, Vermont is carving new territory. Thankfully, as part of saying that revenge porn is not in an already exempted bucket is a good thing, as it wipes out the incorrect claim by some law professors that you could just say that revenge porn is obscene (which would be very problematic). The court correctly highlights how there are massive differences between what is obscene and what is revenge porn, and notes (correctly again) that the Supreme Court is loathe to expand the definition of obscene:

We recognize that some of the characteristics of obscenity that warrant its regulation also characterize nonconsensual pornography, but we take our cues from the Supreme Court’s reluctance to expand the scope of obscenity on the basis of a purpose-based analysis.

Next, the court (correctly!) says it's in no position to create a new category of exempted speech:

Although many of the State’s arguments support the proposition that the speech at issue in this case does not enjoy full First Amendment protection, we decline to identify a new categorical exclusion from the full protections of the First Amendment when the Supreme Court has not yet addressed the question.

Indeed, the Vermont Supreme Court highlights how frequently the US Supreme Court has been tossing out laws that try to create new categories of unprotected speech:

[W]e decline to predict that the Supreme Court will add nonconsensual pornography to the list of speech categorically excluded. We base our declination on two primary considerations: the Court’s recent emphatic rejection of attempts to name previously unrecognized categories, and the oft-repeated reluctance of the Supreme Court to adopt broad rules dealing with state regulations protecting individual privacy as they relate to free speech.

More than once in recent years, the Supreme Court has rebuffed efforts to name new categories of unprotected speech. In Stevens, the Court emphatically refused to add “depictions of animal cruelty” to the list, rejecting the notion that the court has “freewheeling authority to declare new categories of speech outside the scope of the First Amendment.” 559 U.S. at 472. The Court explained, “Maybe there are some categories of speech that have been historically unprotected, but have not yet been specifically identified or discussed as such in our case law. But if so, there is no evidence that ‘depictions of animal cruelty’ is among them.” Id. A year later, citing Stevens, the Court declined to except violent video games sold to minors from the full protections of the First Amendment. Brown, 564 U.S. at 790-93 (“[N]ew categories of unprotected speech may not be added to the list by a legislature that concludes certain speech is too harmful to be tolerated.”). And a year after that, the Court declined to add false statements to the list. Alvarez, 567 U.S. at 722 (affirming appeals court ruling striking conviction for false statements about military decorations).

More significantly, as set forth more extensively above... in case after case involving a potential clash between the government’s interest in protecting individual privacy and the First Amendment’s free speech protections, the Supreme Court has consistently avoided broad pronouncements, and has defined the issue at hand narrowly, generally reconciling the tension in favor of free speech in the context of speech about matters of public interest while expressly reserving judgment on the proper balance in cases where the speech involves purely private matters. The considerations that would support the Court’s articulation of a categorical exclusion in this case may carry great weight in the strict scrutiny analysis.... But we leave it to the Supreme Court in the first instance to designate nonconsensual pornography as a new category of speech that falls outside the First Amendment’s full protections.

So then why doesn't the court declare this law unconstitutional? Well, that has lawyers like Mark Bennett and Eric Goldman perplexed. To pass "strict scrutiny," the court has to find that the law was passed to further a "compelling government interest" and that the legislation must be "narrowly tailored" to address just the issue for which the government has such a compelling reason.

Here, the court finds that there is a compelling government interest, saying that revenge porn images are not a matter of public concern, and serious harms created by revenge porn make it so that the government has a compelling interest in outlawing such content. Fair enough. But what about the "narrowly tailored" part. That seems like where such a law should fall down, but nope:

Section 2606 defines unlawful nonconsensual pornography narrowly, including limiting it to a confined class of content, a rigorous intent element that encompasses the nonconsent requirement, an objective requirement that the disclosure would cause a reasonable person harm, an express exclusion of images warranting greater constitutional protection, and a limitation to only those images that support the State’s compelling interest because their disclosure would violate a reasonable expectation of privacy. Our conclusion on this point is bolstered by a narrowing interpretation of one provision that we offer to ensure that the statute is duly narrowly tailored. The fact that the statute provides for criminal as well as civil liability does not render it inadequately tailored.

But, of course, the real problem is that all of these laws criminalize tons of content that should otherwise be protected. And here, the court more or less ignores that, by saying that the potentially overbroad nature of the law wasn't raised by the defendant:

The Supreme Court has recognized that in a facial challenge to a regulation of speech based on overbreadth, a law may be invalidated if “a substantial number of its applications are unconstitutional, judged in relation to the statute’s plainly legitimate sweep.” Id. at 473 (quotation omitted). Defendant here does not frame his challenge to the statute as an overbreadth challenge but instead argues that insofar as the speech restricted by the statute is content-based, the statute is presumptively invalid and fails strict scrutiny review.

But, as Mark Bennett highlights, this is the court completely missing that "overbreadth" is the thing you check to see if a statute is "narrowly tailored." But that's not what happened. Here, the court said no one raised the "overbreadth" issue, and thus it doesn't need to bother. So, instead, it says that the law is narrowly tailored based on how the law is written with a "rigorous intent element." But, that's not how the test works. As Bennett explains:

To pass strict scrutiny, a restriction must be narrowly tailored. It is logically impossible for a statute to be both overbroad and narrowly tailored. Strict scrutiny and overbreadth are not separate analyses. If a content-based restriction is substantially overbroad—if it restricts a real and substantial amount of constitutionally protected speech—it is ipso facto not narrowly tailored, and it fails strict scrutiny.

This is a confused mess of a ruling. As Eric Goldman notes, it's possible this could be appealed to the US Supreme Court, though it's unlikely that such a petition would be granted. It does seem likely that eventually this issue would need to be looked over by the Supreme Court to clarify the confusion. But, in the meantime, the law in Vermont stands.

Filed Under: exceptions, first amendment, free speech, protected speech, revenge porn, strict scrutiny, vermont

Vermont State Police Rewrite Press Rules To Withhold As Much Information As Possible

from the close-to-the-vest dept

Various authority figures have attempted to define journalism, usually excluding their critics. A recent post here covered a police chief who decided he could determine a journalist's credibility based almost solely on their web presence. Trimming down the definition of "journalist" allows government officials to limit their accountability by treating only certain outlets as credible.

So, we already have government authorities attempting to define what is or isn't a "real" news outlet. Jonathan Peters of the Columbia Journalism Review reports a government authority is attempting to define what is or isn't news. In this case, it's the Vermont State Police.

It recently revised a “Press Release and Public Information Policy” that provides guidance for police officers regarding how, what, and when information should be given to the press and public. The revisions came in July, and local journalists aren’t happy.

“The policy leaves it up to individual state troopers to determine what is news and what isn’t,” Michael Donoghue, the executive director of the Vermont Press Association, tells CJR. “Crimes, including sexual assaults, armed robberies, arsons, burglaries, embezzlements, drugs, and more are not required to be disclosed. Vermonters want to know if they are safe in their homes and out on the streets.”

The new policy [PDF] prefers ambiguity to clarity and transparency. Worse, it allows officers and police officials to make subjective calls on newsworthiness, which is obviously going to make policing the police that much more difficult. This part is particularly problematic, as it restricts dissemination of information to that which is subjectively defined as "significant public interest."

Press releases will be issued as soon as practicable for significant incidents of public interest, including, but not limited to arrests, citations, road closures, hazardous scenes and motor vehicle crashes.

Beyond that, VSP will withhold all info that "could identify" victims of crimes. This would include those who are on the receiving end of criminal activity by law enforcement officers. As Peters points out, this may nod to privacy, but does very little for public safety. (Not to mention accountability…) This would allow officers to withhold information that might be actually useful to the public, like the areas where repeated criminal activity is being observed.

Even as it places more limits on dissemination, the State Police is playing up its supposed "consultation" with local journalists when revising its policy. That's as much of a sham as the new policy.

While the police say they consulted the press (the state public-safety head wrote in a July letter-to-the-editor that the police “met with and had several discussions with and solicited input from” local journalists), the press association didn’t receive a final draft of the revisions before they were implemented.

Donoghue says the formal consultation amounted to one meeting with two officials. Another press association leader then asked to meet with the public-safety head, who hadn’t attended the meeting except to offer a brief welcome. That request wasn’t granted, and there was no follow-up meeting involving the press.

When asked directly about the changes (and their tendency to make dissemination of information even less likely), the Police spokesman offered up some talking points, but little in the way of clarity. He told Waterman the policy tries to strike a balance between the public's right to know and individual privacy and the integrity of criminal investigations. The spokesman also pointed to the department's 14 press releases a day as evidence that it's all over this transparency thing. But, as is pointed out by the policy's critics, 14 releases a day isn't much when there are more than 300 officers on staff. The VSP issues press releases for things like driving with a suspended license and other misdemeanors. If this minutia is supposed to be evidence of transparency, what are the other 300 officers doing with their time?

The faux consultation and the broad language attempt to disguise the self-interested policy rewriting. Law enforcement agencies are rarely paragons of transparency. The new rules the State Police wrote itself with almost zero consultation will only serve to keep more information out of the public's hands.

Filed Under: foia, police, transparency, vermont

Comcast Sues Vermont, Insists Having To Expand Broadband Violates Its First Amendment Rights

from the defenders-of-the-status-quo dept

So you may have noticed this already, but giant telecom conglomerates don't much like having to upgrade their networks, especially in lower ROI areas. And while that's understandable from a purely-financial perspective, this practice is creating some major, notable broadband deployment holes where poor people tend to live. With telcos specifically refusing to upgrade lagging DSL networks at any real scale, that's also creating an emboldened cable broadband monopoly in many areas. That by proxy keeps prices high, speeds low, and allows the introduction of things like bullshit usage caps and overage fees.

By and large, localized efforts to do something about this generally run face-first into brick walls, thanks in large part to the almost comical stranglehold most ISPs have over state legislatures and regional telecom regulators. In many instances this culminates in ISPs not only refusing to expand their networks into under-served areas, but quite literally writing protectionist state laws to make sure nobody else can, either. This cake and eat it too mentality persists in countless states that have prioritized campaign contributions from the likes of AT&T and Comcast over the general welfare of their public constituents.

Despite the broadband industry consistently whining about "burdensome regulation," the reality is there's little to nothing passing for real oversight in many of these areas, and the regulation that is written -- is often focused primarily on protecting these duopolies' uncompetitive geographical fiefdoms. In Vermont, the Vermont Public Utility Commission (VPUC) recently tried to buck this trend by including provisions in Comcast's 11 year permit (pdf) with the state requiring it to not only retain public access programming in the state, but expand "no less than" 550 miles of additional cable into under-served Vermont communities over 11 years.

To be clear, deploying that much cable over more than a decade is a pittance to a company that sees $21 billion in quarterly revenues. But instead, Comcast decided to sue the state, claiming that doing this extra work violates the company's First Amendment rights:

The VPUC claimed that it could impose the blanket 550-mile line extension mandate on Comcast because it is the "largest" cable operator in Vermont and can afford it. These discriminatory conditions contravene federal and state law, amount to undue speaker-based burdens on Comcast's protected speech under the First Amendment of the United States Constitution... and deprive Comcast and its subscribers of the benefits of Vermont law enjoyed by other cable operators and their subscribers without a just and rational basis, in violation of the Common Benefits Clause of the Vermont Constitution.

ISPs love to trot out the First Amendment complaint wherever and whenever possible, similarly insisting that net neutrality protections somehow curtail their free speech rights (arguments that traditionally don't see much traction in the courts). But Comcast is also busy telling local Vermont news outlets that it's spending money on lawyers instead of more cable because it's just really worried about how much Vermont residents pay for broadband and TV service:

Comcast declined to talk about the case. But in a written statement company spokeswoman Kristen Roberts said the new state permit would, "cost millions of dollars, place discriminatory burdens on Comcast and its customers, and arbitrarily increase their costs for cable service.

While that's very sweet of Comcast, the fact is that Comcast enjoys an effective monopoly over broadband in countless areas; the closest it comes to competition in Vermont being a relatively pathetic telco by the name of Fairpoint Communications. Fairpoint acquired Verizon's unwanted DSL networks in the state several years back, bungled the acquisition, stumbled into bankruptcy, and struggles to offer 3 to 6 Mbps DSL across wide swaths of the state. This is, again, thanks to a generation of lawmakers and regulators that have effectively allowed giant duopolists to write state (and often federal) telecom law.

In a working, competitive market, Comcast wouldn't need to be prodded and cajoled by the state to actually upgrade and expand its network. But there's simply no organic market pressure forcing Comcast's hand because the U.S. telecom market is painfully, obviously broken. As a result, there has been a growing push to explore more creative public/private partnerships to help bring connectivity to long-neglected areas. But Comcast consistently supports laws hamstringing those efforts too, allowing Comcast to have its cake (not deploy broadband) and eat it too (erecting regulatory barriers preventing others from doing so either).

Filed Under: broadband, competition, first amendment, vermont
Companies: comcast

Washington Post Falsely Claims Russia Hacked Vermont Utility, Because OMG RUSSIANS!

from the show-your-math dept

When a mainstream press that isn't always good at what it does meets technology it doesn't understand, the end result is often frustrating, if not comedic. Hacking is certainly no exception, given it's a realm where perpetrators are difficult to identify, hard proof is often impossible to come by, and hackers worth their salt either leave false footprints -- or no footprints at all. Throw in a press that's incapable of identifying and avoiding its own nationalism, and often all-too-gullible to intelligence industry influence, and you've got a fairly solid recipe for dysfunction when it comes to hacking-related news coverage.

Some of the resulting coverage has been highly entertaining -- such as CNN using a screen shot from the popular game Fallout 4 in a story about hacking and hoping nobody would notice. Other examples have been decidedly more troubling, such as the Washington Post's epic face plant over the holiday break.

Last Saturday the Post ran a story claiming that Russia was responsible for the hacking of Burlington Electric, a Vermont utility. According to the original Washington Post story, government sources claimed that code "associated with the Russian hacking operation dubbed Grizzly Steppe" was detected at the utility. The story was stuffed to the gills with all manner of pearl-clutching and outrage among politicians convinced Putin was actively trying to bring down the grid:

“Vermonters and all Americans should be both alarmed and outraged that one of the world’s leading thugs, Vladimir Putin, has been attempting to hack our electric grid, which we rely upon to support our quality-of-life, economy, health, and safety,” Shumlin said in a statement. “This episode should highlight the urgent need for our federal government to vigorously pursue and put an end to this sort of Russian meddling."

Unsurprisingly, the story quickly gained traction in the media, with numerous reports pouring gasoline on the idea that Russia has escalated its cyber offensives to include targeting sensitive American infrastructure. Many broadly speculated that other utilities had been compromised and that we were at the brink of war.And while it's true that the power grid is vulnerable to hackers (increasingly so courtesy of the internet-of-not-so-smart things), it turns out that Putin had nothing to do with the particular "attack" on the Vermont utility. In fact, in a follow up story and corrections made to the original report, the Post ultimately had to acknowledge that the malware in question was only found on one laptop, had nothing to do with the Russian government, and was never actually in contact with the grid itself:

"An employee at Burlington Electric Department was checking his Yahoo email account Friday and triggered an alert indicating that his computer had connected to a suspicious IP address associated by authorities with the Russian hacking operation that infiltrated the Democratic Party. Officials told the company that traffic with this particular address is found elsewhere in the country and is not unique to Burlington Electric, suggesting the company wasn’t being targeted by the Russians. Indeed, officials say it is possible that the traffic is benign, since this particular IP address is not always connected to malicious activity."

That's obviously a pretty far cry from the hysteria bouncing around the news wires as the new year arrived. Thanks, again, to news outlets that are all too eager to take the breathless claims of a few anonymous officials as gospel without doing the heavy lifting required to first ensure the information is useful, or accurate. As it turns out, the Post hadn't even bothered to contact Burlington Electric, which was forced to issue its own statement to the Burlington Free Press clarifying what happened, and making it clear the laptop was never in contact with any electrical system.

All told, Burlington Electric had simply received a notification from Homeland Security sent to all utilities warning them to keep an eye out for particular malware. The company only found the malware and laptop in question after doing a scan off all of the company's systems. And as it turns out, the "Russian malware" in question could have simply been made by a Russian and purchased by anybody. Needless to say, the Washington Post then spent the lion's share of the next few days editing the story, changing the headline repeatedly, and walking back the story's claims.

But most of the stories regurgitating the Post's original claims were never updated or corrected.

Reporting on hacking isn't easy. Disinformation is everywhere, and many outlets continue to illustrate they're easily manipulated, thanks to a nationalism bias they're somehow still unaware of. But the Washington Post simply failed to do even the basics, inflaming notable tensions between two giant countries because it couldn't bother to pick up the phone. Yes, Russia hacks us (and uses propaganda against us and other countries) constantly. The United States does the same. Proof of either is often impossible to come by, but that still doesn't mean it's not required before jumping to conclusions.

As tensions rise facts matter more than ever, and sloppy reporting only fuels those quite intentionally looking to take these often-dangerous and idiotic cyber-offensive policies to an entirely new level.

Filed Under: electrical grid, hacking, journalism, russia, russians, technology, vermont
Companies: burlington electric, washington post

Legislator Thinks Warrantless Cell Phone Searches The Best Way To Combat Distracted Driving

from the BLOWOUT!!!!-ALL-RIGHTS-MUST-GO!!! dept

The Supreme Court's Riley decision made it clear: law enforcement cannot search cell phones without a warrant. Seems pretty straightforward. Cell phones aren't mere "containers" -- they contain a great deal of information that has historically been afforded a reasonable expectation of privacy. Get a warrant.

Rep. Martin LaLonde of Vermont feels this is just too much privacy, especially when there's distracted driving that needs to be punished.

H.527, introduced by Rep. Martin LaLonde, D-South Burlington, would allow law enforcement officers to see a driver's phone or other electronic device, to see if it was being used.

By "see," LaLonde means "look at web activity, text messages, recent phone calls or anything else that might indicate the phone was in use." All without a warrant, and based on nothing more than an officer's suspicion that the driver may have been "distracted."

LaLonde, another legislator who seems to have little grasp of the particulars of his trade (other laws, the Constitution) says this won't be an excuse for police to go "rummaging" through drivers' phones. In support of this assertion, he states that he has no idea what limits will be in place or how any of this will actually work.

[T]he chief sponsor of the bill said he hasn’t “really thought about” what, exactly, would be fair game for a warrantless search under his bill.

Here's a stab at narrowing the search.

“Essentially, it’s ‘show me your text log,’” he said.

Whatever the fuck that is. To figure out whether or not a driver has been texting, the officer will have to look at a few messages. What if the officer comes across a message that sounds like code for a drug deal? Would it be considered "plain sight," what with the law authorizing a quick peek at recent activity?

No man is an island, it has been said. LaLonde may be the exception.

No other state allows warrantless searches to combat phone use while driving.

LaLonde is trying to equate distracted driving with impaired driving. While the tragic outcomes of these two behaviors may be similar, the evidence gathered is worlds apart.

LaLonde said he looked at the precedent of breathalyzer tests. Anyone who drives a vehicle on a highway in Vermont is implied to have given consent to take a breath test if an officer suspects him of driving drunk. Refusing to do so can be introduced as evidence in a criminal proceeding.

Under LaLonde’s bill, a driver who refuses police access to his phone would get the same penalty he’d get if he was, in fact, texting.

The privacy impact of giving police carbon dioxide and giving police access to a cell phone aren't comparable. While the originating actions could both result in criminal charges, only one would allow officers to access a wealth of personal information without a warrant. There's only so much abuse an officer can perform with a breathalyzer. An unlocked phone, though? That's a fishing expedition waiting to happen.

It's not just civil liberty advocates and people with common sense that have problems with LaLonde's proposal. Local law enforcement officials don't seem particularly enamored with the legislation either.

Orange County Sheriff Bill Bohnyak, president of the Vermont Sheriffs Association, said he would support the bill, though he doesn’t want to infringe on anyone’s rights.

Thanks for the 4thA hat tip, Sheriff. That's mighty thoughtful, especially for someone who also heads the local law enforcement union. But why would you support a bill you think might infringe on people's rights? Are you hoping the Supreme Court will reverse its decision in the next few months? Or are you expecting the War on Terrorism to strip away what's left of the Fourth Amendment now that the War on Drugs has had its way with with for four decades?

One of Bohnyak's deputies has his own concerns about the bill… but they're strictly logistic.

Deputy Bariteau, who spends hours patrolling the roads of Orange County looking for distracted drivers, said he’s concerned about some of the practical aspects of LaLonde’s proposal. For example, he said, there are a lot of different phones out there, and officers might not know how to use all of them.

“If you make a law, it’s gotta be enforceable for us,” he said.

Warrantless cell phone searches are pretty much illegal, but the only thing bothering the deputy is that some phones might go unsearched because of a lack of officer skillz.

Finally, LaLonde defends his proposal by offering up the stupidest, most asinine defense of privacy violations: the "I, for one, welcome our new privacy-violating law enforcement overlords" cliche.

“Personally, if I’m in a car and I’ve been text messaging, I should expect narrow privacy,” he said.

Here's an idea: if you expect less privacy, then behave accordingly. Hand over your phone along with your license and registration and sign the search consent form. Enjoy your self-imposed lowered expectation of privacy on a one-to-one basis. Don't forget to ask officers to search your trunk, glove compartment and anus, Rep. LaLonde, because those are all places people have been known to hide contraband and you're certainly not carrying any of that, right? Be the hero Vermont neither wants nor deserves. But don't force it on your constituents.

Filed Under: 4th amendment, distracted driving, martin lalone, mobile phones, searches, vermont, warrants

Police Department Says It Would Rather Have A Good Relationship With The Community Than Cheap Military Gear

from the correctly-ordered-priorities dept

Here's something worth reading: the Burlington, Vermont Police Department has announced it will no longer be participating in the Dept. of Defense's 1033 Program. This program is the well-intentioned effort to somehow make use of excess/old military inventory. Unfortunately, along with desks, computers, file cabinets and other office staples, the government also allows police departments to pick up mine-resistant vehicles, assault rifles, grenade launchers and other military gear -- often at a steep discount that's made even more inexpensive by Homeland Security grants.

The full press release by the says several things those within its jurisdiction need to hear, along with the rest of the nation's law enforcement agencies (via Information Liberation)

The Burlington Police Department announced today that the Department has severed its ties with the much-scrutinized “1033 Program,” a Department of Defense initiative that allows aging military equipment to be repurposed for domestic policing. Until this summer, the Burlington Police Department possessed two military-issued night vision devices, which were the extent of its holdings under the Department of Defense (DOD) program.

“The militarization of local police departments is a genuine concern in our nation,” said Burlington Chief of Police Brandon del Pozo. “There are times when military-style equipment is essential for public safety, but they are very rare. Between our partners in the Vermont State Police and the Vermont National Guard, as well as the other federal and local agencies the Burlington Police Department partners with, we have the resources to handle all but the most inconceivable public safety scenarios. Amassing a worst-case scenario arsenal of military equipment results in officers seeing everyday policework through a military lens. When I realized what a small role the military played in equipping our police, I concluded it was better to return the items and let our 1033 Program memorandum of understanding expire.”

The Burlington Police Department has no plans to acquire tactical or military items beyond the types of conventional policing equipment it already possesses.

Mayor Miro Weinberger offered his support of this decision: “Today’s announcement cements the Burlington Police Department’s long-standing practice of avoiding the use of military equipment, in contrast to many other police departments. Our focus instead is on the basics of good policing in the 21st century: foot patrols, strong relationships between the officers and the community, and the use of modern tools to increase public transparency and police effectiveness."

One thing should be clarified: the 1033 Program is by no means mandatory. "Severing ties" really means just deciding not to participate. The MOU may have expired but it could have run on forever without the PD feeling obligated to order anything from the 1033 catalog.

What's more important are the sentiments expressed by the Burlington police chief. He recognizes that acquiring military gear only leads to a military mindset that turns public servants into an invading force. Even better, del Pozo recognizes that using worst-case scenarios as justification for heavily-armored vehicles and military weaponry is a bullshit tactic. As we've seen time and time again, local law enforcement will claim anything and everything is a "potential terrorist target" just so they can acquire cheap MRAPs and M4A1 rifles. Del Pozo isn't going to take his force down a similar path.

The mayor's vocal support of this decision is a pleasant surprise as well. Mayor Weinberger won't be making himself any friends in other law enforcement agencies after calling them out for their (ab)use of the 1033 program. Hopefully, other agencies will see Burlington's very public opt-out as worthy of emulation. But considering the latest narratives to take hold (Ferguson Effect, War on Cops) both paint police officers as under siege, it's highly doubtful many will recognize the goodwill they could generate simply by treating residents as human beings, rather than enemy combatants.

Filed Under: 1033, burlington, community policing, military equipment, police, relationships, vermont