USAF Colonel: Starbucks WiFi Is More Secure Than The Pentagon Network

from the thanks-a-latte dept

Some of the major issues raised during this NSA debacle have gone beyond the question of if the government should be collecting all of this data on roughly all the people to where this data is stored, what's done with it, and how access to it is controlled.They are big questions, because no matter what you think about the surveillance programs perpetrated against the American people, any inability to secure the information collected by the government should be an automatic deal-killer. So, how secure is data on government systems in general? Eh, go grab a cup of coffee before I tell you.

Because while you're at your local Starbucks, the free WiFi offered to you provides some of your answer, at least according to one US Air Force Colonel in charge of providing legal defense for accused 9/11 conspirators. She says the Pentagon's network wasn't as secure as Starbucks'.

Col Mayberry ordered her team of lawyers to stop putting sensitive documents on that system in April, citing their ethical obligation to protect confidentiality. The lawyers have since been using personal computers to email documents from coffee shops and hotel lobbies. Col Mayberry cited evidence that defence files had been lost or altered, prosecutors and defence lawyers were temporarily given access to some of each other's emails, and outside monitors tracked defence researchers' work as they visited terrorism-related sites to prepare for the case.

"It's not speculative or hypothetical," Col Mayberry said. "It happened."

Well isn't that a kick in the hard drive? The two possibilities, that either defense files were accessed by parties outside of the military or federal government, or that someone within the military and/or government was poking mortar-sized holes in the legal rights of the accused, each present their own frightening problems. But the result is the same. The same government that wants us to accept that information about us should be collected can't secure the systems on which that data is stored enough to protect our rights.

The prosecution predictably slammed the defense team, asking if they weren't "concerned about the nice man in the green apron looking over" their shoulders as they worked. Here's a fun thought experiment. Imagine you're on trial and you have two people to choose from to look at your defense team's information, strategies, etc. One is a barista. The other is a shadow of a profile picture, by which you can't determine who the hell is reviewing this stuff. Which one do you choose? Barista, or mystery avatar?

The point is that a government inept enough to have the kind of laughable security for legal proceedings sure as hell can't be trusted with my phone records. Period, paragraph, end of story.

Filed Under: cafes, defense department, pentagon, security

Twenty-Year-Old Requirement For 'Real-time, Full-time' Eavesdropping On Canadian Mobiles Revealed

from the thanks-to-Mr-Snowden dept

Even if it now seems likely that Linus Torvalds wasn't approached to add a backdoor to Linux, there are plenty of others that were asked and acquiesced, as this story from The Globe and Mail in Canada makes clear:

For nearly two decades, Ottawa officials have told telecommunications companies that one of the conditions of obtaining a licence to use wireless spectrum is to provide government with the capability to monitor the devices that use the spectrum. The Sept. 17 kickoff of the auction-countdown process will underscore that commitment, made out of sight of most Canadians because it is deemed too sensitive by the government.

The secret agreement apparently contains specific details of what telecom companies must provide:

"Real-time, full-time" eavesdropping on conversations is just one of the capabilities sought by police, according to the standards. Authorities also want records of call logs, texts, keystrokes and other data, including "the most accurate geographical location known."

Communications made with encryption provided by the carrier must be decrypted:

Carriers that help their customers scramble communications must decrypt them. "Law enforcement requires that any type of encryption algorithm that is initiated by the service provider must be provided to the law-enforcement agency unencrypted."

No doubt, many people might think phone companies should provide this kind of information, provided a properly executed court warrant is presented. What's problematic here is that this has been going secretly on for 20 years, with no public oversight and with no debate about where to draw the line for such surveillance. That discussion would hardly compromise police operations, but would provide vital transparency and legitimacy. The fact that two decades after the practice started the Canadian people are finally hearing about this capability now is probably yet another beneficial knock-on effect of Edward Snowden's leaks.

Follow me @glynmoody on Twitter or identi.ca, and on Google+

Filed Under: canada, mobile phones, surveillance

How Ruling On WiFi Snooping Means Security Researchers May Face Criminal Liability

from the not-a-good-thing dept

We wrote last week about an appeals court's technologically illiterate ruling that WiFi isn't a radio communication, and therefore picking up unencrypted WiFi data, even though it's broadcast for anyone to access, could be a violation of wiretapping laws. This seemed ridiculous for a variety of reasons, including the fact that part of the reasoning is that radio is supposedly mostly "auditory" (even though it's not).

Over at the EFF, Hanni Fakhoury explains how this ruling could be a disaster for security researchers:

If you're a security researcher in the Ninth Circuit (which covers most of the West Coast) who wants to capture unencrypted Wi-Fi packets as part of your research, you better call a lawyer first (and we can help you with that). The Wiretap Act imposes both civil and serious criminal penalties for violations and there is a real risk that researchers who intentionally capture payload data transmitted over unencrypted Wi-Fi—even if they don't read the actual communications —may be found in violation of the law. Given the concerns about over-criminalization and overcharging, prosecutors now have another felony charge in their arsenal.

There's a fairly big risk here that this interpretation of the law is going to create tremendous chilling effects on research.

Of course, there is a flip side. In theory, this might also mean that police can't scoop up WiFi signals either:

On the other hand, the decision also provides a strong argument that the feds and other law enforcement agencies that want to spy on data transmitted over unencrypted Wi-Fi will need to get a wiretap order to do so. We've seen the government use a device called a "moocherhunter" without a search warrant to read Wi-Fi signals to figure out who's connecting to a particular wireless router. This decision suggests that to the extent the government uses a device like this (or even a "stingray" to the extent it can capture Wi-Fi signals) to capture payload data —even if just to determine a person's location—they'll need a wiretap order to do so. That's good news since wiretap orders are harder to get than a search warrant. 

Still we've seen courts give much greater leverage to law enforcement scooping up communications, so this benefit might not actually be real. The risk and the chilling effects to security researchers, however, is very real. Having seen how often security researchers have been threatened and/or arrested for their research, giving law enforcement another bogus thing to use against them is a huge problem.

Filed Under: encryption, liability, research, security, vulnerabilities, wifi, wifi sniffing

Court Says WiFi Isn't Radio Because It's Not Audio; Therefore WiFi Sniffing Can Be Wiretapping

from the it's-not dept

A couple years ago, we were disappointed to see a judge take the technologically wrong stance that data transmitted over WiFi is not a "radio communication," thereby making sniffing of unencrypted WiFi signals potentially a form of wiretapping. Indeed, based on that, the court eventually ruled that Google's infamous WiFi sniffing could be a violation of wiretap laws. This is wrong on so many levels... and tragically, an appeals court has now upheld the lower court's ruling.

There are serious problems with this. Under no reasonable view is WiFi not a radio communication first of all. That's exactly what it is. Second, sniffing unencrypted packets on an open network is a perfectly normal thing to do. The data is unencrypted and it's done on a network that is decidedly open. It's like saying it's "wiretapping" for turning on your radio and having it catch the signals your neighbor is broadcasting. That's not wiretapping. Third, even the court here admits that based on this ruling, parts of the law don't make any sense, because it renders those parts superfluous. Generally speaking, when a court ruling would render a part of a law completely superfluous, it means that the court misinterpreted the law.

Bizarrely, the court seems to rely on the claim that most radio communications are "auditory" (i.e., involving sound) and thus data transmissions are somehow not radio. Seriously. This statement is so uninformed and flat out wrong that it's kind of shocking the court made it. Specifically the ruling says that the "telltale signs" of "radio communications" are that they're (1) "auditory" and (2) "broadcast" and then says it doesn't even need to consider whether or not WiFi signals are broadcast, since the fact that they're not auditory means they don't even have to consider that fact. Seriously. Read this and try not to bang your head on the nearest desk or wall:

We need not reach the question of what exactly constitutes a "broadcast" because the Wi-Fi transmissions in question were not predominantly auditory.

The court also stumbles badly on the other key question in the lawsuit -- over whether or not these things are "readily accessible to the general public." Again, here, if you know anything about the technology you know without question that broadcasting unencrypted data over an open WiFi network are by definition "readily accessible to the general public." That's how it works and how it was designed to work. But the court says it's not because someone might send something "sensitive" from a secured network to an open WiFi network, and the sender didn't intend for that info to be available via open WiFi. But that gets the calculus totally wrong. First, if I'm sending something "sensitive," it should be encrypted, full stop. Second, the security of the endpoint recipient is the responsibility of that recipient, not the sender, so the whole analogy makes no sense.

Later, the court argues that WiFi isn't readily accessible because the signal is "geographically limited." But, um, again, that's true of just about any radio signal. If I have a low-power transmitter, that's still a radio transmitter. It also claims that it's "difficult" to access unencrypted data on an open network, but that's not true at all. They claim it requires "sophisticated" hardware and software, but that's not actually true, and if you believe it's true, you could basically make the same argument about all kinds of radio transmissions.

Either way, there's a fundamental fact here that the courts don't seem to recognize: when you broadcast unencrypted data on an open network it's there for anyone to access. It seems ridiculous to then claim that it's illegal to access it when it's presented in a manner that more or less cries out "come take a look!" This really feels like a situation where the court looked at what Google did, decided it didn't like it, and then tried to tap dance around reality to make it a violation of the law even though it's almost certainly not a violation.

Filed Under: encryption, radio communications, wifi, wifi sniffing, wiretapping
Companies: google

Latest Snowden Leak Reveals NSA's Ability To Tap Your Mobile Phone

from the no-matter-what-phone-it-is dept

The latest article coming out of Ed Snowden's documents is reported in the German publication Spiegel and details how the NSA is able to access data from basically every popular mobile phone/operating system:

The United States' National Security Agency intelligence-gathering operation is capable of accessing user data from smart phones from all leading manufacturers. Top secret NSA documents that SPIEGEL has seen explicitly note that the NSA can tap into such information on Apple iPhones, BlackBerry devices and Google's Android mobile operating system.

The documents state that it is possible for the NSA to tap most sensitive data held on these smart phones, including contact lists, SMS traffic, notes and location information about where a user has been.

The documents also indicate that the NSA has set up specific working groups to deal with each operating system, with the goal of gaining secret access to the data held on the phones.

The "location" tidbit is particularly interesting, in part because that's one point that Senator Ron Wyden has asked the NSA to discuss repeatedly: whether or not it's tracking people's location info based on their mobile phones, and the NSA has denied that they do (or, rather, indicated that they're not doing that currently).

As for the Blackberry, that's often been pitched because it was supposedly much more secure than other phones -- but the NSA figured out how to get around that. And here's an interesting tidbit: for a little while, they lost access because RIM changed how it encrypted its data:

The documents suggest the intelligence specialists have also had similar success in hacking into BlackBerrys. A 2009 NSA document states that it can "see and read SMS traffic." It also notes there was a period in 2009 when the NSA was temporarily unable to access BlackBerry devices. After the Canadian company acquired another firm, it changed the way in compresses its data. But in March 2010, the department responsible declared it had regained access to BlackBerry data and celebrated with the word, "champagne!"

The documents also state that the NSA has succeeded in accessing the BlackBerry mail system, which is known to be very secure. This could mark a huge setback for the company, which has always claimed that its mail system is uncrackable.

The 2010 cracking of Blackberry data is interesting, because we've noted previously that the NSA had claimed a "major" breakthrough in breaking encryption in 2010. This was first reported by James Bamford a few years ago, and discussed in more detail just last week with the revelation about their encryption hacking efforts. These may have been different breakthroughs, but interesting to see the timing.

Either way, it's yet more confirmation of the capabilities of the NSA to tap into almost anything if it really wants to.

Filed Under: encryption, messages, mobile phone, nsa, nsa surveillance, surveillance

Court Says You Can Be Liable For Merely Sending A Text Message To Someone Who's Driving

from the can-you-here-me-now? dept

We've covered stories stemming from texting and driving issues for quite a while here at Techdirt, typically taking the position that all the clamoring for new laws is needless grandstanding when current laws on the books could be applied readily. That said, at least most of the talk about new legislation has centered around making texting illegal for the person who is driving. You know, the person piloting the huge hunk of metal that can kill people.

But now we could be entering a whole new legal realm, as pixelpusher220 writes in about one New Jersey court's ruling that a person sending texts to someone who is driving may also be liable. Witness a truly new level of insanity, stemming from a case in which two victims of a texting driver sued not only the driver, but the girl sending the driver texts as well.

On Tuesday, a state Appeals Court ruled that the girl in that particular case could not be held liable. But it also ruled “that a person sending text messages has a duty not to text someone who is driving if the texter knows, or has special reason to know, the recipient will view the text while driving.”

Sort of leaves you breathless, doesn't it? Probably because it's monumentally stupid. The reason people accept attempts to make texting while driving illegal, even if the reason is misguided, at least makes some sense. Someone texting while driving can be dangerous to those around them. The act inherently means that the driver is distracted while driving. There's really no way around that. The act, in and of itself, introduces at least some measure of danger to the situation.

Sending texts to someone who is driving, on the other hand, carries none of those inherent risks. Even if I know a friend of mine is en route in the car, why wouldn't I assume that any text I send him or her wouldn't be read once he or she has stopped driving? In the instances where that is exactly what happens, no danger has been introduced. At all. Making that act potentially liable is at once stupid and incredibly pernicious when it comes to the concept of justice. It shifts the liability for the stupid and/or illegal actions of the driver to a secondary party. It's just wrong. And it sounds like New Jersey citizens largely agree.

But the majority of those CBS 2 interviewed found the ruling unfair.

“At the end of the day, you’re basically asking somebody else to be responsible for your own behavior,” said Lauren Burns of Verona. “And you can’t control somebody else’s behavior. You can only control your own behavior.”

When the general public shows more common sense than the judiciary, we have a serious problem.

Filed Under: liability, new jersey, texting while driving

Administration Keeps Chipping Away At The Fourth Amendment; Asks Supreme Court To Allow Warrantless Cell Phone Searches

from the law-enforcement-increasingly-hassled-by-inconvenient-laws dept

Considering what's come out about the NSA's domestic surveillance "accidents," it almost makes you wonder why the government would bother. Surely this information is accessible by other means. In an apparent effort to be thorough in its dismantling of the Fourth Amendment, the administration has asked the Supreme Court to rule that this amendment provides for the warrantless search of cell phones.

Here are the details of the case being argued:

In 2007, the police arrested a Massachusetts man who appeared to be selling crack cocaine from his car. The cops seized his cellphone and noticed that it was receiving calls from “My House.” They opened the phone to determine the number for “My House.” That led them to the man’s home, where the police found drugs, cash and guns.

The defendant was convicted, but on appeal he argued that accessing the information on his cellphone without a warrant violated his Fourth Amendment rights. Earlier this year, the First Circuit Court of Appeals accepted the man’s argument, ruling that the police should have gotten a warrant before accessing any information on the man’s phone.

Now, without getting into the arguments the government raises, not the least of which is that the courts are very divided on the subject, there's the issue of the search itself and the circumstances surrounding it.

The path of least resistance is preferable for both the government and the affected law enforcement agencies. But what we're dealing with here is persons already under arrest. They're not going anywhere, unlike people who have only been "detained." Why is it necessary to bypass the warrant process when you already have the suspect locked up? Even if something appears to be time-critical, there are ways around the process -- like waking up a judge in the middle of the night or using any of the emergency exceptions built into these laws.

Is it really necessary to grant law enforcement the right to search through someone's cell phone without a warrant? It's certainly not a good idea, as cell phones today carry a lot more data than they did back in 2007, when the cell phone in question was a flip-phone that held little more than messages and phone numbers.

The government's selection of this case to press the warrantless search issue is conveniently short-sighted, as Orin Kerr points out at the Volokh Conspiracy

[United States v.] Wurie involved a search in 2007, and the search of the phone was pretty narrow. The First Circuit described the phone as “gray Verizon LG phone,” and it noted that the phone had an “external caller ID screen on the front of the phone” and that had to be opened to be used. In other words, it wasn’t a so-called smartphone.

Kerr suggest the government would have been more helpful in setting precedent by taking a case involving phone hardware as we know it today, like Riley v. California, where an actual smartphone was searched without a warrant. The search in Wurie involved flipping open the phone and scrolling through the call log. The search in Riley was much more involved.

According to the lower court opinion, the officer first “looked at Riley’s cell phone, [and] he noticed all of the entries starting with the letter K were preceded by the letter C, which gang members use to signify ‘Crip Killer.’” It sounds like this was a text search through the phone, although it’s not entirely clear. Second, the officer later “looked through the phone and found some video clips” and “some photographs.” This sounds like a more extensive search through the contents of the phone.

The government and various courts have often compared cell phones to physical objects like address books or diaries. Even when granting the right to do limited warrantless searches of cell phones, the courts have drawn a line between what should be accessed and what shouldn't.

It’s not even clear that we need a rule of law specific to cell phones or other computers. If police are entitled to open a pocket diary to copy the owner’s address, they should be entitled to turn on a cell phone to learn its number. If allowed to leaf through a pocket address book, as they are, United States v. Rodriguez, 995 F.2d 776, 778 (7th Cir. 1993), they should be entitled to read the address book in a cell phone. If forbidden to peruse love letters recognized as such found wedged between the pages of the address book, they should be forbidden to read love letters in the files of a cell phone.

The problem is that the government has apparently cherry-picked a case in order to get the ruling it wants, limiting its arguments to the glorified phone books cell phones once were. And that's a bad idea, as Orin Kerr flatly states:

Reviewing a case with an earlier model phone would lead to a decision with facts that are atypical now and are getting more outdated every passing month.

The last thing this country needs is more outdated laws and rulings -- the kind often misconstrued and broadly applied to cover technological advances not even hinted at, much less imagined by legislators and courts. Giving law enforcement the freedom to warrantlessly search today's phones is roughly equivalent to giving them permission to enter someone's home and search their computer. At least the administration didn't cite the state of Texas' assertion that searching a cell phone is no different than searching through someone's pants.

But, at the end of 105 pages, one has to ask: how hard is it to acquire a warrant to search an arrested person's cell phone? The arguments here seem to indicate that getting a warrant is a nearly insurmountable task when in all reality, it's rarely more than a light hassle. The idea that the Fourth Amendment should be protected and upheld seems to be a non-starter with those advancing this argument. Unfortunately for all of us, it's our own government sacrificing our privacy in order to cut a few corners.

Filed Under: 4th amendment, mobile phones, supreme court, warrantless searches