Category: Privacy

Score One for the Good Guys

No Comments

It looks like the Obama administration has shut down an NSA proposal to continuously monitor huge portions of the internet:

The National Security Agency has pushed repeatedly over the past year to expand its role in protecting private-sector computer networks from cyberattacks but has been rebuffed by the White House, largely because of privacy concerns, according to administration officials and internal documents.

The most contentious issue was a legislative proposal last year that would have required hundreds of companies that provide such critical services as electricity generation to allow their Internet traffic to be continuously scanned using computer threat data provided by the spy agency. The companies would have been expected to turn over evidence of potential cyberattacks to the government.

The National Security Agency has pushed repeatedly over the past year to expand its role in protecting private-sector computer networks from cyberattacks but has been rebuffed by the White House, largely because of privacy concerns, according to administration officials and internal documents.

The most contentious issue was a legislative proposal last year that would have required hundreds of companies that provide such critical services as electricity generation to allow their Internet traffic to be continuously scanned using computer threat data provided by the spy agency. The companies would have been expected to turn over evidence of potential cyberattacks to the government.

While the NSA does good work, their world view, and hence their policy prescriptions, are driven by the fact that they are eavesdroppers.

Basically, they want to make their jobs easier, without any sort of cumbersome review of civil rights protections. It’s the inevitable consequence of who they are and what they do.

Their organizational imperative leads them to support policies that can be described as either totalitarian or sociopathic, which is why care should be taken to ensure that they are the servant, and not the master, of security policy in the United States.

H/t Kevin Drum.

For All You Libertarians Out There, If You Think that Private Enterprise Will Protect You

No Comments

How do you handle the fact that the auto communications company OnStar is going to track all the cars with operational units, and resell the data:

OnStar has begun notifying customers that it may continue to collect and use information about the vehicle even if the customer terminates his or her subscription.

In a privacy notice that will take effect this December, OnStar said that it would collect data as long as a data connection was active, including such details as the location and speed of the vehicle, as well as such fine-grained details as the odometer readings and tire pressure.

The privacy statement lists it as being effective as of Dec. 2011, although the statement also notes that the changes were made to the Jan. 2011 privacy statement.

In the privacy notification, OnStar said that it will share the information it collects with credit card processors and data management companies, as well as roadside assistance providers, emergency services providers, law enforcement, and wireless and satellite service providers.

The data collection can be halted, but OnStar must deactivate the data connection. “Unless the Data Connection to your Vehicle is deactivated, data about your Vehicle will continue to be collected even if you do not have a Plan,” the privacy policy states. “It is important that you convey this to other drivers, occupants, or subsequent owners of your Vehicle. You may deactivate the Data Connection to your Vehicle at any time by contacting an OnStar Advisor.”

Do you have OnStar?  Did you know about the change in the privacy policy?  Do you know whether or not a private individual could hack into your system and track you? 

How about a cop without a warrant?  (It’s still in litigation)

Rupert Murdoch Craps His Pants

No Comments

H/t Calculated Risk for the vid which puts everything in context nicely

In response to revalations that his one of Newscorp’s paper, News of the World, had hacked voice mails of dead soldiers’ families and a missing girl (later found to be murdered), Rupert Murdoch has decided to shutter the 168 year old tabloid:

Beset by a widening phone-hacking scandal, media mogul Rupert Murdoch pulled the plug Thursday on his News of the World, Britain’s best-selling weekly tabloid newspaper, which will shut down after publishing Sunday’s issue.

In a surprise announcement to the paper’s staff, James Murdoch, a top executive of the tabloid’s parent company and son of Rupert Murdoch, said the July 10 paper “will be the last issue of the News of the World.”

The feisty, hugely profitable paper, which has been continuously published for 168 years, “has a proud history of fighting crime, exposing wrong-doing and regularly setting the news agenda for the nation,” James Murdoch said. But those attributes “have been sullied by behavior that was wrong,” he said. “Indeed, if recent allegations are true, it was inhuman and has no place in our company. The News of the World is in the business of holding others to account. But it failed when it came to itself.”

Referring to the phone-hacking scandal, the younger Murdoch, deputy chief operating officer of his father’s News Corp., said the newspaper “failed to get to the bottom of repeated wrongdoing that occurred without conscience or legitimate purpose.” He added, “Wrongdoers turned a good newsroom bad and this was not fully understood or adequately pursued.” He pledged that “those who acted wrongly will have to face the consequences.”

BTW, it’s not just 1 dead girl, it appears that they hacked the phones of parents of some other missing girls.

People have already been arrested, specifically Andy Coulson, former editor in chief of News of the World, and former communications director for British Prime Minister David Cameron, as well as Clive Goodman, their former royal editor, who has been arrested on this matter before.

Additionally, it appears that this scandal has queered the deal that Murdoch had to buy satellite TV provider BSkyB, for the near term at least.


Pass the Popcorn

That being said I don’t think that it’s the business repercussions that have Murdoch running scared, it’s the possibility that he finds it likely that he, son James, could shortly be working in the prison laundry next to Conrad Black.

Heh.

A Win on Civil Rights

No Comments

The Second Circuit Court of Appeals has ruled that a consortium of groups including the ACLU have legal standing to sue over the expansion in wiretapping powers passed in 2008.

The Circuit Court had ruled that unless a plaintiff could prove that they had been secretly wiretapped, they had no standing to sue, and the court has said that they do have standing.  It made no ruling on the merits:

A district judge in Manhattan had thrown out the lawsuit because he said that the plaintiffs failed to demonstrate they were actually spied upon and did not have legal standing to sue. But the Second Circuit Court of Appeals disagreed, allowing the lawsuit on Monday to move forward.

It found that the groups challenging the wiretapping law, including lawyers and journalists communicating with people overseas who might fall under terrorism investigations, had a reasonable fear that their international calls and e-mails would be monitored by the government.

The district court set up a lovely “Catch-22”. You could not challenge the law unless you had proof that you were wiretapped, but the wiretaps are secret, so you couldn’t sue, and so could not use the courts to prove that you were wiretapped.

I expect the Obama administration to use everything but the kitchen sink to stop this suit, but sovereign immunity will be their first bite at the apple.

610 Grand, Not Enough

No Comments

The lawsuit against the Lower Merion school district for spying on children with webcams has been settled for $610,000:

The Lower Merion School District will pay $610,000 to settle lawsuits over its tracking of student laptop computers, ending an eight-month saga that thrust the elite district into a global spotlight and stirred questions about technology and privacy in schools.

School board members voted unanimously Monday night to pay $185,000 to the two students who claimed the district spied on them by secretly activating the webcams on their laptops.

Someone should have gone to jail over all of this.

The fact that there was not a serious criminal investigation of this, with dozens of school officials under scrutiny is a disgrace.

Obama Doubles Down on Bush Policies Again

No Comments

He is proposing mandating a back door in pretty much every form of communication on the internet:

Federal law enforcement and national security officials are preparing to seek sweeping new regulations for the Internet, arguing that their ability to wiretap criminal and terrorism suspects is “going dark” as people increasingly communicate online instead of by telephone.

Essentially, officials want Congress to require all services that enable communications — including encrypted e-mail transmitters like BlackBerry, social networking Web sites like Facebook and software that allows direct “peer to peer” messaging like Skype — to be technically capable of complying if served with a wiretap order. The mandate would include being able to intercept and unscramble encrypted messages.

The bill, which the Obama administration plans to submit to lawmakers next year, raises fresh questions about how to balance security needs with protecting privacy and fostering innovation. And because security services around the world face the same problem, it could set an example that is copied globally.

This would mean that if you had two people communicating handling their own encryption, which a little program called PGP has been doing for decades, they would have to make it illegal.

Obama, a former lecturer on constitutional law, should know better. He is operating under the assumption that because he’s a good guy,* it’s OK for him to have this power, which is, of course completely antithetical to the most basic foundation of the constitution.

Some pertinent quotes:

But as an example, one official said, an investigation into a drug cartel earlier this year was stymied because smugglers used peer-to-peer software, which is difficult to intercept because it is not routed through a central hub. Agents eventually installed surveillance equipment in a suspect’s office, but that tactic was “risky,” the official said, and the delay “prevented the interception of pertinent communications.”

And, of course, there is nothing to prevent these guys from using similar software, and there is already a work around, as the official have admitted.

Even worse is this argument:

Moreover, according to several other officials, after the failed Times Square bombing in May, investigators discovered that the suspect, Faisal Shahzad, had been communicating with a service that lacked prebuilt interception capacity. If he had aroused suspicion beforehand, there would have been a delay before he could have been wiretapped.

Translation:

  • We had that there was a plan afoot.
  • We had no clue that Shahzad was involved with the Taliban.
  • We had no clue that the Taliban was looking at doing anything in the US, though the fact that we are dropping missiles on men, women, and children in their country might give them some motivation.
  • Having this capability would not have allowed us to determine any of the above.
  • However, if we had somehow discovered that this guy was hooking up with terrorists, it would have been easier to wiretap him.

There is also the fact that if you create a back door, it becomes a point of vulnerability for every hacker, crook, terrorist, or despot out there:

Steven M. Bellovin, a Columbia University computer science professor, pointed to an episode in Greece: In 2005, it was discovered that hackers had taken advantage of a legally mandated wiretap function to spy on top officials’ phones, including the prime minister’s.

“I think it’s a disaster waiting to happen,” he said. “If they start building in all these back doors, they will be exploited.”

Why there is such a determination by the Obama administration to embrace and extend every wrong-headed and un-American policy thought up by Bushand His Evil Minions™ is beyond me.

Doubling down on failed and expensive polices does not help.

* To the degree that someone who feels that he can be king and order the murder of American citizens for secret reasons can be considered a “good guy”.

Facebook Founder Completely PWN36* By Facebook Privacy Policy

No Comments

Bummer of a birth mark, Mr. Zuckerberg

I check Facebook every day or soo, and I feed my blog there, albeit imperfectly, so when the came up with a privacy policy update, I didn’t pay too much attention, until I heard lots of people complaining.

Management there said it was no big deal, but then about 300 personal photos of Facebook founder Mark Zuckerberg were made public to the general public:

In a not-uncommon development for the social-networking leader, Facebook’s recently released privacy controls are leaving the company a bit red-faced. As a result of a new policy that by default makes users’ profiles, photos and friends lists available on the web, almost 300 personal photos of founder Mark Zuckerberg became publicly available, a development that had gossip sites like Gawker yukking it up.

Kashmir Hill, a blogger for True/Slant, first reported Zuckerberg’s new exposure, noting, “Either Mark Zuckerberg got a whole lot less private or Facebook’s CEO doesn’t understand the company’s new privacy settings.” Under the new privacy regime, user profiles are exposed to the web unless users are proactive about limiting access.

So, what did Morty make public?

  • His wall
  • His photo albums
  • The fact that he is a Taylor Swift fan
  • Graphic (!?!) photos of “The Great Goat Roast of 2009”
  • The time, date, and location of the Facebook corporate holiday party.

Oopsie.

*Owned.

People Who You Cannot Trust

No Comments
Are They Selling Your Child’s Data to Junk Food Makers or a Child Sex Ring?

The publishers of the software known as nannyware:

A software product sold to protect children from predators, cyberbullying, and visiting inappropriate Web sites is also collecting information about what the kids are saying, and its publisher is selling that data–in aggregate form–to other companies for marketing purposes.

In an interview, Echometrix CEO Jeffrey Greene said that the company doesn’t collect or report the names or any identifying information about the children. “We never, ever, ever can identify who the kid is who is saying it. In fact, we don’t have any information about the individual child,” he said.

Yeah, sure, as has been noted with Netflix, bits apparently innocuous data frequently make it trivial to identify a user.

In the case of Netflix, by knowing a couple of their video likes and dislikes, you could extract their entire video rental history with a probability of 28 standard deviations (99.87% probability, or a bout 1 in 800)

You know, if this were video rental data from adults, as opposed to conversations online by children, this would be illegal.

Homeland Security Suspends Trusted Traveler Program

No Comments

Verified Identity Pass, Inc., which operates the “Clear” program lost 33,000 customers’ records when an unencrypted laptop was stolen.

While it was recovered a week later, what happened to the data is unclear.

Among the data was:

  • Names
  • Addresses
  • Birth dates
  • Driver’s license, passport and green card data

Which one could describe as an “identity theft kit” for 33,000 people, and since the program also collects the following:

  • Credit card information
  • Digital photo
  • Digital images of all of the applicant’s fingerprints and his or her irises
  • Previous home addresses for the past five years
  • Digital images of passports and driver’s licenses.

It could have been much worse.

Security expert Bruce Schneier analyzes this sort of “trusted traveler” program, and finds it wanting from a security standpoint:

I think of Clear as a $100 service that tells terrorists if the F.B.I. is on to them or not. Why in the world would we provide terrorists with this ability?

I Guess You Can’t Help Anyone Without Stomping on Civil Rights These Days

No Comments

Case in point, the housing bailout bill that just passed the Senate creates national fingerprint registry:

Buried in the text of the revised legislation, approved by the Senate Banking Committee by a 19-2 vote this week, is a plan to create a new national fingerprint registry. It covers just about everyone involved in the mortgage business, including lenders, “loan originators,” and some real estate agents.

Lovely.

The War on Privacy

No Comments

The folks at TPM have found another Yoo memo, this one only 37 pages long, and discovered that one of the conclusions there was that the 4th amendment, which protects against “unreasonable search and seizure” did not apply in anti-terror investigations.

Seriously, these guys had no concept as to the rule of law. They really hate everything that out founding fathers worked for.

The memo is no longer in effect, but little known state agencies known as “fusion centers” have been sucking up every bit of personal data they can find:

  • New York and other states also tap into a Federal Trade Commission database with information about hundreds of thousands of identity-theft reports.
  • Pennsylvania buys credit reports and uses face-recognition software to examine driver’s license photos.
  • Rhode Island has access to car-rental databases
  • Maryland, authorities rely on a little-known data broker called Entersect, which claims it maintains 12 billion records about 98 percent of Americans, including cell phone records.

See the ACLU report here.

Well On Our Way to the Police State

No Comments

What is a police state?

I would argue that it is a country in which all rights are sublimated to increasing the capabilities of the state security apparatus to conduct any business that it desires without impediment.

No bothersome warrants, no consideration of the rights of the accused, torture, no privacy, etc.

Cases in point:

  • FBI intends to assemble a massive database of physical characteristics of people, including retinal and iris scans, palm prints, and tattoos.
    • Of course my initial response to the idea of a database of tattoos was, “Why bother. Just tattoo numbers on people’s wrists. It worked so well the last time out.”
  • And then we have some crypto-fascist at DHS who wants to require Real ID cards to track people’s cold medication purchases. I understand that pseudoephedrin can make meth, but this is insane.
  • Of course, in a police state, you have to have massive prisons stuffed to the gills with people, so AG Mukasey wants congress to act because people who got disproportionate sentences under the racist crack laws might will get out earlier under the new sentencing guidelines.
    • Dude, that was the whole idea of changing the guidelines. The disproportionate sentencing was deliberately racist, and demonstrably so, and this is why they want it changed. Rockefeller style drug laws have proved a failure. All it’s left the US with is the greatest proportioned of imprisoned in the world.
  • Finally, we are requiring permission for USA citizens to return to the US.

    Under new regulations and procedures announced to take effect over the next month, citizens of the USA will, for the first time, be required to obtain USA government permission in order to return home to their own country from abroad — from anywhere else in the world, by air or sea or land.

    On no other aspect of the right to travel is international law more clear than on the right of return to the country of one’s own citizenship: “No one shall be arbitrarily deprived of the right to enter his own country.” The new regulations are a flagrant violation of the obligations of the USA as a party to the International Covenant on Civil and Political Rights and other international human rights treaties, as well as a violation of the Constitutional duty of the USA government to treat such treaties as the highest law of the land.

I want my country back.