Spitfire List Web site and blog of anti-fascist researcher and radio personality Dave Emory.

News & Supplemental  

Knock, Knock? Who’s There? Either a Strongbox or a Wall Safe. It’s Undecided.

In this post we’re going to take a look at the recent Supreme Court rul­ing on 4th amend­ment rights and smart­phones and how this rul­ing could impact the ongo­ing debate over NSA spy­ing. We’re also going to look at the oth­er side of the coin: the 5th Amend­ment right against self-incrim­i­na­tion dur­ing a time when encryp­tion tools strong enough to thwart law enforce­ment and the NSA are becom­ing increas­ing­ly main­stream. Is encryp­tion like a strong­box or a wall safe? You might be sur­prised by just how impor­tant that ques­tion has become.

————-

The Supreme Court made an impor­tant, and unan­i­mous, rul­ing recent­ly regard­ing the legal­i­ty of law enforce­ment offi­cers search­ing some­one’s smart­phones dur­ing an arrest. The rul­ing: War­rants are required. The rea­son­ing: Smart­phones con­tain so much infor­ma­tion about peo­ple’s lives that you can poten­tial­ly learn more about an indi­vid­ual by search­ing their smart­phone than you would learn while search­ing their house:

Los Ange­les Times
Supreme Court rul­ing affirms the aston­ish­ing pow­er of smart­phones

Robin Abcar­i­an

June 25, 2014, 2:34 PM

Wednesday’s unan­i­mous Supreme Court rul­ing – that offi­cers must obtain war­rants in order to search cell­phones obtained dur­ing the course of arrests – shows the jus­tices’ pro­found under­stand­ing of the way these ubiq­ui­tous lit­tle devices have prac­ti­cal­ly become appendages of the human body.

Chief Jus­tice John R. Roberts even got a lit­tle car­ried away with that metaphor when he wrote in his enter­tain­ing opin­ion that mod­ern cell­phones “are now such a per­va­sive and insis­tent part of dai­ly life that the prover­bial vis­i­tor from Mars might con­clude they were an impor­tant fea­ture of human anato­my.”

Giv­ing police the abil­i­ty to search a cell­phone with­out a war­rant, the court said, is as offen­sive as the intru­sions that led the birth of this coun­try and the cre­ation of its Con­sti­tu­tion.

The 4th Amend­ment, with its pro­tec­tion against unrea­son­able search­es, Roberts said, “was the found­ing generation’s response to the reviled ‘gen­er­al war­rants’ and ‘writs of assis­tance’ of the colo­nial era, which allowed British offi­cers to rum­mage through homes in an unre­strained search for evi­dence of crim­i­nal activ­i­ty. Oppo­si­tion to such search­es was in fact one of the dri­ving forces behind the Rev­o­lu­tion itself.”

As the chief jus­tice not­ed, today’s smart­phones are not “just anoth­er tech­no­log­i­cal con­ve­nience.” They are indis­pens­able repos­i­to­ries for exceed­ing­ly pri­vate details about an individual’s life.

(How indis­pens­able? He cit­ed one poll in which 3/4 of phone own­ers said they were nev­er more than five feet away from their devices, while 12% admit­ted bring­ing their phones into the show­er with them. That is an image I could have done with­out.)

You can actu­al­ly learn more about a per­son by exam­in­ing their phone, Roberts said, than you can in “the most exhaus­tive search” of a house.

“A phone not only con­tains in dig­i­tal form many sen­si­tive records pre­vi­ous­ly found in the home; it also con­tains a broad array of pri­vate infor­ma­tion nev­er found in a home in any form,” he wrote — unless a smart­phone is also found in the home.

Giv­ing police offi­cers access to a person’s apps — Roberts said the aver­age user has 33 — gives them the abil­i­ty to cre­ate “a reveal­ing mon­tage” of a subject’s life.

...

The court rec­og­nized that its rul­ing may impose a bur­den on law enforce­ment offi­cers at the time of an arrest. But, as Roberts point­ed out, tech­no­log­i­cal advances cut both ways.

In some juris­dic­tions, he said, police offi­cers can email war­rant requests to judges’ iPads, and judges, for their part, have been known to sign war­rants and email them back to offi­cers in less than 15 min­utes.

Not sur­pris­ing­ly, the rul­ing has prompt­ed a great deal of spec­u­la­tion over what it could mean for pend­ing law­suits against the NSA. But if you were expect­ing that this rul­ing sug­gests the the Supreme Court if poised to rule against, say, the NSA col­lec­tion of meta­da­ta you might be dis­ap­point­ed:

Politi­co
SCOTUS cell­phone rul­ing res­onates in NSA fight

By JOSH GERSTEIN | 6/25/14 8:15 PM EDT

The Supreme Court’s blunt and unequiv­o­cal deci­sion Wednes­day giv­ing Amer­i­cans strong pro­tec­tion against arrest-relat­ed search­es of their cell phones could also give a boost to law­suits chal­leng­ing the Nation­al Secu­ri­ty Agency’s vast col­lec­tion of phone call data.

Chief Jus­tice John Roberts’s 28-page paean to dig­i­tal pri­va­cy was like music to the ears of crit­ics of the NSA’s meta­da­ta pro­gram, which sweeps up details on bil­lions of calls and search­es them for pos­si­ble links to ter­ror­ist plots.

“This is a remark­ably strong affir­ma­tion of pri­va­cy rights in a dig­i­tal age,” said Marc Roten­berg of the Elec­tron­ic Pri­va­cy Infor­ma­tion Cen­ter. “The court found that dig­i­tal data is dif­fer­ent and that has con­sti­tu­tion­al sig­nif­i­cance, par­tic­u­lar­ly in the realm of [the] Fourth Amendment…I think it also sig­nals the end of the NSA pro­gram.”

...

For the NSA debate, the most sig­nif­i­cant idea in the court’s Wednes­day opin­ion may be the notion that scale mat­ters. Roberts and his col­leagues sound­ly reject­ed argu­ments from the Oba­ma admin­is­tra­tion that because police can search a few print­ed pho­tographs found in someone’s wal­let, offi­cers were free to search thou­sands of images and the troves of oth­er per­son­al data con­tained on a typ­i­cal smart­phone.

...

“It’s very impor­tant that the court is rec­og­niz­ing that quan­ti­ty mat­ters,” said Geor­gia Tech pro­fes­sor Peter Swire, a pri­va­cy expert and mem­ber of a pan­el Pres­i­dent Barack Oba­ma set up to review the NSA’s call meta­da­ta pro­gram. “The court has said that quan­ti­ty mat­ters when it comes to the con­tent of cell phones. And I believe the court will feel the same way when it comes to mas­sive data­bas­es of tele­phone calls or com­put­er com­mu­ni­ca­tions.”

A for­mer cyber­crime pros­e­cu­tor said the jus­tices also seemed to rec­og­nize that scale of the col­lec­tion not only gives the gov­ern­ment more data, but also the abil­i­ty to be much more intru­sive than in ear­li­er eras.

“The dis­tinc­tion here is more than just the capac­i­ty of the device to hold pic­tures,” said Alex South­well, now with law firm Gib­son, Dunn & Crutch­er. “A cell phone is orders of mag­ni­tude dif­fer­ent, not just in terms of num­bers of items held but also in terms of the intru­sive­ness if searched. The mosa­ic of infor­ma­tion avail­able from see­ing the whole of the data is trans­for­ma­tive, just like the call records at issue in the NSA pro­gram.”

The Supreme Court’s rul­ing Wednes­day in Riley v. Cal­i­for­nia doesn’t say any­thing explic­it­ly about the NSA’s meta­da­ta, nor did the jus­tices men­tion nation­al secu­ri­ty con­cerns or intel­li­gence gath­er­ing.

How­ev­er, in one some­what opaque foot­note to Roberts’s major­i­ty opin­ion, the jus­tices seem to be say­ing they are leav­ing the issue of bulk col­lec­tion of data for anoth­er day. “These cas­es do not impli­cate the ques­tion whether [sic] the col­lec­tion or inspec­tion of aggre­gat­ed dig­i­tal infor­ma­tion amounts to a search under oth­er cir­cum­stances,” Roberts wrote.

Even if the jus­tices were to deem the NSA pro­gram a war­rant­less search that goes well beyond trac­ing calls made on a spe­cif­ic phone line, that wouldn’t mean the ter­ror­ism-focused effort is uncon­sti­tu­tion­al. Instead, the court would have to con­sid­er whether the search is rea­son­able in light of the nation­al secu­ri­ty and pub­lic safe­ty con­cerns involved — and jus­tices are often extra­or­di­nary def­er­en­tial to such argu­ments.

...

Ana­lysts on both sides said the cell phone rul­ing is not a one-off, but seems to be part of a pat­tern of the court’s efforts to square pri­va­cy rights with the new chal­lenges posed by emerg­ing tech­nol­o­gy. Two years ago, in U.S. v. Jones, the jus­tices reject­ed argu­ments that GPS track­ing should not require a war­rant because police have always been free to fol­low sus­pects around with­out get­ting one.

“What’s significant…is the jus­tices, like the rest of us, are ful­ly alive to the fact that tech­nol­o­gy is gen­er­at­ing large quan­ti­ties of data about us and putting it in places where it didn’t used to be,” Bak­er said.

Pres­i­dent Barack Oba­ma ini­tial­ly dis­missed the pri­va­cy impact of the meta­da­ta pro­gram as “mod­est,” but in recent months he has acknowl­edged that it is trou­bling to many Amer­i­cans. Ear­li­er this year, he pro­posed shut­ting down the NSA pro­gram and replac­ing it with one in which tele­phone com­pa­nies store the call infor­ma­tion and make it read­i­ly avail­able for the gov­ern­ment to search. The pres­i­dent also imple­ment­ed a pro­ce­dure in which a judge approves most queries in advance, but the stan­dard is low­er than that for a search war­rant.

The Oba­ma admin­is­tra­tion has made much of safe­guards it has imposed on the NSA pro­gram. How­ev­er, the court’s cell phone search opin­ion sug­gests the jus­tices might not find such self-reg­u­la­tion suf­fi­cient to address pri­va­cy con­cerns.

“The Gov­ern­ment pro­pos­es that law enforce­ment agen­cies ‘devel­op pro­to­cols to address’ con­cerns raised by cloud com­put­ing,” the chief jus­tice wrote. “Prob­a­bly a good idea, but the Founders did not fight a rev­o­lu­tion to gain the right to gov­ern­ment agency pro­to­cols.”

...

As the arti­cle indi­cates, while it’s unclear how direct­ly this rul­ing by the Supreme Court could impact rul­ings on bulk meta­da­ta col­lec­tion, observers on all sides agree that this cell phone rul­ing “is not a one-off , but seems to be part of a pat­tern of the court’s efforts to square pri­va­cy rights with the new chal­lenges posed by emerg­ing tech­nol­o­gy”. And that’s good news because, at the end of the day, the only real solu­tion to these increas­ing­ly dif­fi­cult issues of bal­anc­ing pri­va­cy and secu­ri­ty in an ever chang­ing tech­no­log­i­cal land­scape is a nev­er end­ing cycle of court cas­es, leg­is­la­tion, and lots and lots of peo­ple spend­ing time to real­ly think thought the impli­ca­tions how we progress through the Infor­ma­tion Age.

But as the arti­cle also high­lights, it’s unclear from this rul­ing which way the court is lean­ing on the issue of bulk meta­da­ta col­lec­tion because, as Chief Jus­tice Roberts put it, “these cas­es do not impli­cate the ques­tion whether [sic] the col­lec­tion or inspec­tion of aggre­gat­ed dig­i­tal infor­ma­tion amounts to a search under oth­er cir­cum­stances,” while also assert­ing that “the Gov­ern­ment pro­pos­es that law enforce­ment agen­cies ‘devel­op pro­to­cols to address’ con­cerns raised by cloud computing...Probably a good idea, but the Founders did not fight a rev­o­lu­tion to gain the right to gov­ern­ment agency pro­to­cols.”. What Chief Jus­tice Roberts appears to be allud­ing to is the idea that address­ing issues like this can’t be han­dled by self-reg­u­la­tions and pro­to­cols alone and that seems to sug­gest that Roberts is of the opin­ion that in order to bal­ance the pri­va­cy and secu­ri­ty (in a age where cell phones might hold more per­son­al infor­ma­tion about you than the con­tents of your home) we’re prob­a­bly going to need a pol­i­cy solu­tions and a tech­no­log­i­cal solu­tions. And he’s quite right. When tech­nol­o­gy cre­ates new legal conun­drums, a look at chang­ing the tech­nol­o­gy or chang­ing how it’s used is clear­ly part of the solu­tion.

What Would Snow­den and the Cypher­punks Say?
But, of course, it’s also worth point­ing out that sim­ply say­ing “we need pol­i­cy solu­tions and tech­nol­o­gy solu­tions” is a lot eas­i­er said than done. For instance, take Edward Snow­den’s “pol­i­cy + tech­nol­o­gy” solu­tions that he has con­sis­tent­ly rec­om­mend­ed to glob­al audi­ence. As Snow­den puts it, we need pol­i­cy solu­tions but we also need tech­nol­o­gy solu­tions like unbreak­able end-to-end encryp­tion and the use of sys­tems like TOR to ensure that bulk data col­lec­tion becomes impos­si­ble:

The Inquir­er
Edward Snow­den wants easy to use encryp­tion every­where
Com­mu­ni­ty must do more
By Dave Neal
Mon Mar 10 2014, 18:0

SURVEILLANCE WHISTLEBLOWER Edward Snow­den has tak­en part in a video con­ver­sa­tion at the South By South­west (SXSW) con­fer­ence and called for more acces­si­ble encryp­tion tools.

The sub­ject of the con­ver­sa­tion, which was host­ed by the Amer­i­can Civ­il Lib­er­ties Union, was whether com­mu­ni­ca­tions are secure and if they can be trust­ed. They can, said Snow­den, but only with some third par­ty help and the use of end to end, machine to machine encryp­tion.

The use of strong encryp­tion is key and the pan­el agreed that Snow­den’s rev­e­la­tions have improved the secu­ri­ty land­scape. The whistle­blow­er said that tech­nol­o­gy com­pa­nies need to help make encryp­tion more acces­si­ble and less com­plex. “Encryp­tion does work,” he said, call­ing it “the defence against the dark arts for the dig­i­tal realm.”

Snow­den said that the US Nation­al Secu­ri­ty Agency (NSA) has cre­at­ed an “adver­sar­i­al inter­net”. He added that while pol­i­cy changes are need­ed, tech­no­log­i­cal changes will be the most effec­tive.

“[We must] craft solu­tions that are safe”, he said. “End to end encryp­tion makes bulk sur­veil­lance impos­si­ble. There is more over­sight, and they won’t be able to pitch exploits at every com­put­er in the world with­out get­ting caught.”

...

As Snow­den said, “End to end encryp­tion makes bulk sur­veil­lance impos­si­ble. There is more over­sight, and they won’t be able to pitch exploits at every com­put­er in the world with­out get­ting caught.” So, if Snow­den is cor­rect, we can sim­ply devel­op easy-to-use unbreak­able encryp­tion tech­nol­o­gy and bulk sur­veil­lance will be made impos­si­ble and there­fore all sur­veil­lance will be forced to shift towards tar­get­ed sur­veil­lance where “there is more over­sight”. No more bulk sur­veil­lance but still room for tar­get­ed sur­veil­lance. Prob­lem solved, right?

Well, if the elim­i­na­tion of bulk data col­lec­tion is some­thing that soci­ety wants to pri­or­i­tize then, yes, strong end-to-end encryp­tion and the use of tools like TOR (because strong encryp­tion still won’t actu­al­ly hide all the meta­da­ta, you’d need some­thing like TOR) would indeed force sur­veil­lance to become much more tar­get­ed. Assum­ing a spy­ware­poca­lypse does­n’t take place.

But what about that tar­get­ed sur­veil­lance that Snow­den claims to sup­port? Will that still be pos­si­ble once strong end-to-end encryp­tion tools are made wide­ly avail­able? Well, here’s where it get messy in ways that Snow­den and the Cypher­punks don’t like to talk about and in ways that relate to the Supreme Court’s recent cell­phone rul­ing: Once you have easy-to-use strong encryp­tion tools that make com­mu­ni­ca­tions unbreak­able, it’s prob­a­bly not going to take too long before sim­i­lar tools (or the very same tools) are also used make the local files on your com­put­er strong­ly encrypt­ed too. That means that when there’s a legit­i­mate law enforce­ment or nation­al secu­ri­ty need to view the con­tents of some­one’s com­put­er or smart­phone, a war­rant won’t be enough. The per­son under inves­ti­ga­tion is sim­ply going to have to decrypt the soft­ware or hand over a pass­word under threat of con­tempt of court. And when law enforce­ment has to rely on the per­son being inves­ti­gat­ed to pro­vide access to incrim­i­nat­ing evi­dence, it means we might be see­ing a lot more 5th amend­ment sto­ries like this:

Extreme­Tech
US Appeals court upholds Fifth Amend­ment right to not decrypt hard dri­ves

By Joel Hrus­ka on Feb­ru­ary 24, 2012 at 1:31 pm

The 11th Cir­cuit Appeals Court has issued an impor­tant rul­ing on the ques­tion of whether or not a defen­dant can be forced to decrypt a hard dri­ve when its con­tents could pro­vide addi­tion­al incrim­i­nat­ing evi­dence. The case in ques­tion refers to the actions of a John Doe who was com­pelled to tes­ti­fy before a grand jury in exchange for immu­ni­ty from pros­e­cu­tion. Doe was ordered to decrypt the con­tents of his lap­top as part of that tes­ti­mo­ny, but was told that his immu­ni­ty would not extend to the deriv­a­tive use of such mate­r­i­al as evi­dence against him. Doe refused to decrypt the True­Crypt-locked dri­ves, claim­ing that to do so would vio­late his Fifth Amend­ment right against self-incrim­i­na­tion.
...

Note that this case involves the use of True­Crypt, one of the tools used by Snow­den to encrypt his NSA doc­u­ments that he strong­ly advo­cates (before it mys­te­ri­ous­ly shut down about a week before the Heart­bleed rev­e­la­tions ). Not only can True­Crypt encrypt data in ways that the NSA can’t break, but it also allows you to cre­ate hid­den vol­umes with­in your encrypt­ed vol­umes so if you are asked to hand over the pass­word you can sim­ply give the “fake” top-lay­er pass­word that only decrypts the non-hid­den fold­ers.

Con­tin­u­ing...

...
The 11th Circuit’s rul­ing revers­es the low­er court’s deci­sion to hold Doe in con­tempt and affirms that forc­ing him to decrypt the dri­ves would be unlaw­ful. It also states that the dis­trict court erred in lim­it­ing the immu­ni­ty it grant­ed Doe to only apply to grand jury tes­ti­mo­ny and not the deriv­a­tive use of the evi­dence in ques­tion. The rul­ing on mis­ap­plied immu­ni­ty means that the 11th Cir­cuit could’ve punt­ed on the Fifth Amend­ment issue, but the court opt­ed not to do so.

The applic­a­bil­i­ty of the Fifth Amend­ment rests on the ques­tion of what the gov­ern­ment knew and how it knew it. Fed­er­al pros­e­cu­tors admit­ted at tri­al that while the amount of stor­age encrypt­ed exceed­ed 5TB, there was no way to deter­mine what data was on the hard dri­ve — indeed, if there was any data what­so­ev­er. Plain­tiffs were reduced to hold­ing up numer­i­cal print­outs of encryp­tion code that they said “rep­re­sent­ed” the data they want­ed, but were forced to admit that there was no way to dif­fer­en­ti­ate what might be ille­gal mate­r­i­al vs. legal.

The ques­tion at hand is whether or not decrypt­ing the con­tents of a lap­top dri­ve is tes­ti­mo­ny or sim­ply the trans­fer of exis­tent infor­ma­tion. The court acknowl­edges that the drive’s files are not tes­ti­mo­ny of them­selves, but writes “What is at issue is whether the act of pro­duc­tion may have some tes­ti­mo­ni­al qual­i­ty suf­fi­cient to trig­ger Fifth Amend­ment pro­tec­tion when the pro­duc­tion explic­it­ly or implic­it­ly con­veys some state­ment of fact.” (empha­sis orig­i­nal)

Pre­vi­ous court cas­es have estab­lished that mere­ly com­pelling a phys­i­cal act, such as requir­ing a defen­dant to pro­vide the key to a safe, is not tes­ti­mo­ni­al. Actions are also non-tes­ti­mo­ni­al if the gov­ern­ment can invoke the “fore­gone con­clu­sion” doc­trine by show­ing with “rea­son­able par­tic­u­lar­i­ty” that it already knew that cer­tain mate­ri­als or con­tent exist­ed.

By decrypt­ing the dri­ves, Doe is admit­ting “his knowl­edge of the exis­tence and loca­tion of poten­tial­ly incrim­i­nat­ing files; of his pos­ses­sion, con­trol, and access to the encrypt­ed por­tions of the dri­ves; and of his capa­bil­i­ty to decrypt the files.” The court dis­miss­es the argu­ment that the con­tents of Doe’s hard dri­ves are a fore­gone con­clu­sion, not­ing that “Noth­ing… reveals that the Gov­ern­ment knew whether any files exist or the loca­tion of those files on the hard dri­ves; what’s more, noth­ing in the record illus­trates that the Gov­ern­ment knew with rea­son­able par­tic­u­lar­i­ty that Doe was even capa­ble of access­ing the encrypt­ed por­tions of the dri­ves.

“The Gov­ern­ment has not shown, how­ev­er, that the dri­ves actu­al­ly con­tain any files, nor has it shown which of the esti­mat­ed twen­ty mil­lion files the dri­ves are capa­ble of hold­ing may prove use­ful… we are not per­suad­ed by the sug­ges­tion that sim­ply because the devices were encrypt­ed nec­es­sar­i­ly means that Doe was try­ing to hide some­thing. Just as a vault is capa­ble of stor­ing moun­tains of incrim­i­nat­ing doc­u­ments, that alone does not mean that it con­tains incrim­i­nat­ing doc­u­ments, or any­thing at all.”

Not exact­ly carte blanche

The strength of this deci­sion is the bal­ance it strikes between the rights of the gov­ern­ment and the indi­vid­ual. Rather than focus­ing on the nature of the pass phrase defen­dants are ordered to pro­vide, it empha­sizes the issue of what the pros­e­cu­tion knows and how it learned it. If the pros­e­cu­tors had had suf­fi­cient data to indi­cate that ille­gal mate­ri­als were pstored on Doe’s hard dri­ves, forc­ing him to tes­ti­fy would’ve been valid under the fore­gone con­clu­sion prin­ci­ple.

...

This deci­sion doesn’t make it impos­si­ble for the gov­ern­ment to use the con­tents of an encrypt­ed dri­ve, but it requires that the pros­e­cu­tion demon­strate a knowl­edge of the con­tents and data con­tained there­in before being allowed to issue a blan­ket demand. It’s a fair call, and giv­en the increas­ing num­ber of sim­i­lar cas­es, an impor­tant one.

There’s a lot to digest there: Ok, so it appears that “John Doe” was stay­ing in a hotel room with an inter­net IP addressed that was caught access­ing child porn over YouTube. But it was­n’t the only hotel room with that IP address so it could­n’t be specif­i­cal­ly tied to his com­put­er. The pros­e­cu­tors offer him immu­ni­ty for his tes­ti­mo­ny if he decrypts the True­Crypt-encrypt­ed files on his com­put­er but they don’t offer him immu­ni­ty for the “deriv­a­tive use of such mate­r­i­al as evi­dence against him”. So Doe refus­es to decrypt the dri­ve, cit­ing the 5th amend­ment right against self incrim­i­na­tion. And 11th Cir­cuit Appeals Court argued that:

...
By decrypt­ing the dri­ves, Doe is admit­ting “his knowl­edge of the exis­tence and loca­tion of poten­tial­ly incrim­i­nat­ing files; of his pos­ses­sion, con­trol, and access to the encrypt­ed por­tions of the dri­ves; and of his capa­bil­i­ty to decrypt the files.

The court dis­miss­es the argu­ment that the con­tents of Doe’s hard dri­ves are a fore­gone con­clu­sion, not­ing that “Noth­ing… reveals that the Gov­ern­ment knew whether any files exist or the loca­tion of those files on the hard dri­ves; what’s more, noth­ing in the record illus­trates that the Gov­ern­ment knew with rea­son­able par­tic­u­lar­i­ty that Doe was even capa­ble of access­ing the encrypt­ed por­tions of the dri­ves.
...

In oth­er words, the 11th Cir­cuit appeals court ruled that pro­vid­ing the decryp­tion key is basi­cal­ly a tes­ti­mo­ny that says “yes, I have access to those files” and thus con­sti­tutes a self-incrim­i­nat­ing tes­ti­mo­ny when the gov­ern­ment could­n’t actu­al­ly pro­vide evi­dence that they knew any incrim­i­nat­ing evi­dence was on the dri­ve (since mul­ti­ple hotel rooms shared the same IP). If this seems like a stretch, keep in mind that it’s entire­ly pos­si­ble for some­one to pos­sess a com­put­er or smart­phone that con­tains encrypt­ed files that some­one else put there and con­trols.

Is Encryp­tion Like a Strong­box or a Wall Safe? Who Cares? The Courts
Also keep in mind that the Supreme Court has yet to rule on this case or sim­i­lar cas­es, so a very big Supreme Court rul­ing on forced decryp­tion is just a mat­ter of time:

DuqCrim.com
Crim­i­nal Jus­tice Pro­gram of Duqesne Uni­ver­si­ty School of Law

The catch 22 of forced decryp­tion.
Post­ed by Frank Spinel­li on May 7, 2014 at 7:14 AM

Should forced decryp­tion of a hard dri­ve be pro­hib­it­ed under the Fifth Amend­ment?

Some back­ground: In cryp­tog­ra­phy, encryp­tion is the process of encod­ing mes­sages or infor­ma­tion in such a way that only autho­rized par­ties can read it. Encryp­tion has been around for a very long time, and has his­tor­i­cal­ly been used fre­quent­ly dur­ing wartime.

...

Mean­while, the Fifth Amend­ment states that no per­son, “shall be com­pelled in any crim­i­nal case to be a wit­ness against him­self.” The Fifth Amend­ment is designed to pre­vent the accused from being forced to divulge incrim­i­nat­ing evi­dence from with­in his or her own mind, to be used against him or her self. A per­son may invoke the Fifth Amend­ment once three fac­tor have been estab­lished: com­pul­sion, a tes­ti­mo­ni­al com­mu­ni­ca­tion or act, and incrim­i­na­tion. The law also requires that the infor­ma­tion sought still retain tes­ti­mo­ni­al val­ue, and con­se­quent­ly be worth being con­sti­tu­tion­al­ly pro­tect­ed. The infor­ma­tion sought out can­not already be a for­gone con­clu­sion, which the Gov­ern­ment already con­crete­ly knows, or has proven exists by inde­pen­dent means.

Com­pul­sion, and incrim­i­na­tion are rel­a­tive­ly straight­for­ward where an accused is asked by a court to decrypt a hard dri­ve.

The court is com­pelling the accused to divulge the con­tents that are encrypt­ed in one of two ways. First­ly, by either decrypt­ing the infor­ma­tion by pro­vid­ing the pass­word required to decrypt the infor­ma­tion, enabling author­i­ties to do just the same. Or, sec­ond­ly, by pro­vid­ing the infor­ma­tion sought, in a decrypt­ed and intel­li­gi­ble form.

Incrim­i­na­tion mere­ly refers to the fact that the infor­ma­tion sought to be gained, and com­pelled to be revealed by the accused, is in fact incrim­i­nat­ing.

The issue that is cur­rent­ly unde­cid­ed is whether or not the act of pro­duc­tion, or enabling the decrypt­ing, is tes­ti­mo­ni­al, and whether or not the tes­ti­mo­ni­al sta­tus extends beyond the act of decrypt­ing, to the actu­al con­tents revealed, or decrypted.l

The supreme court has yet to rule on this issue. The high­est court to rule on the issue has pro­vid­ed some inter­est­ing insight regard­ing the issue. The Eleventh Cir­cuit has held that an accused may not be forced to decrypt the files on an encrypt­ed hard dri­ve, due to the nature of encryp­tion.

The court explained that whether an act is tes­ti­mo­ni­al, and is cov­ered by the pro­tec­tions of invok­ing the Fifth Amend­ment, or mere­ly a com­pelled phys­i­cal act, which remains unpro­tect­ed by the Fifth amend­ment, can be best analo­gized to the dif­fer­ence between a strong­box and a wall safe. The court relied on pre­vi­ous Supreme Court deci­sions con­cern­ing the Fifth Amend­ment, point­ing out that the forced pro­duc­tion of a phys­i­cal key to a strong box would not gen­er­al­ly con­sid­ered to be a tes­ti­mo­ni­al act. Where­as, the forced pro­duc­tion of a com­bi­na­tion to a wall safe would be con­sid­ered a pro­tect­ed tes­ti­mo­ni­al com­mu­ni­ca­tion or act, as it requires an accused to reveal a truth from with­in his or her mind. The rev­e­la­tion of which would lead to the pro­duc­tion of incrim­i­nat­ing evi­dence, from with­in the wall safe, or at least sup­port a link in the chain of evi­dence, strength­en­ing the case against the accused. Some­thing that Fifth Amend­ment was specif­i­cal­ly added to the bill of rights to pro­tect against.

For exam­ple, in regards to the pre­vi­ous­ly men­tioned his­tor­i­cal events, hypo­thet­i­cal­ly, an accused per­son would be unable to invoke the Fifth Amend­ment in a case where a court issued a sub­pe­na forc­ing the pro­duc­tion of an enig­ma machine to decrypt a file. This would be anal­o­gous to the phys­i­cal key in the strong­box anal­o­gy, because the act of pro­duc­ing the enig­ma machine, would be requir­ing a phys­i­cal act. How­ev­er, if a court issued a sub­poe­na forc­ing an accused per­son, flu­ent in Nava­jo and Eng­lish, to reveal the con­tents of a file, writ­ten in Nava­jo, it would like­ly be con­sid­ered to be a tes­ti­mo­ni­al act, and pro­tect­ed under the invo­ca­tion of the Fifth Amend­ment. The sec­ond sub­poe­na requires the accused to reveal encrypt­ed infor­ma­tion by uti­liz­ing a men­tal skill, and essen­tial­ly com­pel the pro­duc­tion of encrypt­ed, and incrim­i­nat­ing evi­dence from with­in his or her mind.

Fur­ther­more, because of the nature of encryp­tion, the “fore­gone con­clu­sion” doc­trine is gen­er­al­ly inap­plic­a­ble to infor­ma­tion sought, unless cor­rob­o­rat­ed from oth­er evi­dence, or non-encrypt­ed data on the dri­ve. This is sim­ply because, as the court point­ed out, until a hard dri­ve is decrypt­ed it is usu­al­ly extreme­ly dif­fi­cult to tell what type of file, or files, if any, are being stored on a hard dri­ve until it is decrypt­ed. Con­se­quent­ly, it is gen­er­al­ly not a “for­gone con­clu­sion,” since it is dif­fi­cult to tell if an encrypt­ed hard dri­ve con­tains zero data, or is filled com­plete­ly with encrypt­ed data, as emp­ty space and record­ed data appear gen­er­al­ly the same before decryp­tion. The court there­fore rea­soned that the decrypt­ed infor­ma­tion should also be pro­tect­ed, not just the act of pro­duc­tion of the pass­word, but the decrypt­ed data as well.

Con­se­quent­ly, a broad­er grant of immu­ni­ty would have to be grant­ed, one which extend­ed the data even­tu­al­ly decrypt­ed, not just the act of pro­duc­tion, before a court may com­pel an accused to decrypt data.

The issue remains unclear for now in the oth­er cir­cuits, and most states, until the Supreme Court hears a case con­cern­ing this issue, and rules deci­sive­ly on it.

...

“The issue remains unclear for now in the oth­er cir­cuits, and most states, until the Supreme Court hears a case con­cern­ing this issue, and rules deci­sive­ly on it.” Yep, the issue does remain unclear. But if the Supreme Court is poised to issue a series of rul­ings on pri­va­cy-relat­ed issues it seems pret­ty like­ly that we’re going to see a rul­ing on this top­ic of forced decryp­tion pret­ty soon because the growth in both the num­ber and pop­u­lar­i­ty of encryp­tion tools means 5th amend­ment fights over forced decryp­tion are only going become increas­ing­ly fre­quent. And that means the “Strong­box vs Wall safe” debate is going to become quite a hot top­ic because, as groups like the Cypher­punk-lean­ing Elec­tron­ic Fron­tier Foun­da­tion (EFF) and the ACLU argued last Octo­ber, if you’re ever forced to decrypt your data it is clear­ly a “wall safe” and not a “strong­box” sce­nario and there­fore you should get blan­ket immu­ni­ty for any­thing found:

Threat­post

EFF Makes Case That Fifth Amend­ment Pro­tects Against Com­pelled Decryp­tion
by Michael Mimoso
Octo­ber 31, 2013 , 2:08 pm

With new leaks about the extent of U.S. gov­ern­ment sur­veil­lance com­ing almost dai­ly, one con­stant remains among all the deter­rents to the NSA’s pry­ing eyes: encryp­tion tech­nol­o­gy works. As far as we know, the math behind encryp­tion is sol­id, despite the specter of some unnamed break­through made by the spy agency some years ago.

...

Tan­gen­tial­ly, the gov­ern­ment con­tin­ues to try to make a case for the abil­i­ty to force some­one alleged to have com­mit­ted a crime to decrypt their hard dri­ves and turn over evi­dence. On a num­ber of pre­vi­ous occa­sions, the courts have upheld Fifth Amend­ment pro­tec­tions against self-incrim­i­na­tion in such cas­es.

In a case start­ing on Mon­day in Mass­a­chu­setts Supreme Judi­cial Court, an appeal of a pre­vi­ous deci­sion against Leon Gelf­gatt, 49, of Mar­ble­head, Mass., an attor­ney, was indict­ed in a mort­gage fraud scam in which he is alleged to have stolen more than $1.3 mil­lion. The gov­ern­ment, in try­ing to make its case against Gelf­gatt, tried to com­pel him to decrypt his hard dri­ve. The judge in the case, how­ev­er, denied the request say­ing that such an action would vio­late the Fifth Amend­ment.

Dig­i­tal advo­ca­cy group the Elec­tron­ic Fron­tier Foun­da­tion, along with the Amer­i­can Civ­il Lib­er­ties Union, filed an ami­cus brief yes­ter­day explain­ing the Fifth Amend­ment priv­i­lege against self-incrim­i­na­tion pro­hibits com­pelled decryp­tion. Han­ni Fakhoury, staff attor­ney with the EFF, wrote in a blog­post that the Fifth Amend­ment pro­tects an indi­vid­ual from unveil­ing the “con­tents of his mind” and that the gov­ern­ment through this action would be learn­ing new facts in the case beyond the encryp­tion key.

“By forc­ing Gelf­gatt to trans­late the encrypt­ed data it can­not read into a read­able for­mat, it would be learn­ing what the unen­crypt­ed data was (and whether any data exist­ed),” Fakhoury wrote. “Plus, the gov­ern­ment would learn per­haps the most cru­cial of facts: that Gelf­gatt had access to and domin­ion and con­trol of files on the devices.”

The government’s argu­ment is that the decryp­tion is akin to pro­vid­ing the com­bi­na­tion to unlock a safe, rather than com­pelling the pro­duc­tion of decrypt­ed files.

“That asser­tion is incor­rect,” the brief says. “Just as encrypt­ing a dri­ve encrypts each and every one of its files, decrypt­ing the dri­ve makes avail­able copies of all of its files.” The con­tention is that because the data is trans­formed and scram­bled, decryp­tion is more than a key, safe com­bi­na­tion or pass­word, the brief said.

...

“In the sur­veil­lance envi­ron­ment, the need for encryp­tion is espe­cial­ly strong because it often seems that strong tech­nol­o­gy is our last refuge from the government’s pry­ing eyes,” Fakhoury said. “We’ve seen in all the leaks the government’s effort to under­mine web encryp­tion and so we must make sure they can’t under­mine the phys­i­cal device encryp­tion here.”

So in this case involv­ing $1.3 mil­lion stolen through mort­gage fraud, the gov­ern­ment tried to com­pel the defen­dant to decrypt his data by argu­ing that decryp­tion is anal­o­gous to a hand­ing over a key to a strong­box. But the EFF and ACLU assert the oppo­site, that decryp­tion is an act of reveal­ing a piece of your inner mind and there­fore pro­tect­ed by the 5th Amend­ment. So when the Supreme Court even­tu­al­ly rules in this top­ic, THAT’s one of the key legal dis­tinc­tions it’s going to have to resolve: Is encryp­tion like a strong­box or a wall safe? Wel­come to the fun world of unbreak­able encryp­tion and legal right.

The Mass­a­chu­setts Supreme Court Ruled on that $1.3 mil­lion mort­gage fraud case just days ago. In that instance, the court found, the gov­ern­ment could com­pel decryp­tion. Why? Well, basi­cal­ly because the per­son under inves­ti­ga­tion told the police that he could indeed decrypt the data, but he won’t. So, in this case, court ordered forced decryp­tion was deemed con­sti­tu­tion. But that’s just for Mass­a­chu­setts. Until the US Supreme Court rules on this top­ic, the con­sti­tu­tion­al­i­ty of forced decryp­tion will depend on not only your legal cir­cum­stances, but also your locale:

Ars tech­ni­ca
Mass­a­chu­setts high court orders sus­pect to decrypt his com­put­ers
Sus­pect told cops: “Every­thing is encrypt­ed and no one is going to get to it.”

by Cyrus Fari­var — June 25 2014, 7:00pm CST

Mass­a­chu­setts’ top court ruled, in a 5–2 deci­sion on Wednes­day, that a crim­i­nal sus­pect can be ordered to decrypt his seized com­put­er.

The Mass­a­chu­setts Supreme Judi­cial Court (MSJC) rul­ing only applies to the state. Var­i­ous oth­er courts at the state and fed­er­al lev­el have dis­agreed as to whether being forced to type in a decryp­tion pass­word is a vio­la­tion of the Fifth Amend­ment right to pro­tect against self-incrim­i­na­tion and its state equiv­a­lents (such as Arti­cle Twelve of the Mass­a­chu­setts Dec­la­ra­tion of Rights). For exam­ple, more than two years ago, the 11th Cir­cuit Court of ruled ruled that a defen­dant was not oblig­ed to decrypt his hard dri­ve, as doing so would vio­late his Fifth Amend­ment rights. How­ev­er, that rul­ing only took effect in the 11th Cir­cuit, which cov­ers parts of the south­east­ern Unit­ed States. Just last year, a fed­er­al judge refused to force a Wis­con­sin child pornog­ra­phy sus­pect to decrypt his lap­top. Over­all, cas­es involv­ing decryp­tion are still rel­a­tive­ly new and rare. The first known one only dates back to 2007.

Pri­va­cy advo­cates lament­ed the MSJC’s new rul­ing, dis­agree­ing with the court’s judg­ment that an excep­tion to the Fifth Amend­ment rule, such as a “fore­gone con­clu­sion,” applies here.

“The defen­dant is only telling the gov­ern­ment what it already knows”

hori­ties that he was able to decrypt his com­put­ers but would not do so.

As the MSJC ruled:

Dur­ing his postar­rest inter­view with State police Troop­er Patrick M. John­son, the defen­dant stat­ed that he had per­formed real estate work for Bay­lor Hold­ings, which he under­stood to be a finan­cial ser­vices com­pa­ny. He explained that his com­mu­ni­ca­tions with this com­pa­ny, which pur­port­ed­ly was owned by Russ­ian indi­vid­u­als, were high­ly encrypt­ed because, accord­ing to the defen­dant, “[that] is how Rus­sians do busi­ness.” The defen­dant informed Troop­er John­son that he had more than one com­put­er at his home, that the pro­gram for com­mu­ni­cat­ing with Bay­lor Hold­ings was installed on a lap­top, and that “[e]verything is encrypt­ed and no one is going to get to it.” The defen­dant acknowl­edged that he was able to per­form decryp­tion. Fur­ther, and most sig­nif­i­cant­ly, the defen­dant said that because of encryp­tion, the police were “not going to get to any of [his] com­put­ers,” there­by imply­ing that all of them were encrypt­ed.

When con­sid­er­ing the entire­ty of the defen­dan­t’s inter­view with Troop­er John­son, it is appar­ent that the defen­dant was engaged in real estate trans­ac­tions involv­ing Bay­lor Hold­ings, that he used his com­put­ers to alleged­ly com­mu­ni­cate with its pur­port­ed own­ers, that the infor­ma­tion on all of his com­put­ers per­tain­ing to these trans­ac­tions was encrypt­ed, and that he had the abil­i­ty to decrypt the files and doc­u­ments. The facts that would be con­veyed by the defen­dant through his act of decryption—his own­er­ship and con­trol of the com­put­ers and their con­tents, knowl­edge of the fact of encryp­tion, and knowl­edge of the encryp­tion key—already are known to the gov­ern­ment and, thus, are a “fore­gone con­clu­sion.” The Com­mon­wealth’s motion to com­pel decryp­tion does not vio­late the defen­dan­t’s rights under the Fifth Amend­ment because the defen­dant is only telling the gov­ern­ment what it already knows.

A step back for pri­va­cy

Because Gelf­gatt already admit­ted to police that he owned and con­trolled the seized com­put­ers and had the abil­i­ty to decrypt them, the court found that the act of decryp­tion would not reveal any­thing new to the police. There­fore, the act of com­pelled decryp­tion was not “tes­ti­mo­ni­al.” Nor­mal­ly, the Fifth Amend­ment priv­i­lege pre­vents the gov­ern­ment from forc­ing a wit­ness to dis­close incrim­i­nat­ing infor­ma­tion in his mind (like a pass­word not writ­ten down any­where else)—but only if that is infor­ma­tion the police do not already know.

Jessie Ross­man, an attor­ney with the Amer­i­can Civ­il Lib­er­ties Union of Mass­a­chu­setts, told Ars that her orga­ni­za­tion is “dis­ap­point­ed in the deci­sion.”

“For exam­ple, an indi­vid­ual can be forced to hand over a key to a locked safe if the gov­ern­ment already knows that’s your safe—the doc­u­ments in there have already been cre­at­ed,” she said.

“Your open­ing that safe, the doc­u­ments are already there. That’s not new tes­ti­mo­ni­al. But encrypt­ed data needs to be trans­formed into some­thing new when decrypt­ed. A num­ber of encrypt­ed tech­nol­o­gy works such that when you look at [a hard dri­ve] you can’t even tell what is emp­ty space or what is not emp­ty space. When you decrypt that com­put­er it’s cre­at­ing some­thing new and if you didn’t have any knowl­edge, the act of decrypt­ing tells you some­thing you didn’t know before­hand. We believe that the Fifth Amend­ment and Arti­cle 12 needs to pro­tect not only the act of enter­ing a code but the act of pro­duc­ing decrypt­ed files to the gov­ern­ment.”

...

Fred Cate, a law pro­fes­sor at Indi­ana Uni­ver­si­ty, told Ars that this rul­ing could come with an unfor­tu­nate con­se­quence. If some­one admits to own­ing a com­put­er and asserts that they pos­sess the pass­word, “its only like­ly effect is to encour­age future defen­dants to be less forth­com­ing with police.”

“This seems to be an issue like­ly to head to the Supreme Court where, despitetoday’s sweep­ing 9–0 vic­to­ry for pri­va­cy involv­ing search­es of cell­phones, the out­come is not at all cer­tain,” he added. “His­tor­i­cal­ly, the high court has tak­en a dim view of efforts to expand the Fifth Amend­ment priv­i­lege against self-incrim­i­na­tion or to apply it in nov­el ways. In the mean­time, we should expect to see both fed­er­al and state courts con­tin­u­ing to reach diver­gent results when faced with this impor­tant ques­tion.”

As sug­gest­ed at the end, “this seems to be an issue like­ly to head to the Supreme Court where, despitetoday’s sweep­ing 9–0 vic­to­ry for pri­va­cy involv­ing search­es of cell­phones, the out­come is not at all cer­tain.” Should that uncer­tain­ty be sur­pris­ing? Well, we aren’t just look­ing at the emer­gence of a new tech­no­log­i­cal phe­nom­e­na (pock­et-sized com­put­ers) requir­ing a review of 4th amend­ment right. We’re real­ly look­ing at the inter­sec­tion of two inter­twined tech­nolo­gies. Until the last decade or so, you did­n’t have peo­ple car­ry­ing around a home­’s worth of per­son­al­ly reveal­ing (and poten­tial­ly incrim­i­nat­ing) infor­ma­tion in your pock­et. And yet, as the arti­cle points out, pre-2007 we did­n’t real­ly see cas­es involve court-forced decryp­tion where which is to be expect­ed since strong encryp­tion is noto­ri­ous­ly non-user-friend­ly. And the Supreme Court’s recent rul­ing on the 4th Amend­ment did­n’t real­ly address the issue of forced decryp­tion at all, so yes, quite a bit of uncer­tain­ty should be prob­a­bly be expect­ed in the area.

At the same time, notice the over­whelm­ing­ly neg­a­tive respons­es to this Mass­a­chu­setts Supreme Court rul­ing by groups like the ACLU and EFF even when the defen­dant basi­cal­ly tells the police that, yes, the encrypt­ed dri­ves are his and, yes, he can decrypt them. So one thing we can prob­a­bly be pret­ty sure of is that this issue is going to be con­tentious for a long long time and the debate over forced encryp­tion is only going to grow. In sit­u­a­tions like this where there isn’t a clear ‘right’ and ‘wrong’ but instead a dif­fi­cult bal­anc­ing of pri­or­i­ties, a drawn out fight is pret­ty much guar­an­teed.

So get ready for more Supreme Court rul­ings on these top­ics. But also get ready for more con­fus­ing debates over “what did the gov­ern­ment know and when did they know it” and a far more detailed exam­i­na­tion of the dis­tinc­tions between strong­box­es and wall safes than you ever expect­ed to endure. Is decryp­tion “an act of pro­duc­tion” war­rant­i­ng 5th Amend­ment pro­tec­tions or just “a phys­i­cal act”? We’ll find out!

But the fact that these strange­ly nuanced legal dis­tinc­tion have to be made in the first place is actu­al­ly a great exam­ple of the sys­tem work­ing. Life is com­plex and the law should reflect that com­plex­i­ty. And as tech­nol­o­gy pro­gress­es those com­plex­i­ties are only going to grow so this is the kind of legal morass that we should be some­what pleased to see emerg­ing. That legal morass is a reflec­tion of a real­i­ty morass and it has to be tack­led. Tack­led over and over as tech­nol­o­gy changes. But that legal morass is also a strong reminder that the pri­va­cy, secu­ri­ty, and ever-chang­ing tech­nol­o­gy is far more com­plex than the ver­sion of real­i­ty pre­sent­ed by Edward Snow­den and his allies like the EFF.

Much of the acco­lades giv­en to the Supreme Court’s recent rul­ing is about how it for­mal­ized a recog­ni­tion that the scale of tech­nol­o­gy can qual­i­ta­tive­ly change its nature and neces­si­tate a legal rebal­anc­ing of pri­va­cy and secu­ri­ty. The sim­ple cell­phones of yes­ter­year are quite dif­fer­ent from the smart­phones of today. As the Supreme Court put it, search­ing some­one’s cell­phone might be more infor­ma­tive than search­ing their home. That’s an impor­tant recog­ni­tion because if tech­nol­o­gy sud­den­ly allows us all to walk around with a home­’s worth of per­son­al infor­ma­tion in our pock­ets we prob­a­bly don’t want to allow full access to that when some­one is sim­ply under arrest. But as we saw with tools like True­Crypt, if our smart­phones are homes, they’re increas­ing­ly homes that can­not be entered at all by law enforce­ment with­out the per­mis­sion of the home own­er regard­less of cir­cum­stance because it will be math­e­mat­i­cal­ly impos­si­ble (and maybe phys­i­cal­ly impos­si­ble some­day).

If a court issues a war­rant to allow a search of your home, some­one is going to search your home whether want to let them in or not. Phys­i­cal­ly impen­e­tra­ble homes aren’t phys­i­cal­ly pos­si­ble. But impen­e­tra­ble smart­phones via encryp­tion, on the oth­er hand, are now being aggres­sive­ly devel­oped and pro­mot­ed (by Ger­many) in the post-Snow­den era for use by the mass­es (although they’ll still pre­sum­ably be hack­able by the BND or whichev­er gov­ern­ment spon­sors them).

Sure, you can still be sent to jail for con­tempt of court if you refuse to com­ply with a valid court order to decrypt, but that just means that the jail time for con­tempt of court could now sud­den­ly become a much more avail­able legal option in a grow­ing num­ber of cas­es for peo­ple fac­ing far more seri­ous crimes. And don’t for­get that peo­ple can be assigned the role of the data mule or data ‘fall guy’ in a larg­er crim­i­nal orga­ni­za­tion. That might be a lot eas­i­er to do going for­ward. We should still pri­or­i­tize pro­tect­ing our 4th Amend­ment rights, but we should also rec­og­nize the new real costs that arise when pro­tect­ing them as we’re forced to adapt those legal pro­tect­ing to chang­ing tech­no­log­i­cal land­scapes. Strong encryp­tion is an incred­i­bly use­ful tool, for good or ill. And that means strong encryp­tion is going to lead to new costs in pro­tect­ing those rights at the same time that it’s being used in help­ful ways. It is what it is.

Beware of Lib­er­tar­i­ans Bear­ing Non-Solu­tions
So let’s be relieved that the Supreme Court is intent on tack­ing the increas­ing­ly com­plex issues sur­round­ing pri­va­cy, secu­ri­ty, and tech­nol­o­gy because the legal ambi­gu­i­ty on these issues is only going to grow. Unbreak­able encryp­tion is just a mat­ter of time because it already exists. Edward Snow­den may have dra­mat­i­cal­ly accel­er­at­ed strong encryp­tion’s adop­tion, but it was just a mat­ter of time before some encryp­tion “killer app” brought strong encryp­tion for both data trans­mis­sions and local data stor­age to the mass­es. These super-encryp­tion tools were already grow­ing in pop­u­lar­i­ty long before Snow­den came along and turned the glob­al focus onto them. Some sort of legal clar­i­ty was going to be nec­es­sary soon­er or lat­er.

And let’s also be relieved that the recent 4th amend­ment rul­ing sig­ni­fies that the Supreme Court jus­tices are keen­ly aware that changes in the scope and capac­i­ty of tech­nol­o­gy can neces­si­tates sig­nif­i­cant rethink­ing in how soci­ety estab­lish­es the rules and safe­guards for both the tech­nol­o­gy itself and that ever-chang­ing tech­nol­o­gy inter­faces with our nev­er-chang­ing human sit­u­a­tion of all hav­ing to live togeth­er under uni­form set of laws. It was a great rul­ing on the 4th that was over­due.

But with tools like True­Crypt and Tor becom­ing increas­ing­ly pop­u­lar, let’s not be relieved about the fact that folks like Edward Snow­den, Julian Assange, Jacob Appel­baum, and the rest of Cypherpunk/Cyberlibertarian move­ment have large­ly seized con­trol of the inter­na­tion­al debates over these issues. Bal­anc­ing pri­va­cy, secu­ri­ty, and tech­nol­o­gy is tough enough as is and it’s only going to get more and more com­pli­cat­ed. That’s why you don’t want extrem­ist ide­olo­gies dom­i­nat­ing the debate. The Cypher­punks make many valid points when high­light­ing the dan­gers of a creep­ing tech­nol­o­gy-enabled sur­veil­lance states (it’s not hard). But Snow­den and the Cypher­punks also casu­al­ly dis­miss or ignore the dark­er impli­ca­tions of the solu­tions they sug­gest.

If soci­ety wants to go down the path of adopt­ing ubiq­ui­tous unbreak­able encryp­tion and tools that allow for lay­ers and lay­ers of “hid­den vol­umes” along with gen­er­ous 5th Amend­ments inter­pre­ta­tions that give blan­ket immu­ni­ty for forced decryp­tion, well, ok, soci­ety should have the right to go down that path. And it might even be the best path over­all. We’ll find out because it’s kind of inevitable that super encryp­tion goes main­stream. But we should at least be try­ing to pre­dict the neg­a­tive impli­ca­tions that come with going down that path and you don’t see any real attempts to do that by the move­ments that are cur­rent­ly dom­i­nat­ing the glob­al debate. That’s pre­car­i­ous.

It’s true that Edward Snow­den and the Cypher­punks says things like “not all spy­ing is bad” and things like “we need both pol­i­cy solu­tions and tech­ni­cal solu­tion”, but that’s about it. The rest of what he’s been advo­cat­ing is large­ly a Cyper­punk agen­da that makes pol­i­cy solu­tions moot. Let’s take anoth­er quick look at Snow­den’s sug­ges­tions at the SXSW fes­ti­val:

Wired
Edward Snow­den Urges SXSW Crowd to Thwart NSA With Tech­nol­o­gy

By Kim Zetter
03.10.14 |
3:48 pm

With law­mak­ers slow to pass leg­is­la­tion curb­ing NSA sur­veil­lance, it’s up to the tech­nol­o­gy com­mu­ni­ty to step in and devise solu­tions that will bet­ter pro­tect online com­mu­ni­ca­tions from snoops, said Edward Snow­den, speak­ing today from Moscow at the South by South­west con­fer­ence in Austin.

“[T]he peo­ple who are in the room at Austin right now, they’re the folks who can real­ly fix things, who can enforce our rights for tech­ni­cal stan­dards even when Con­gress hasn’t yet got­ten to the point of cre­at­ing leg­is­la­tion that pro­tect our rights in the same man­ner…,” he said. “There’s a pol­i­cy response that needs to occur, but there’s also a tech­ni­cal response that needs to occur. And it’s the mak­ers, the thinkers, the devel­op­ing com­mu­ni­ty that can real­ly craft those solu­tions to make sure we’re safe.”

The mas­sive sur­veil­lance being done by the NSA and oth­er gov­ern­ments has cre­at­ed “an adver­sar­i­al inter­net,” he said, “a sort of a glob­al free-fire zone for gov­ern­ments, that’s noth­ing that we ever asked [for]; it’s not what we want­ed. It’s some­thing we need to pro­tect against….

“[T]hey’re set­ting fire to the future of the inter­net. And the peo­ple who are in this room now, you guys are all the fire­fight­ers. And we need you to help us fix this.”

One solu­tion he high­light­ed, that would make it more dif­fi­cult for the U.S. and oth­er gov­ern­ments to con­duct pas­sive sur­veil­lance, is the imple­men­ta­tion of end-to-end encryp­tion that would pro­tect com­mu­ni­ca­tions from user to user, rather than as it’s cur­rent­ly done by Google and oth­er ser­vices, which only encrypt the com­mu­ni­ca­tion from user to ser­vice, leav­ing it vul­ner­a­ble to col­lec­tion from the ser­vice provider.

“End-to-end encryp­tion … makes mass sur­veil­lance impos­si­ble at the net­work lev­el,” he says, and pro­vides a more con­sti­tu­tion­al­ly pro­tect­ed mod­el of sur­veil­lance, because it forces the gov­ern­ment to tar­get the end­points — the indi­vid­ual users — through hack­ing, rather than con­duct mass col­lec­tion.

...

End-to-end encryp­tion … makes mass sur­veil­lance impos­si­ble at the net­work lev­el,” he says, and pro­vides a more con­sti­tu­tion­al­ly pro­tect­ed mod­el of sur­veil­lance, because it forces the gov­ern­ment to tar­get the end­points — the indi­vid­ual users — through hack­ing, rather than con­duct mass col­lec­tion.

That’s the claim made over and over by Snow­den: if we just all imple­ment end-to-end strong encryp­tion than the gov­ern­ment will just tar­get indi­vid­ual users “through hack­ing”. So it will be hard­er for the gov­ern­ment to spy on indi­vid­u­als, but not impos­si­ble. But as we’ve seen, there’s real­ly no way to “hack” strong­ly-encrypt­ed local­ly stored data. Espe­cial­ly if it’s in a hid­den vol­ume that can’t be detect­ed. And then there’s the fact that much of Snow­den’s leaks have revealed have been tar­get­ed sur­veil­lance meth­ods.

Snow­den’s words have enor­mous influ­ence on these top­ics and, unfor­tu­nate­ly, that means the glob­al pol­i­cy debate that needs to emerge in response to ubiq­ui­tous super encryp­tion tech­nol­o­gy is start­ing off in a warped man­ner. We get end­less debates over whether or not meta­da­ta col­lec­tion helps stop ‘ter­ror’ and yet, as we also saw above, it was­n’t ter­ror­ism that peo­ple were using strong encryp­tion to car­ry out. It was every­day crimes. This isn’t just about ter­ror­ism and the abuse of gov­ern­ment pow­er.

So we real­ly have to keep ask­ing our­selves if the anti-NSA back­lash is going to used by folks with a lib­er­tar­i­an agen­da to weak­en the gov­ern­ment in ways that go far beyond bulk sur­veil­lance. If we accept the the lib­er­tar­i­an assump­tion that gov­ern­ment sim­ply can’t work, the kind of bal­ance even­tu­al­ly struck on issues like the 4th and 5th amend­ments may results in the kind of soci­ety where things like legit­i­mate law enforce­ment increas­ing­ly can’t work too. Is that part of the agen­da? It sure would fit the cur­rent anti-gov­ern­ment fever afflict­ing an increas­ing­ly far-right GOP. Just imag­ine the kinds of cor­po­rate abus­es that could be enabled with end-to-end encryp­tion, “hid­den vol­umes”, and the kind of 5th Amend­ment inter­pre­ta­tion that basi­cal­ly views any forced decryp­tion as a vio­la­tion of the 5th Amend­ment.

These lurk­ing dan­gers are one of the rea­sons why the Supreme Court’s 4th Amend­ment rul­ing was great but it was also only part of the over­all solu­tion to bal­anc­ing pri­va­cy and secu­ri­ty in this cur­rent­ly tech­no­log­i­cal envi­ron­ment. Now that strong encryp­tion for the mass­es is becom­ing a real­i­ty, a 5th Amend­ment rul­ing on forced decryp­tion is going to be need­ed too before we can real­ly assess to the new legal land­scape. And as we saw above, that’s not an easy or obvi­ous ruling...not near­ly as easy as this 4th amend­ment case. In fact, it looks pret­ty dif­fi­cult. Is encryp­tion like a strong­box or wall safe? What a strange con­cept to have legal immu­ni­ty hinge upon.

But anoth­er rea­son we need to be on guard against an anti-NSA back­lash mor­ph­ing into an attack on the legit­i­ma­cy of gov­ern­ment is because the ‘Lit­tle Broth­er’ sur­veil­lance state that every­one wants to live in — and it’s not just lib­er­tar­i­ans desire that — might require a ‘Big Help­ful Broth­er’ gov­ern­ment for fix­ing the kinds of big prob­lems that don’t get fixed on their own or by “the mar­ket” or char­i­ty. And that means *gasp* build­ing a gov­ern­ment you can trust and that’s empow­ered to get things done! Not the lib­er­tar­i­an vision of a gov­ern­ment that you can trust because it’s been sys­tem­at­i­cal­ly dis­em­pow­ered, but a real demo­c­ra­t­i­cal­ly elect­ed gov­ern­ment that does­n’t accept pover­ty or oppres­sion in any form and does­n’t sim­ply wait for the pri­vate sec­tor to fix those prob­lems.

We can’t rely on tech­nol­o­gy as shield against bad pol­i­cy or bad gov­ern­ments. If we’re going to get seri­ous about address­ing the weird and ever more exot­ic threats fac­ing for soci­ety one of the most pow­er­ful tools for pro­tect­ing our pri­va­cy is, quite sim­ply, a high­ly com­pe­tent soci­ety. Com­pe­tent in the sense that it’s a soci­ety that is active­ly engaged in learn­ing about the threats around it, emerg­ing and exist­ing threats, while also being sane enough to deal with these threats in a man­ner that does­n’t lead to some sort of night­mare sit­u­a­tion. That’s how we pro­tect our pri­va­cy most effec­tive­ly: by iden­ti­fy­ing and solv­ing the kinds of open­ly vis­i­ble prob­lems like pover­ty and oppres­sion that encour­age indi­vid­u­als to secret­ly engage in ter­ror­ism or harm­ful crimes. There’s sim­ply going to be less dan­ger to look out for the more we make a bet­ter world.

But we’re not going to be able to build that com­pe­tent soci­ety capa­ble of help­ing if the only gov­ern­ments we can trust are those with­out the pow­er to harm. Gov­ern­ment, it turns out, is a lot like tech­nol­o­gy: Gov­ern­ments with the pow­er to help can also hurt, just like tech­nol­o­gy. Pow­er­ful gov­ern­ment aren’t inher­ent­ly a “good” or “bad” thing, as the lib­er­tar­i­ans assert. It depends on how you use it. If you have a weak gov­ern­ment, it may not direct­ly harm you but it’s not going to help either. Just like tech­nol­o­gy. This is why ensur­ing that we don’t pro­tect our rights at the expense of a com­pe­tent help­ful gov­ern­ment is going to be increas­ing­ly impor­tant and chal­leng­ing going for­ward. The sim­ple fact that few enti­ties are more empow­ered by tech­nol­o­gy than a gov­ern­ment cre­ates impulse to dis­em­pow­er gov­ern­ment as a form of civic self-defense. And that impulse is only going to grow with each tech­no­log­i­cal advanced that enhances that pow­er. How we strike that bal­ance between pri­va­cy and secu­ri­ty with­out turn­ing gov­ern­ments into either a beast or a worth­less joke isn’t obvi­ous. Maybe empow­er­ing crim­i­nals with super encryp­tion tools and 5th Amend­ment rights is a rea­son­able price to pay to avoid the costs asso­ci­at­ed it gov­ern­ment abuse? Or maybe it’ll fos­ter a crime explo­sion? Maybe both. No mat­ter which path is cho­sen we’ll see the con­se­quences. Even­tu­al­ly. But we’re not going to see all of the oth­er option­al paths for­ward if the Cypher­punk/Libertarian per­spec­tive con­tin­ues to be dom­i­nant per­spec­tive on these kinds of issues.

Enough With the Insane Insan­i­ty. Sane Insan­i­ty is Required
To some extent, if we real­ly want to get seri­ous about grap­pling with these mutu­al­ly con­tra­dic­to­ry issues we, by def­i­n­i­tion, need to go some­what insane in terms of our world­view. Insane in the sense that we real­ly do need to hold mul­ti­ple, mutu­al­ly con­tra­dic­to­ry ideas in our minds simul­ta­ne­ous­ly in order to grap­ple with them indi­vid­u­al­ly. Sane insan­i­ty. In oth­er words, you can’t sim­ply be a “pri­va­cy advo­cate” with­out being a “secu­ri­ty advo­cate”. Pri­va­cy and secu­ri­ty are inter­twined because our lives our inter­twined. I have to care about your secu­ri­ty too if I real­ly want to pro­tect my pri­va­cy and vice ver­sa.

But you also can’t achieve that inter­twined state by sim­ply defin­ing “privacy=security”, as we often hear from folks like Snow­den or Assange. That just does­n’t make sense when “pri­va­cy” includes super encryp­tion and “hid­den vol­umes” and legal regimes that can poten­tial­ly pro­vide an incred­i­ble shield against legit­i­mate law enforce­ment or nation­al secu­ri­ty tasks. At the same time, because real­i­ty is some­what insane we can’t kid our­selves about the incred­i­ble dan­gers that could poten­tial­ly arise from tech­no­log­i­cal­ly enabled mass sur­veil­lance, espe­cial­ly cryp­to-mass sur­veil­lance (the Panop­ti­con). Sane insan­i­ty is need­ed on a vari­ety of top­ics and that need is only going to grow.

Ter­ri­fied of a gov­ern­ment with the pow­er to track us all? Great. It’s a healthy sense of ter­ror. Gov­ern­ments can become crim­i­nal. But also be ter­ri­fied of a gov­ern­ment that can’t real­ly track or pros­e­cute crim­i­nals, even when it’s impor­tant. So embrace the cog­ni­tive dis­so­nance that comes with these issues. Embrac­ing the tech­nol­o­gy-enhanced cog­ni­tive dis­so­nance and lack of easy and obvi­ous answers is the answer. That’s how the kinds of long-term solu­tions we need are going to be found and it’s a lot bet­ter than the alter­na­tive.

Discussion

18 comments for “Knock, Knock? Who’s There? Either a Strongbox or a Wall Safe. It’s Undecided.”

  1. This sto­ry is extreme­ly com­plex. If I under­stand it cor­rect­ly it boils down to; not every deci­sion that sound good on its face is good. Also the pow­ers that be are SOBs and the gen­er­al pub­lic is screwed. I hope I am under­stand­ing cor­rect­ly. Thank you.

    Posted by GK | July 4, 2014, 1:02 pm
  2. @GK: Hehe, yeah that’s the gist of it, but with the added caveats that 1. the pow­ers that be are both pub­lic and pri­vate, and 2. should we find that the pow­ers that be are indeed SOBs that pose an unrea­son­able threat to rights pri­va­cy, the best defense the pub­lic has against those SOBs is replac­ing the pub­lic SOBs with non-SOBs that that can keep the pub­lic and pri­vate SOBs from tram­pling every­one’s rights. But yeah, since some degree of human judge­ment by peo­ple in posi­tions of pow­er is required for a mod­ern soci­ety to func­tion, judi­cious use of our main TPTB SOB man­age­ment tool (democ­ra­cy) is required.

    Posted by Pterrafractyl | July 4, 2014, 5:03 pm
  3. @GK: Here’s anoth­er sto­ry that’s great exam­ple of an idea that might sound good on on face but may not be so great in prac­tice: So Rus­sia is fol­low­ing the rec­om­men­da­tions by Ger­many’s and Brazil’s gov­ern­ments that they require com­pa­nies like Google and Face­book to store their data local­ly. When it was Ger­many and Brazil mak­ing this pitch it was typ­i­cal­ly char­ac­ter­ized as a way for those gov­ern­ments to pro­tect their cit­i­zens from the pry­ing eyes of the NSA. But when Rus­sia actu­al­ly pass­es such a law, we get remind­ed that data local­iza­tion laws also make the data much more like­ly to get spied on by the local gov­ern­ment and that might be a much big­ger threat to your pri­va­cy the NSA. As is usu­al, the com­plex­i­ties of issues like this can remained obscured for a while but not nec­es­sar­i­ly for­ev­er:

    Russ­ian law­mak­ers pass new bill restrict­ing Inter­net

    By Maria ANTONOVA July 5, 2014

    Moscow (AFP) — Rus­si­a’s par­lia­ment passed a bill on Fri­day requir­ing Inter­net com­pa­nies to store Rus­sians’ per­son­al data inside the coun­try in an appar­ent move to pres­sure sites such as Face­book and Twit­ter into hand­ing over user infor­ma­tion.

    Intro­duc­ing the bill to par­lia­ment this week, MP Vadim Den­gin said “most Rus­sians don’t want their data to leave Rus­sia for the Unit­ed States, where it can be hacked and giv­en to crim­i­nals.”

    “Our entire lives are stored over there,” he said, adding that com­pa­nies should build data cen­tres in Rus­sia.

    The bill would increase pres­sure on social net­work­ing ser­vices which do not have offices in Rus­sia and have become a vital resource for anti-gov­ern­ment groups.

    ...

    Just days before the bill was for­mal­ly pro­posed last month, Twit­ter’s pub­lic pol­i­cy chief Col­in Crow­ell vis­it­ed Rus­sia to speak with media watch­dog Roskom­nad­zor. Few details of the vis­it were pub­li­cised, but access to user data is thought to have been top of the list.

    Rus­sia is also ask­ing Twit­ter to open a local office, which the com­pa­ny has so far refused to do.

    “Nobody wants to relo­cate to Rus­sia, but I am pes­simistic. I think (the Russ­ian author­i­ties) will make them relo­cate the servers,” said Andrei Solda­tov, a jour­nal­ist who tracks Rus­si­a’s secu­ri­ty ser­vices.

    “For the most part, this is direct­ed against Gmail, Face­book, and Twit­ter,” he said.

    If passed, the rules will not take effect until Sep­tem­ber 2016 but will pro­vide the gov­ern­ment with grounds to block sites that do not com­ply.

    ...

    - ‘Iron cur­tain all over’ -

    Rus­si­a’s Asso­ci­a­tion of Elec­tron­ic Com­mu­ni­ca­tion (RAEC), a group that lob­bies on behalf of Inter­net com­pa­nies and also helped organ­ise Crow­ell’s vis­it, said the new mea­sures would be detri­men­tal to Inter­net users.

    “Many glob­al Inter­net ser­vices would be impos­si­ble,” the group said ear­li­er this week. “The bill takes the right of peo­ple over their own per­son­al data away from them.”

    “They want the iron cur­tain all over again, with every­thing writ­ten on pieces of paper like in the Sovi­et Union,” Vladimir Kan­torovich, vice pres­i­dent at the Russ­ian Asso­ci­a­tion of Tour Oper­a­tors, told AFP.

    “I feel like the Duma wants to lock us in an armoured cell for our pro­tec­tion with­out ask­ing if we need it.”

    The bill must still be approved by the upper cham­ber and Pres­i­dent Vladimir Putin before it becomes law, but is only the lat­est in what appears as a con­cert­ed push by the gov­ern­ment to crack down on Inter­net dis­sent.

    Law­mak­ers have already passed a slew of restric­tions, includ­ing a require­ment for blog­gers to reg­is­ter as media if they have more than 3,000 fol­low­ers and a law direct­ed against “extrem­ist” lan­guage that could see Rus­sians go to jail for up to five years for retweet­ing offen­sive infor­ma­tion.

    Con­ser­v­a­tive law­mak­ers are also dis­cussing the pos­si­bil­i­ty of wide­spread Inter­net fil­ters that could only be lift­ed for peo­ple who hand over their pass­port infor­ma­tion.

    Posted by Pterrafractyl | July 4, 2014, 6:03 pm
  4. This is inter­est­ing: Edward Snow­den just endorsed a web ser­vice provider specif­i­cal­ly because it does­n’t retain the capac­i­ty to decrypt your data even when pro­vid­ed with a valid war­rant:

    Upstart
    July 18, 2014, 5:10pm EDT
    Edward Snow­den gives lit­tle-known Spi­deroak his stamp of approval

    Michael del Castil­lo
    Upstart Busi­ness Jour­nal Tech­nol­o­gy & Inno­va­tion Edi­tor

    The UpTake: Edward Snow­den cur­rent­ly live in exile in Rus­sia. But his endorse­ment of a U.S. start­up still has the pow­er to draw atten­tion from pri­va­cy-focused cus­tomers.

    Edward Snow­den may be per­son­ona non gra­ta in the Unit­ed States, but in the bur­geon­ing Anony­mous Econ­o­my that sprung up after he leaked thou­sands of doc­u­ments show­ing that the U.S. gov­ern­ment was spy­ing on cit­i­zens around the world and domes­ti­cal­ly, he is quite a hot com­mod­i­ty.

    So when he dissed Drop­box for being “hos­tile to privacy”—specifically cit­ing the com­pa­ny’s appoint­ment of for­mer Sec­re­tary of State Con­doleez­za Rice to its board ear­li­er this year—the Guardian took note. But for entre­pre­neurs look­ing to stay ahead of the curve, it’s who he endorsed as an alter­na­tive to Drop­box that’s par­tic­u­lar­ly inter­est­ing.

    “Spi­deroak has struc­tured their sys­tem in such a way you can store all of your infor­ma­tion on them with the same sort of fea­tures that Drop­box does, but they lit­er­al­ly had have no access to the con­tent,” Snow­den told the Gau­r­dian in a report pub­lished yes­ter­day. “So while they can be com­pelled to turn it over, the law enforce­ment agen­cies still have to go to a judge and get a war­rant to actu­al­ly get your encryp­tion key from you.

    Spi­deroak, an online tool for back­ing up, shar­ing, sync­ing, access­ing and stor­ing data, offers its users what they call “zero-knowl­edge pri­va­cy,” mean­ing, “the serv­er nev­er knows the plain­text con­tents of the data it is stor­ing,” accord­ing to the site. “There­fore, the data is nev­er at risk of being com­pro­mised or abused by either inter­nal threats or exter­nal hack­ers.” A sim­i­lar ser­vice to Kim Dotcom’s Mega, Spi­deroak encrypts users’ files before they are stored, pre­vent­ing the com­pa­ny from know­ing their con­tents.

    On the oth­er hand, accord­ing to Snow­den, Drop­box is a “wannabe PRISM part­ner,” refer­ring to the project name asso­ci­at­ed with gov­ern­ment spy­ing using cor­po­ra­tions. “They’re very hos­tile to pri­va­cy.”

    Accord­ing to Drop­box’s site, while it does encrypt files, the pri­va­cy keys giv­ing access to the data are gen­er­at­ed by the com­pa­ny, and there are a “small num­ber of employ­ees who must be able to access user data.” For ” advanced” users though, Drop­box does allow for third par­ty appli­ca­tions to pro­vide addi­tion­al encryp­tion.

    ...

    Posted by Pterrafractyl | July 23, 2014, 12:27 pm
  5. Fol­low­ing the attacks on Char­lie Heb­do’s Paris office, UK Prime Min­is­ter David Cameron drew a num­ber of respons­es with his call for leg­is­la­tion to force UK inter­net ser­vice providers to make their encrypt­ed cus­tomer data avail­able to UK law enforce­ment. They tend­ed to be rather neg­a­tive respons­es, which is under­stand­able giv­en the con­tro­ver­sial nature of the request. But they appar­ent­ly weren’t all neg­a­tive:

    EU Observ­er
    EU wants inter­net firms to hand over encryp­tion keys

    By Niko­laj Nielsen
    BRUSSELS, 22. Jan, 09:30

    A top EU offi­cial wants inter­net and telecom­mu­ni­ca­tion com­pa­nies to hand over encryp­tion keys to police and spy agen­cies as part of a wider crack­down on ter­ror­ism.

    The EU’s counter-ter­ror­ism co-ordi­na­tor Gilles de Ker­chove, in a doc­u­ment leaked by Lon­don-based civ­il lib­er­ties group State­watch, says the Euro­pean Com­mis­sion should come up with rules that require the firms to help nation­al gov­ern­ments snoop on pos­si­ble sus­pects.

    “Since the Snow­den rev­e­la­tions, inter­net and telecom­mu­ni­ca­tions com­pa­nies have start­ed to use often de-cen­tralised encryp­tion which increas­ing­ly makes law­ful inter­cep­tion by the rel­e­vant nation­al author­i­ties tech­ni­cal­ly dif­fi­cult or even impos­si­ble,” notes de Ker­chove in the doc­u­ment.

    Edward Snow­den is a for­mer US intel­li­gence con­trac­tor who leaked files on how the US and UK inter­cept vast amounts of pri­vate data in the name of secu­ri­ty.

    The de Ker­chove pro­pos­al joins sim­i­lar recent calls made by the US and UK gov­ern­ments to weak­en or ban cer­tain forms of encryp­tion.

    UK prime min­is­ter David Cameron, in the after­math of the Char­lie Heb­do attack in Paris, said British intel­li­gence agen­cies should have the legal abil­i­ty to break the encrypt­ed com­mu­ni­ca­tions.

    His plea was lat­er joined by Oba­ma who said post-Snow­den encryp­tion tech­nolo­gies was mak­ing it more dif­fi­cult for spy agen­cies to crack sus­pect com­mu­ni­ca­tions.

    “If we find evi­dence of a ter­ror­ist plot … and despite hav­ing a phone num­ber, despite hav­ing a social media address or email address, we can’t pen­e­trate that, that’s a prob­lem,” the US leader said.

    Fears are mount­ing such pro­pos­als could force com­pa­nies to intro­duce back­door entries that would allow gov­ern­ments to pierce encrypt­ed emails and smart­phone mes­sage apps.

    ...

    Mean­while, the de Ker­chove paper goes fur­ther.

    Last April, the Lux­em­bourg-based Euro­pean Court of Jus­tice scrapped the EU data reten­tion direc­tive. But Ker­chove wants the Euro­pean Com­mis­sion to come up with a new pro­pos­al.

    He also wants a new Inter­net mon­i­tor­ing unit set up inside the EU police agency, Europol.

    The unit would be tasked to comb the web for any ille­gal con­tent and alert IT com­pa­nies to remove it.

    Ker­chove sug­gests the police agency should also bet­ter align itself with the EU’s intel­li­gence analy­sis cen­tre, Int­Cen.

    Wow, it sounds like the EU’s counter-ter­ror­ism chief is call­ing for pret­ty exact­ly what David Cameron wants, plus he’d like to see the EU remake the very same data-reten­tion laws that the EU par­lia­ment scrapped last year. And a new EU inter­net mon­i­tor­ing unit.

    So it’ll be inter­est­ing to see how that pro­pos­al goes over well with the pub­lic. But it will also be inter­est­ing to see what Edwards Snow­den has to say about these pro­pos­als. He’s obvi­ous­ly not going to be in favor of EU counter-ter­ror­ism chief’s rec­om­men­da­tions, but he’s also on record say­ing things like “not all spy­ing is bad”, so how harsh­ly will he respond to the EU’s new plans? Might he call for the abol­ish­ment of intel­li­gence agen­cies? It’s pos­si­ble:

    Law­fare
    Did Edward Snow­den Call for Abol­ish­ing the Intel­li­gence Com­mu­ni­ty?

    By Ben­jamin Wittes
    Wednes­day, Decem­ber 24, 2014 at 2:34 PM

    For­get North Korea. For­get the Islam­ic State. For­get the Iran­ian nuclear pro­gram. I want to tell you about my exchange with Edward Snowden—and the amaz­ing things he seems to have said in it.

    The exchange took place a cou­ple of weeks ago, when I appeared as a last-minute sub-in on a pan­el at the Cato Institute’s sur­veil­lance con­fer­ence. I was there, as I jok­ing­ly told the audi­ence at the out­set of my remarks, to rep­re­sent unprin­ci­pled statism—though I like to think that my sta­tism is a prin­ci­ple. (Nobody even cracked a smile at this joke.) Specif­i­cal­ly, I was there at the request of Cato’s excel­lent sur­veil­lance schol­ar, Julian Sanchez, to defend the notion that Con­gress should not—and prob­a­bly can­not constitutionally—regulate by statute the uni­verse of sur­veil­lance now con­duct­ed under Exec­u­tive Order 12333. My remarks drew an inter­est­ing, and I think reveal­ing, response from Snow­den, who addressed the con­fer­ence by video lat­er in the day.

    To under­stand the rad­i­cal­ism of what Snow­den was say­ing, you have to start with the com­ments I made. Pre­vi­ous speak­ers on the panel—Marcy Wheel­er, John Napi­er Tye, and Lau­ra Donohue—had all object­ed to the breadth of col­lec­tion under 12333 and Dono­hue, in par­tic­u­lar, had argued for bring­ing 12333 col­lec­tion under the For­eign Intel­li­gence Sur­veil­lance Act. I start­ed my remarks (which run from rough­ly 47:30 to rough­ly 55:30 of the video below) by point­ing out that at least some for­eign col­lec­tion against non-US per­sons does not make sense to treat under statu­to­ry law:

    There’s a temp­ta­tion when we all sit here to think about the many ways that we can reg­u­late the tra­di­tion­al­ly unreg­u­lat­ed space of for­eign espi­onage. And it’s worth just tak­ing a step back, and a deep breath, and say­ing, “What should Con­gress have to say about the rules when Barack Oba­ma wants to know what Vladimir Putin is talk­ing about?” And if that ques­tion doesn’t give you any pause . . . then I lose and yes, you should reg­u­late every com­po­nent of every aspect of for­eign col­lec­tion.

    [But t]here is a lim­it to Congress’s author­i­ty to reg­u­late some of this stuff. I think most peo­ple, going back to my Vladimir Putin ques­tion, would say that is actu­al­ly an area of inher­ent pres­i­den­tial author­i­ty.

    [see video]
    My inter­locu­tors on the pan­el object­ed that this exam­ple was—as one put it—a “straw man.” It’s actu­al­ly not a straw man; if you’re going to reg­u­late over­seas col­lec­tion against non-US per­sons, you have to ask if any­one lies out­side of that reg­u­la­tion and, if so, whom. And to his cred­it, Snow­den did not object on that basis. In his own com­ments, lat­er in the day, he took on direct­ly the impli­ca­tions of my hypo­thet­i­cal, and his answer is deeply reveal­ing.

    He actu­al­ly addressed my remarks twice. The first time (which begins at rough­ly 28:45), he active­ly embraced the idea of both pub­lic law con­cern­ing over­seas sur­veil­lance tar­get­ing and judi­cial review of sur­veil­lance even of for­eign heads of state:

    There are very few peo­ple who con­test that we should not be able to pur­sue inves­ti­ga­tions using almost any author­i­ty against indi­vid­u­als where you can get a judge to sign a par­tic­u­lar­ized war­rant. Ben­jamin Wittes ear­li­er, he basi­cal­ly argued that, should we have leg­is­la­tors involved? Should we have pub­lic rules about the way we apply our sur­veil­lance capa­bil­i­ties because Vladimir Putin might know about it? I say yes, because there is no court in the world—well, at least, no court out­side Russia—who would not go, “This man is an agent of the for­eign gov­ern­ment. I mean, he’s the head of the gov­ern­ment.” Of course, they will say, “this guy has access to some kind of for­eign intel­li­gence val­ue. We’ll sign the war­rant for him.” If we know about the author­i­ties, if we know about how they are used, there’s no prob­lem whether they are pub­lic or pri­vate, because he can’t elide them. He can’t hide in the noise. We know what his capa­bil­i­ties are.

    Snow­den returned to my Putin exam­ple lat­er in his com­ments (around 44:00) and went fur­ther, argu­ing that we don’t real­ly need an intel­li­gence com­mu­ni­ty at all—much less a FISA process:

    Par­tic­u­lar­ly in the con­text of state secu­ri­ty agen­cies, spy agen­cies, do we real­ly need them? Aren’t they a prod­uct of devel­op­ing soci­eties, devel­op­ing gov­ern­ments, devel­op­ing civ­i­liza­tions, that can be replaced by our meth­ods of law enforce­ment? When we talked about, for exam­ple, ear­li­er Ben Wittes’s ref­er­ence to Vladimir Putin, do we real­ly need the NSA and a secret court to say, “hey, we’re going to wire­tap Putin”? or is it easy enough to get any judge to sign that war­rant? I don’t think we need a spe­cial mech­a­nism to pro­vide for tar­get­ed wire­taps or tar­get­ed efforts to gain intel­li­gence relat­ed to a par­tic­u­lar­ized inves­ti­ga­tion. And it’s not a far leap to say we can pro­vide for leg­is­la­tion that affords that out­side of secret orga­ni­za­tions that inevitably push the line beyond what the pub­lic would agree with.

    Snowden’s point is suf­fi­cient­ly opaque to me that I find respond­ing a lit­tle dif­fi­cult. First of all, Snow­den is respond­ing to a point I did not make: I was, in fact, not say­ing that the prob­lem with pub­lic law and apply­ing the FISA process to sur­veil­lance of Putin would be mak­ing legal author­i­ties pub­lic that should be secret. My point was, rather, that there’s a con­sti­tu­tion­al lim­it on Congress’s author­i­ty to reg­u­late for­eign intel­li­gence activ­i­ty, and that one doesn’t have to be Dick Cheney to believe that there’s some zone of inher­ent pres­i­den­tial pow­er to con­duct for­eign pol­i­cy that would include the con­duct of espi­onage against, say, a for­eign head of state over­seas. As I said in my remarks, I am not mar­ried at all to the idea that Con­gress has no author­i­ty to reg­u­late in areas cur­rent­ly gov­erned by 12333. But I do think there’s a core that Con­gress can­not con­sti­tu­tion­al­ly touch.

    But let’s leave aside the ships-pass­ing-in-the-night qual­i­ty of Snow­den and my legal dis­cus­sion and pause a moment to con­sid­er the pol­i­cy ideas he advanced, of which there are two. First, Snow­den pro­pos­es that all for­eign intel­li­gence gath­er­ing should be par­tic­u­lar­ized and sub­ject to indi­vid­ual judi­cial review—even against for­eign hos­tile heads of state. Sec­ond, he pro­pos­es that we not real­ly have an intel­li­gence com­mu­ni­ty and spe­cial­ized judi­cial instru­ments to over­see it but use exclu­sive­ly law enforce­ment and con­ven­tion­al judi­cial tools for for­eign sur­veil­lance. In short, he’s propos­ing a rev­o­lu­tion in the entire way the U.S. gov­ern­ment oper­ates over­seas, orga­nizes its secu­ri­ty appa­ra­tus domes­ti­cal­ly, and treats con­cep­tu­al­ly for­eign and domes­tic threats.

    I couldn’t tell from Snowden’s com­ments whether he even under­stands the mag­ni­tude of what he’s propos­ing here. A reg­u­lar court super­vis­ing a reg­u­lar law enforce­ment agency, after all, would not be able to autho­rize sur­veil­lance against Putin absent prob­a­ble cause that he had com­mit­ted a crime. Putin is a bad guy, but I’m not sure he’s right­ly the sub­ject of U.S. crim­i­nal inves­ti­ga­tions, and a great many law­ful intel­li­gence tar­gets cer­tain­ly are not. The sources of author­i­ty to con­duct for­eign espi­onage sim­ply lie in a dif­fer­ent place from the sources of author­i­ty to inves­ti­gate crim­i­nal behav­ior, and the para­me­ters of those author­i­ties are very dif­fer­ent from one anoth­er too.

    ...

    Well, that’s one way to pre­vent gov­ern­ment spy­ing: elim­i­nate intel­li­gence agen­cies alto­geth­er, because spy­ing is some­thing only devel­op­ing coun­tries engage in, and instead con­duct any war­rant-approved wire­tap­ping through law enforce­ment agen­cies. The police can tap Putin’s phone after they get a war­rant.

    This pro­pos­al rais­es a num­ber of fas­ci­nat­ing ques­tions, includ­ing Snow­den’s views on the mil­i­ta­riza­tion of law enforce­ment. But it’s also worth not­ing that the Snow­den’s views on this top­ic sound some­what sim­i­lar to the pro­pos­als of promi­nant secu­ri­ty expert Bruce Schneier’s views, but not excat­ly the same, so it would be very inter­est­ing to see where they diverge. Trans­fer­ring all domes­tic intel­li­gence gath­er­ing to the FBI was some­thing Schneier rec­om­mend­ed last year. At the same time, Scheier was also advo­cat­ing that all for­eign cyber­at­tacks and tar­get­ing hack­ing be con­duct­ed by the mil­i­tary and for­eign spy­ing be offi­cial­ly con­sid­ered an offen­sive mil­i­tary act:

    CNN
    It’s time to break up the NSA
    By Bruce Schneier
    updat­ed 6:40 PM EST, Thu Feb­ru­ary 20, 2014

    (CNN) — The NSA has become too big and too pow­er­ful. What was sup­posed to be a sin­gle agency with a dual mis­sion — pro­tect­ing the secu­ri­ty of U.S. com­mu­ni­ca­tions and eaves­drop­ping on the com­mu­ni­ca­tions of our ene­mies — has become unbal­anced in the post-Cold War, all-ter­ror­ism-all-the-time era.

    Putting the U.S. Cyber Com­mand, the mil­i­tary’s cyber­war wing, in the same loca­tion and under the same com­man­der, expand­ed the NSA’s pow­er. The result is an agency that pri­or­i­tizes intel­li­gence gath­er­ing over secu­ri­ty, and that’s increas­ing­ly putting us all at risk. It’s time we thought about break­ing up the Nation­al Secu­ri­ty Agency.

    Broad­ly speak­ing, three types of NSA sur­veil­lance pro­grams were exposed by the doc­u­ments released by Edward Snow­den. And while the media tends to lump them togeth­er, under­stand­ing their dif­fer­ences is crit­i­cal to under­stand­ing how to divide up the NSA’s mis­sions.

    The first is tar­get­ed sur­veil­lance.

    This is best illus­trat­ed by the work of the NSA’s Tai­lored Access Oper­a­tions (TAO) group, includ­ing its cat­a­log of hard­ware and soft­ware “implants” designed to be sur­rep­ti­tious­ly installed onto the ene­my’s com­put­ers. This sort of thing rep­re­sents the best of the NSA and is exact­ly what we want it to do. That the Unit­ed States has these capa­bil­i­ties, as scary as they might be, is cause for grat­i­fi­ca­tion.

    The sec­ond is bulk sur­veil­lance, the NSA’s col­lec­tion of every­thing it can obtain on every com­mu­ni­ca­tions chan­nel to which it can get access. This includes things such as the NSA’s bulk col­lec­tion of call records, loca­tion data, e‑mail mes­sages and text mes­sages.

    This is where the NSA over­reach­es: col­lect­ing data on inno­cent Amer­i­cans either inci­den­tal­ly or delib­er­ate­ly, and data on for­eign cit­i­zens indis­crim­i­nate­ly. It does­n’t make us any safer, and it is liable to be abused. Even the direc­tor of nation­al intel­li­gence, James Clap­per, acknowl­edged that the col­lec­tion and stor­age of data was kept a secret for too long.

    The third is the delib­er­ate sab­o­tag­ing of secu­ri­ty. The pri­ma­ry exam­ple we have of this is the NSA’s BULLRUN pro­gram, which tries to “insert vul­ner­a­bil­i­ties into com­mer­cial encryp­tion sys­tems, IT sys­tems, net­works and end­point com­mu­ni­ca­tion devices.” This is the worst of the NSA’s excess­es, because it destroys our trust in the Inter­net, weak­ens the secu­ri­ty all of us rely on and makes us more vul­ner­a­ble to attack­ers world­wide.

    ...

    Keep in mind that when Bruce Schneier describes the tar­get­ting of indi­vid­u­als by the “Tai­lor Access Opra­tions” (TAO) group as “the best of the NSA and is exact­ly what we want it to do”, that’s the oppo­site of what Wik­ileaks-hack­er Jacob Appel­baum was sug­gest­ing dur­ing his keynote address to the 2013 Chaos Com­put­ing Con­ven­tion. Appel­baum, who has a large cache of Snow­den Doc­u­ments him­self and writ­ten exten­sive­ly about it in Der Spiegel, spent the entire talk show­ing one exam­ple after anoth­er of the TAO’s tools and dis­cussed how hor­ri­ble it was the the NSA these tools at their dis­pos­al because their exis­tence means any­one could poten­tial have them used against them.

    This reflects a large­ly unspo­ken divide in the secu­ri­ty com­mu­ni­ty: Scheier seems to be acknowl­edg­ing that tar­get­ed sur­veil­lance is fine, just not mass-sur­veil­lance. Appel­baum, on the oth­er hand, appears to view tar­get­ed sur­veil­lance as effec­tive­ly just as bad because, hey, they could tar­get every­one, includ­ing the NSA’s capac­i­ty to arrange for com­put­er man­u­fac­tur­ers to tar­get spe­cif­ic peo­ple’s com­put­ers with built in hard­ware or soft­ware changes to make only those com­put­ers vul­ner­a­ble. Appel­baum is essen­tial­ly a “no spy­ing at all by gov­ern­ments or any­one” advo­cate.

    The inter­twined nature of tar­get­ed sur­veil­lance tech­niques and mass-sur­veil­lance capa­bil­i­ties in a world where every­one is using the same tech­nol­o­gy plat­forms but from dif­fer­ent loca­tions using dif­fer­ent hard­ware. For instance, if you’re tar­get­ing some­one or some group, you might need to have the capac­i­ty to inter­cept and ana­lyze, at least at a meta-data lev­el, a flood of data in order to find your tar­gets’ com­mu­ni­ca­tions. Appel­baum would clear­ly pre­fer no com­mu­ni­ca­tions get tar­get­ed ever. It’s unclear how Schneier would rec­on­cile this inher­ent con­flict with the poten­tial use of mass-sur­veil­lance capa­bil­i­ties for the pur­pose of tar­get­ing peo­ple with a war­rant if all non-tar­get­ed data was fil­tered out.

    Con­tin­u­ing...

    ...
    That’s the three: good, bad, very bad. Reor­ga­niz­ing the U.S. intel­li­gence appa­ra­tus so it con­cen­trates on our ene­mies requires break­ing up the NSA along those func­tions.

    First, TAO and its tar­get­ed sur­veil­lance mis­sion should be moved under the con­trol of U.S. Cyber Com­mand, and Cyber Com­mand should be com­plete­ly sep­a­rat­ed from the NSA. Active­ly attack­ing ene­my net­works is an offen­sive mil­i­tary oper­a­tion, and should be part of an offen­sive mil­i­tary unit.

    What­ev­er rules of engage­ment Cyber Com­mand oper­ates under should apply equal­ly to active oper­a­tions such as sab­o­tag­ing the Natanz nuclear enrich­ment facil­i­ty in Iran and hack­ing a Bel­gian tele­phone com­pa­ny. If we’re going to attack the infra­struc­ture of a for­eign nation, let it be a clear mil­i­tary oper­a­tion.

    Sec­ond, all sur­veil­lance of Amer­i­cans should be moved to the FBI.

    The FBI is charged with coun­tert­er­ror­ism in the Unit­ed States, and it needs to play that role. Any oper­a­tions focused against U.S. cit­i­zens need to be sub­ject to U.S. law, and the FBI is the best place to apply that law. That the NSA can, in the view of many, do an end-run around con­gres­sion­al over­sight, legal due process and domes­tic laws is an affront to our Con­sti­tu­tion and a dan­ger to our soci­ety. The NSA’s mis­sion should be focused out­side the Unit­ed States — for real, not just for show.

    And third, the remain­der of the NSA needs to be rebal­anced so COMSEC (com­mu­ni­ca­tions secu­ri­ty) has pri­or­i­ty over SIGINT (sig­nals intel­li­gence). Instead of work­ing to delib­er­ate­ly weak­en secu­ri­ty for every­one, the NSA should work to improve secu­ri­ty for every­one.

    Com­put­er and net­work secu­ri­ty is hard, and we need the NSA’s exper­tise to secure our social net­works, busi­ness sys­tems, com­put­ers, phones and crit­i­cal infra­struc­ture. Just recall the recent inci­dents of hacked accounts — from Tar­get to Kick­starter. What once seemed occa­sion­al now seems rou­tine. Any NSA work to secure our net­works and infra­struc­ture can be done open­ly — no secre­cy required.

    This is a rad­i­cal solu­tion, but the NSA’s many harms require rad­i­cal think­ing. It’s not far off from what the Pres­i­den­t’s Review Group on Intel­li­gence and Com­mu­ni­ca­tions Tech­nolo­gies, charged with eval­u­at­ing the NSA’s cur­rent pro­grams, rec­om­mend­ed. Its 24th rec­om­men­da­tion was to put the NSA and U.S. Cyber Com­mand under dif­fer­ent gen­er­als, and the 29th rec­om­men­da­tion was to put encryp­tion ahead of exploita­tion.

    ...

    Ok, so accord­ing to one of the world’s most promi­nent secu­ri­ty experts we should:
    1. Break up the NSA, end bulk-sur­veil­lance meth­ods, and shift tar­get­ed sur­veil­lance mis­sions and Cyber­war­fare capa­bil­i­ties to US Cyber Com­mand so that any stuxnet-like actions or things like hack­ing a Bel­gian Tele­phone Com­pa­ny are seen as offen­sive mil­i­tary actions.

    2. Shift all domes­tic sur­veil­lance to the FBI, pre­sum­ably a ref­er­ence the FBI’s war­rant­less wire­tap­ping pro­gram start­ed by George W. Bush in the wake of 9/11. This reform has already kind of but not real­ly hap­pened but, in prin­ci­ple, it’s cer­tain­ly a wor­thy goal of try­ing to redraw the line between domes­tic and for­eign sur­veil­lance, although giv­en that much of the uproar over NSA spy­ing has to do with the fact that you can’t real­ly dis­en­tan­gle for­eign and domes­tic com­mu­ni­ca­tions giv­en how the inter­net is struc­tured, it’s unclear how suc­cess­ful this will be.

    3. Repri­or­i­tize the NSA so that, when the inevitable con­flicts emerge in its mutu­al­ly exclu­sive mis­sions (secur­ing net­works while simul­ta­ne­ous­ly try­ing to break them) the “secur­ing the net­works” pri­or­i­ty wins. That’s, well, it’s ambi­tious. As the say­ing goes, “the best defense is a great offense”, but could the best defense actu­al­ly be a great defense in the realm of nation­al secu­ri­ty when you have to not only pro­tect your dig­i­tal infra­struc­ture but also spy on adver­saries to learn about oth­er stuff going on? That seems to be what Schneier is argu­ing.

    So sug­ges­tion 2, get­ting the NSA out of domes­tic sur­veil­lance, seems pret­ty rea­son­able, albeit tech­ni­cal­ly chal­leng­ing. But what about sug­ges­tions 1 and 3. Should gov­ern­ment hack­ing of oth­er nations’ tele­com firms, which is ubiq­ui­tous these days, be con­sid­ered an act of war? Is that going to lead to a safer world? It will place a dif­fer­ent con­text on spy­ing that gets pub­licly out­ed, but is that a bet­ter con­text? And what hap­pens if oth­er nations don’t all agree to this new approach? Should their hacks of US firms now also be con­sid­ered mil­i­tary actions too? Schneier isn’t clear on that, although he has called for some sort of glob­al­ly run anti-sur­veil­lance enforce­ment agency:

    The Atlantic
    How the NSA Threat­ens Nation­al Secu­ri­ty
    Our choice isn’t between a dig­i­tal world where the agency can eaves­drop and one where it can­not; our choice is between a dig­i­tal world that is vul­ner­a­ble to any attack­er and one that is secure for all users.
    Bruce Schneier Jan 6 2014, 11:10 AM ET

    Secret NSA eaves­drop­ping is still in the news. Details about once secret pro­grams con­tin­ue to leak. The Direc­tor of Nation­al Intel­li­gence has recent­ly declas­si­fied addi­tion­al infor­ma­tion, and the Pres­i­den­t’s Review Group has just released its report and rec­om­men­da­tions.

    With all this going on, it’s easy to become inured to the breadth and depth of the NSA’s activ­i­ties. But through the dis­clo­sures, we’ve learned an enor­mous amount about the agen­cy’s capa­bil­i­ties, how it is fail­ing to pro­tect us, and what we need to do to regain secu­ri­ty in the Infor­ma­tion Age.

    ...

    The NSA’s col­lect-every­thing men­tal­i­ty is large­ly a hold-over from the Cold War, when a voyeuris­tic inter­est in the Sovi­et Union was the norm. Still, it is unclear how effec­tive tar­get­ed sur­veil­lance against “ene­my” coun­tries real­ly is. Even when we learn actu­al secrets, as we did regard­ing Syr­i­a’s use of chem­i­cal weapons ear­li­er this year, we often can’t do any­thing with the infor­ma­tion.

    Ubiq­ui­tous sur­veil­lance should have died with the fall of Com­mu­nism, but it got a new—and even more dangerous—life with the intel­li­gence com­mu­ni­ty’s post‑9/11 “nev­er again” ter­ror­ism mis­sion. This quixot­ic goal of pre­vent­ing some­thing from hap­pen­ing forces us to try to know every­thing that does hap­pen. This push­es the NSA to eaves­drop on online gam­ing worlds and on every cell phone in the world. But it’s a fool’s errand; there are sim­ply too many ways to com­mu­ni­cate.
    ...

    Note that Scheier wrote that, “it is unclear how effec­tive tar­get­ed sur­veil­lance against “ene­my” coun­tries real­ly is. Even when we learn actu­al secrets, as we did regard­ing Syr­i­a’s use of chem­i­cal weapons ear­li­er this year, we often can’t do any­thing with the infor­ma­tion.” So it would appear, based on that state­ment, that Sheier is open to poli­cies that effec­tive­ly elim­i­nate tar­get­ed sur­veil­lance in addi­tion to bulk data-col­lec­tion.

    Skip­ping down...

    ...

    It’s not just domes­tic abuse we have to wor­ry about; it’s the rest of the world, too. The more we choose to eaves­drop on the Inter­net and oth­er com­mu­ni­ca­tions tech­nolo­gies, the less we are secure from eaves­drop­ping by oth­ers. Our choice isn’t between a dig­i­tal world where the NSA can eaves­drop and one where the NSA is pre­vent­ed from eaves­drop­ping; it’s between a dig­i­tal world that is vul­ner­a­ble to all attack­ers, and one that is secure for all users.

    Fix­ing this prob­lem is going to be hard. We are long past the point where sim­ple legal inter­ven­tions can help. The bill in Con­gress to lim­it NSA sur­veil­lance won’t actu­al­ly do much to lim­it NSA sur­veil­lance. Maybe the NSA will fig­ure out an inter­pre­ta­tion of the law that will allow it to do what it wants any­way. Maybe it’ll do it anoth­er way, using anoth­er jus­ti­fi­ca­tion. Maybe the FBI will do it and give it a copy. And when asked, it’ll lie about it.

    NSA-lev­el sur­veil­lance is like the Mag­inot Line was in the years before World War II: inef­fec­tive and waste­ful. We need to open­ly dis­close what sur­veil­lance we have been doing, and the known inse­cu­ri­ties that make it pos­si­ble. We need to work toward secu­ri­ty, even if oth­er coun­tries like Chi­na con­tin­ue to use the Inter­net as a giant sur­veil­lance plat­form. We need to build a coali­tion of free-world nations ded­i­cat­ed to a secure glob­al Inter­net, and we need to con­tin­u­al­ly push back against bad actors—both state and non-state—that work against that goal.

    Secur­ing the Inter­net requires both laws and tech­nol­o­gy. It requires Inter­net tech­nol­o­gy that secures data wher­ev­er it is and how­ev­er it trav­els. It requires broad laws that put secu­ri­ty ahead of both domes­tic and inter­na­tion­al sur­veil­lance. It requires addi­tion­al tech­nol­o­gy to enforce those laws, and a world­wide enforce­ment regime to deal with bad actors. It’s not easy, and has all the prob­lems that oth­er inter­na­tion­al issues have: nuclear, chem­i­cal, and bio­log­i­cal weapon non-pro­lif­er­a­tion; small arms traf­fick­ing; human traf­fick­ing; mon­ey laun­der­ing; intel­lec­tu­al prop­er­ty. Glob­al infor­ma­tion secu­ri­ty and anti-sur­veil­lance needs to join those dif­fi­cult glob­al prob­lems, so we can start mak­ing progress.

    The Pres­i­den­t’s Review Group rec­om­men­da­tions are large­ly pos­i­tive, but they don’t go near­ly far enough. We need to rec­og­nize that secu­ri­ty is more impor­tant than sur­veil­lance, and work towards that goal.

    There’s a lot to digest in that piece but note this part at the end:

    It requires addi­tion­al tech­nol­o­gy to enforce those laws, and a world­wide enforce­ment regime to deal with bad actors. It’s not easy, and has all the prob­lems that oth­er inter­na­tion­al issues have: nuclear, chem­i­cal, and bio­log­i­cal weapon non-pro­lif­er­a­tion; small arms traf­fick­ing; human traf­fick­ing; mon­ey laun­der­ing; intel­lec­tu­al prop­er­ty. Glob­al infor­ma­tion secu­ri­ty and anti-sur­veil­lance needs to join those dif­fi­cult glob­al prob­lems, so we can start mak­ing progress.

    Yes, in some sens­es sur­veil­lance abus­es do share some of the chal­lenges with nuclear, chem­i­cal, and bio­log­i­cal weapon non-pro­lif­er­a­tion, small arms traf­fick­ing, human traf­fick­ing, etc. But isn’t sur­veil­lance, at least tar­get­ed sur­veil­lance, also part of the solu­tion to nuclear, chem­i­cal, and bio­log­i­cal weapon non-pro­lif­er­a­tion, small arms traf­fick­ing, human traf­fick­ing, etc?

    So do we break up the NSA and place all spy­ing under the aus­pices of the FBI, even spy­ing on for­eign lead­ers? Should we instead trans­fer all domes­tic spy­ing to the FBI and then declare all for­eign sur­veil­lance a mil­i­tary act and reg­u­lat­ed by “a coali­tion of free-world nations ded­i­cat­ed to a secure glob­al Inter­net”? Or will we end up attempt­ing to leg­is­late back­doors and legal access like the EU’s counter-ter­ror­ism chief is call­ing for?

    These are just some of the issues swirling around the issue how to han­dle the roll out of ubiq­ui­tous, end-to-end strong-encryp­tion. If you aren’t famil­iar with this emerg­ing pub­lic debate yet, you will be even­tu­al­ly, because they aren’t going away any time soon. Untan­gling a glob­al Mex­i­can stand­off that’s been going on since the dawn of civ­i­liza­tion isn’t as easy as you might expect. It’s going to take a while.

    Posted by Pterrafractyl | January 27, 2015, 7:37 pm
  6. Marks Ames has a recent piece that points us towards a rule in the 1986 Elec­tron­ic Com­mu­ni­ca­tions Pri­va­cy Act that is both sur­pris­ing and not sur­pris­ing: It’s sur­pris­ing because, wow, it’s kind of amaz­ing that the US gov­ern­ment has the rights to read your emails over 180 days old with­out a war­rant and yet this fun fact real­ly has­n’t made it into the nation­al dis­course over the near­ly two years since the Snow­den Affair start­ed.

    At the same time, it should­n’t real­ly be sur­pris­ing at since it’s been the law since 1986:

    Pan­do Dai­ly

    Meet the ser­i­al fail­ures in charge of pro­tect­ing America’s online pri­va­cy

    By Mark Ames
    On Feb­ru­ary 15, 2015

    Ear­li­er this week, McClatchey pub­lished an arti­cle remind­ing read­ers of some­thing that can’t be repeat­ed enough: Thanks to the 1986 Elec­tron­ic Com­mu­ni­ca­tions Pri­va­cy Act, the gov­ern­ment can read all your emails over 180 days old with­out a war­rant. That’s what the law says — and yet it remains obscure enough that every time some nation­al media reminds us, it still shocks the sens­es.

    McClatchy writes:

    Lit­tle known to most Amer­i­cans, ambigu­ous lan­guage in a com­mu­ni­ca­tions law passed in 1986 extends Fourth Amend­ment pro­tec­tions against unrea­son­able search and seizure only to elec­tron­ic com­mu­ni­ca­tions sent or received few­er than 180 days ago.

    The lan­guage, known as the “180-day rule,” allows gov­ern­ment offi­cials to treat any emails, text mes­sages or doc­u­ments stored on remote servers – pop­u­lar­ly known as the cloud – as “aban­doned” and there­fore acces­si­ble using admin­is­tra­tive sub­poe­na pow­er, a tac­tic that crit­ics say cir­cum­vents due process.

    As you rush to purge your Gmail and Drop­box accounts, how­ev­er, be fore­warned that even delet­ed files still could be fair game as long as copies exist on a third-par­ty serv­er some­where.

    Unsur­pris­ing­ly, there have been attempts over the years to reform the law, but so far they’ve all end­ed in fail­ure. And it’s when we start to dig into the rea­son for those fail­ures that things do get sur­pris­ing.

    As it turns out, many of the “pri­va­cy activists” who are sup­posed to pro­tect us from laws like this, and who are today lead­ing the cru­sade against the 1986 ECPA law, are the same peo­ple and orga­ni­za­tions who col­lud­ed with the gov­ern­ment to put that law on the books in the first place.

    Today there’s a big push for a bill called, some­what con­fus­ing­ly, the Elec­tron­ic Com­mu­ni­ca­tions Pri­va­cy Act Amend­ments Act Amend­ments Act that’s sup­posed to rem­e­dy this giant hole in online pri­va­cy. The bill is co-authored by pro­gres­sive Demo­c­rat (and occa­sion­al Bat­man cameo) Sen. Patrick Leahy of Ver­mont, and Tea Par­ty Repub­li­can Sen. Mike Lee of Utah. Per­haps more impor­tant­ly, the ECPA Amend­ment Act — and its House ver­sion, the “Email Pri­va­cy Act” — has the sup­port of both the Sil­i­con Val­ley Establishment—Google, Apple, Face­book, Ama­zon et al—and the civ­il lib­er­tar­i­an estab­lish­ment: the ACLU, the Elec­tron­ic Fron­tier Foun­da­tion, the Cen­ter for Democ­ra­cy and Tech­nol­o­gy, and oth­ers.

    But as McClatchy notes, this “solu­tion” to the ear­li­er law’s prob­lem turns out to cre­ate a brand new pri­va­cy prob­lem: Under both Leahy’s Sen­ate bill and the House “Email Pri­va­cy Act,” the same gov­ern­ment snoops will still be able to access all email user meta­da­ta:

    In oth­er words, the Email Pri­va­cy Act would not extend Fourth Amend­ment pro­tec­tions to “non-con­tent” data. Even if the bill becomes law, cus­tomers’ names, loca­tions, address­es, rout­ing infor­ma­tion and sub­scriber net­work address­es still could be sub­poe­naed with­out a war­rant and with­out notice, although access­ing the con­tent of their con­ver­sa­tions would require the autho­riza­tion of a judi­cial mag­is­trate or judge.

    As we learned from the Snow­den secrets, gov­ern­ment intel­li­gence agen­cies like the NSA are at least as inter­est­ed in col­lect­ing user meta­da­ta as they are in col­lect­ing con­tent. Yet the won­der­ful solu­tion, the Leahy-Lee bill, allows war­rant­less gov­ern­ment sur­veil­lance of our email meta­da­ta:

    “the gov­ern­ment may use an admin­is­tra­tive or grand jury sub­poe­na in order to obtain cer­tain kinds of elec­tron­ic com­mu­ni­ca­tion records from a 1service provider, includ­ing cus­tomer name, address, ses­sion time records, length of ser­vice infor­ma­tion, sub­scriber num­ber and tem­porar­i­ly assigned net­work address, and means and source of pay­ment infor­ma­tion.”

    So that rais­es the ques­tion: Why are these lead­ing civ­il libertarian/privacy advo­cates lob­by­ing for a law that doesn’t pro­tect our pri­va­cy or extend Fourth Amend­ment pro­tec­tions to our email meta­da­ta?

    To begin under­stand­ing that, you first have to look at the names of the folks push­ing the Elec­tron­ic Com­mu­ni­ca­tions Pri­va­cy Act Amend­ment Act “fix” to the 1986 Elec­tron­ic Com­mu­ni­ca­tions Pri­va­cy Act, and then com­pare them to those involved in the 1986 law. Wouldn’t you know it: The 1986 law was co-spon­sored by a younger Sen. Patrick Leahy, and came into being thanks to the lob­by­ing efforts of the ACLU and its chief leg­isla­tive coun­sel, Jer­ry Berman.

    In my last depress­ing sto­ry about how the ACLU col­lud­ed with the CIA to write the Rea­gan-era law that jailed CIA whistle­blow­er John Kiri­ak­ou, I wrote about how Jer­ry Berman was one of the key ACLU col­lab­o­ra­tors in craft­ing that anti-whistle­blow­er law with CIA direc­tor Bill Casey’s peo­ple. I also revealed Berman’s con­tro­ver­sial role—as exec­u­tive direc­tor of the Elec­tron­ic Fron­tier Foun­da­tion— in col­lab­o­rat­ing with the FBI in pass­ing the 1994 Dig­i­tal Tele­pho­ny Bill, which expand­ed FBI sur­veil­lance of the Inter­net.

    In 1986, Berman served as the ACLU’s chief leg­isla­tive coun­sel in Wash­ing­ton DC, and he also led a new ACLU project focused on pri­va­cy and the new fast-grow­ing tech­nol­o­gy sec­tor: The ACLU Project on Pri­va­cy and Tech­nol­o­gy. In these capac­i­ties, Berman and the ACLU pro­vid­ed the nec­es­sary lib­er­al cov­er to bring togeth­er indus­try and gov­ern­ment sur­veil­lance inter­ests to craft the new bill.

    As the New York Times report­ed in late 1986, in an arti­cle head­lined “Tac­ti­cal Alliances and the A.C.L.U.”:

    Michael F. Cavanagh, exec­u­tive direc­tor of the Elec­tron­ic Mail Asso­ci­a­tion, a trade group, said the A.C.L.U. had “played a cen­tral role” in assem­bling the coali­tion that won approval for the Elec­tron­ic Com­mu­ni­ca­tions Pri­va­cy Act of 1986. The law updates Fed­er­al wire­tap statutes to pro­tect the pri­va­cy of cel­lu­lar tele­phone calls, com­put­er data com­mu­ni­ca­tions and satel­lite tele­vi­sion trans­mis­sions.

    In anoth­er arti­cle about the bill, the Times quotes Berman sell­ing it on “philo­soph­i­cal” grounds rather than mere­ly eco­nom­ic, deft­ly lever­ag­ing the ACLU’s pro­gres­sive cred­i­bil­i­ty:

    For the Amer­i­can Civ­il Lib­er­ties Union, a major force behind the bill, the com­mit­ment is philo­soph­i­cal rather than eco­nom­ic. “This is a very good bill,” said Jer­ry Berman, the head of the union’s Pri­va­cy Tech­nol­o­gy Project, who worked to bring the busi­ness groups togeth­er. “It demon­strates that you can put togeth­er a pri­va­cy coali­tion and make it work.”

    ...

    In 1992, Berman left the ACLU for the Elec­tron­ic Fron­tier Foun­da­tion to take the Sil­i­con Val­ley tech­no-lib­er­tar­i­an rev­o­lu­tion to Wash­ing­ton… bring­ing the EFF’s dual-pur­pose func­tion as online pri­va­cy advo­cate, and lob­by front for its Big Tech fun­ders’ inter­ests, into the lair of the fed­er­al leviathan. In 1994, Berman brought oth­er key peo­ple from the ACLU’s Projects on Pri­va­cy and Tech­nol­o­gy into the Elec­tron­ic Fron­tier Foun­da­tion with him—Janlori Gold­man and Daniel Weitzn­er. Berman’s for­mer ACLU team, now at the EFF, went to work in col­lab­o­ra­tion with the FBI and with—who else?—Sen. Patrick Leahy to draft the Dig­i­tal Tele­pho­ny Law that expand­ed FBI sur­veil­lance of the Inter­net, and near­ly destroyed the EFF.

    The sub­ti­tle to an old Wired mag­a­zine arti­cle from 1994 shows just how sil­ly (and stag­nant) the EFF’s cyber-rev­o­lu­tion­ary expec­ta­tions were—and how bad­ly, in a famil­iar old-econ­o­my way, every­thing turned out when this same crowd led that reform bill:

    The Elec­tron­ic Fron­tier Foun­da­tion went to Wash­ing­ton to “reverse-engi­neer gov­ern­ment, hack pol­i­tics down to its com­po­nent parts, and fix it.” Then it helped pass the FBI’s loath­some “let’s‑just-wiretap-everyone” Dig­i­tal Tele­pho­ny Bill. And dis­cov­ered it was Wash­ing­ton that had reverse-engi­neered the EFF, dri­ving it into dis­sen­sion, debt, dis­grace – and right out of town

    After that fias­co, Berman and his for­mer ACLU Project on Pri­va­cy and Tech­nol­o­gy team left the EFF to found the Cen­ter for Democ­ra­cy and Tech­nol­o­gy (CDT), which has remained a top DC lob­by group for Big Tech ever since. (Mean­while back at the ACLU, the Berman “pri­va­cy and tech­nol­o­gy” project reap­peared under the sim­i­lar­ly-named “ACLU Projects on Speech, Pri­va­cy and Tech­nol­o­gy” — led today by the ACLU’s Ben Wiz­n­er, Edward Snowden’s lawyer, along with online pri­va­cy celebri­ty-activist Chris Soghoian)

    Which brings us to today, in which we find our­selves deal­ing with the appalling con­se­quences of the 1986 bill cob­bled togeth­er by the ACLU, led by Jer­ry Berman, and co-spon­sored by Patrick Leahy. First of all, why didn’t the ACLU, the EFF, the CDT or their crowd warn us all these decades? Why did it take them so god­damn long to tell us, “Oops! We screwed up! The bill we wrote to pro­tect you actu­al­ly allows the gov­ern­ment total access to all your 180-plus-old email cor­re­spon­dences, we just for­got to scare you about it all these decades!”

    Well, in fact they still haven’t done that, because that would mean admit­ting they’re part of the prob­lem. Instead, these same out­fits are shak­ing their fists in right­eous out­rage over the law they helped pass. On the ACLU’s web­page attack­ing the 1986 ECTA, there’s not a sin­gle men­tion of the “cen­tral role” that the orga­ni­za­tion played in get­ting it passed.

    The same goes with the web­site for Dig­i­tal Due Process the main lob­by coali­tion fight­ing to replace bad ECPA with good, new & improved EPCA-Amend­ment Act. Dig­i­tal Due Process was found­ed in 2010 by none oth­er than Jer­ry Berman; it brings togeth­er all the big names in Sil­i­con Valley—Google, Apple, Facebook—with all the big civ­il lib­er­tar­i­an groups like the ACLU, EFF, CDT and so on: fun­ders and fund­ed, all work­ing self­less­ly on our behalf to pro­tect us, or so they tell us. And their lead man writ­ing the bad­ly flawed “amend­ment” law that’s sup­posed to solve the prob­lem: Sen. Patrick Leahy.

    The same peo­ple and same civ­il lib­er­tar­i­an groups that have failed us over and over are about to fail us all over again. Aren’t we lucky to have them onDig­i­tal Due Process our side?

    Well that was some fun his­to­ry. And keep in mind that Patrick Leahy real­ly is prob­a­bly one of the most reli­able defend­ers of civ­il lib­er­ties in the Sen­ate so the 1986 Elec­tron­ic Com­mu­ni­ca­tions Pri­va­cy Act and 1994 Dig­i­tal Tele­pho­ny Bill would have prob­a­bly both been a lot worse had it been some­one else craft­ing the leg­is­la­tion and there. To put anoth­er way, the out­come of these bills has a lot more to do with the larg­er nation­al secu­ri­ty state and the immense influ­ence it wields than any giv­en Sen­a­tor. It’s a harsh real­i­ty high­light­ed by the role played by both the ACLU and EFF in craft­ing and endors­ing both bills. When two of the most promi­nent orga­ni­za­tions asso­ci­at­ed with defend­ing dig­i­tal civ­il lib­er­ties turn out to have major cor­po­rate back­ers and helped write the laws that estab­lished war­rant­less access to old emails in 1986 and “let’s-just-wire­tap-every­one” laws in 1994, it’s pret­ty clear that “dig­i­tal due process” has been has­n’t been very like­ly to get the con­sid­er­a­tion its due for a long, long time.

    Also keep in mind that, although access­ing emails old­er than 180 days may not require a war­rant, the emails need to at least be asso­ci­at­ed with some sort of inves­ti­ga­tion. But the bar is still a lot low­er than a war­rant:

    ProP­ub­li­ca
    No War­rant, No Prob­lem: How the Gov­ern­ment Can Get Your Dig­i­tal Data

    by Theodor­ic Mey­er
    June 27, 2014, 9:29 a.m

    Update, June 27, 2014: This post has been updat­ed. It was orig­i­nal­ly pub­lished on Dec. 4, 2012.

    The gov­ern­ment isn’t allowed to wire­tap Amer­i­can cit­i­zens with­out a war­rant from a judge. But there are plen­ty of legal ways for law enforce­ment, from the local sher­iff to the FBI to the Inter­nal Rev­enue Ser­vice, to snoop on the dig­i­tal trails you cre­ate every day. Author­i­ties can often obtain your emails and texts by going to Google or AT&T with a court order that does­n’t require show­ing prob­a­ble cause of a crime. These pow­ers are entire­ly sep­a­rate from the Nation­al Secu­ri­ty Agen­cy’s col­lec­tion of Amer­i­cans’ phone records en masse, which the House of Rep­re­sen­ta­tives vot­ed to end last month.

    Here’s a look at what the gov­ern­ment can get from you and the legal frame­work behind its pow­er:

    How They Get It
    Lis­ten­ing to your phone calls with­out a judge’s war­rant is ille­gal if you’re a U.S. cit­i­zen. But police don’t need a war­rant — which requires show­ing “prob­a­ble cause” of a crime— to mon­i­tor the num­bers for incom­ing and out­go­ing calls in real time, as well as the dura­tion of the calls. Instead, they can get a court to sign off on an order that only requires the data they’re after is “rel­e­vant to an ongo­ing crim­i­nal inves­ti­ga­tion— a less­er stan­dard of evi­dence..The gov­ern­ment can also get his­tor­i­cal phone records with an admin­is­tra­tive sub­poe­na, which does­n’t require a judge’s approval.

    Many cell phone car­ri­ers pro­vide author­i­ties with a phone’s loca­tion and may charge a fee for doing so. Cell tow­ers track where your phone is at any moment; so can the GPS fea­tures in some smart­phones. In response to an inquiry by Sen. Edward J. Markey, a Mass­a­chu­setts Demo­c­rat, Sprint report­ed that it pro­vid­ed loca­tion data to U.S. law enforce­ment 67,000 times in 2012. AT&T report­ed receiv­ing 77,800 requests for loca­tion data in 2012. (AT&T also said that it charges $100 to start track­ing a phone and $25 a day to keep track­ing it.) Oth­er car­ri­ers, includ­ing T‑Mobile, U.S. Cel­lu­lar and Ver­i­zon, did­n’t spec­i­fy the num­ber of loca­tion data requests they had received or the num­ber of times they’ve pro­vid­ed it. Inter­net ser­vice providers can also pro­vide loca­tion data that tracks users via their com­put­er’s IP address — a unique num­ber assigned to each com­put­er.

    The stan­dard for IP address­es is the same as the one for phone records: Author­i­ties can get a court order allow­ing real-time access as long the court approves that the records are rel­e­vant to an inves­ti­ga­tion. They can also get his­tor­i­cal records of IP address­es with an admin­is­tra­tive sub­poe­na.

    Here’s where the rules get real­ly com­pli­cat­ed. Author­i­ties need a war­rant to get unopened emails that are less than 180 days old, but they can obtain opened email as well as unopened emails that are at least 180 days old with only a sub­poe­na as long as they noti­fy the cus­tomer whose email they’ve request­ed. The gov­ern­ment can also get old­er unopened emails with­out noti­fy­ing the cus­tomer if they get a court order that requires them to offer “spe­cif­ic and artic­u­la­ble facts show­ing that there are rea­son­able grounds to believe” the emails are “rel­e­vant and mate­r­i­al to an ongo­ing crim­i­nal inves­ti­ga­tion” — a high­er bar than a sub­poe­na. How often does the gov­ern­ment request emails? Google says it got 16,407 requests for data in total — includ­ing emails sent through its Gmail ser­vice — from U.S. law enforce­ment agen­cies in 2012, and an addi­tion­al 10,918 requests in the first half of 2013. Microsoft, with its Out­look and Hot­mail email ser­vices, says it received 11,073 requests from U.S. author­i­ties in total in 2012, and an addi­tion­al 7,014 in the first half of 2013. The com­pa­ny pro­vid­ed some cus­tomer data in 75.8 per­cent of the 2013 requests. (The fig­ures don’t include requests for data from Skype, which Microsoft owns.) And Yahoo says it received 12,444 such requests in the first half of 2013, pro­vid­ing at least some cus­tomer data in 91.6 per­cent of them. (The Depart­ment of Jus­tice requires providers to wait six months before releas­ing data on the requests.) A coali­tion of tech­nol­o­gy com­pa­nies, includ­ing Apple, Google and AT&T, is lob­by­ing to change the law to require a search war­rant for email and oth­er dig­i­tal data stored remote­ly.

    ...

    Note that the coali­tion of tech­nol­o­gy com­pa­nies men­tioned in the arti­cle that are lob­by­ing to change the law to require a search war­rant is the same “Dig­i­tal Due Process” orga­ni­za­tion Mark Ames dis­cussed above that was start­ed in 2010 by Jer­ry Berman (who helped write both the 1986 and 1994 laws). Also note that the “News” page for “Dig­i­tal Due Process” has­n’t been update since April 2013, a month before the start of the Snow­den Affair, which is kind of curi­ous all things con­sid­ered.

    So it’s pret­ty clear that, while war­rants aren’t cur­rent­ly nec­es­sary for rum­mag­ing through your old emails and phone records, that might change if the new “Email Pri­va­cy Act” becomes law. And yet, as Mark Ames point­ed out above, while the new “Email Pri­va­cy Act” bill being debat­ed in con­gress would indeed require a war­rant for access­ing old emails, it still leaves meta­da­ta open to war­rant­less access and the bill .

    Now, putting aside the ques­tion of whether or not some gov­ern­ment agen­cies should have war­rant­less access to meta­da­ta, it’s real­ly quite remark­able that anoth­er indus­try-fund­ed group led by the same man, Jer­ry Berman, is once again help­ing craft the laws that define our dig­i­tal pri­va­cy rights. But it’s even more remark­able that this new “Email Pri­va­cy Act” is going to allow war­rant­less meta­da­ta access and there’s so lit­tle atten­tion being paid to it, espe­cial­ly since the bill is endorsed by an array of indus­try-backed groups like the ACLU, EFF, and Dig­i­tal Due Process. That seems like a big sto­ry!

    This is part of the rea­son it’s unfor­tu­nate that the post-Snow­den debates are tak­ing place in a larg­er polit­i­cal envi­ron­ment where there most inter­est­ed par­ties aren’t real­ly inter­est­ed in a debate. For the most part, we hear from:
    1. Nation­al secu­ri­ty hawks that view enhanced dig­i­tal due process as a unaf­ford­able lux­u­ry in an age of ter­ror­ist net­works, rogues states and super weapons and see no rea­son for the pub­lic to be con­cerned about the poten­tial abus­es of vast and grow­ing sur­veil­lance capa­bil­i­ties.

    or

    2. Lib­er­tar­i­ans and Cypher­punks that have already writ­ten off the pos­si­ble of effec­tive inter­nal safe­guards in gov­ern­ment bureau­cra­cies and see strong­ly encrypt­ing every­thing as the only fea­si­ble solu­tion to gov­ern­ment sur­veil­lance abus­es.

    The much less tan­ta­liz­ing dis­cus­sions about how to cre­ate rules that both secu­ri­ty hawks and pri­va­cy activists can live with in the event that Con­gress does­n’t live up to either side’s dreams and writes com­pro­mise leg­is­la­tion (like the Email Pri­va­cy Act) haven’t real­ly tak­en place in the nation­al dia­logue. For issues like meta­da­ta col­lec­tion the pri­va­cy activist com­mu­ni­ty has focused on the devel­op­ment of tech­no­log­i­cal plat­forms like Tor that make meta­da­ta col­lec­tion impos­si­ble and improv­ing secu­ri­ty pro­to­cols to pre­vent gov­ern­ment hack­ing where­as the secu­ri­ty hawks see the whole issue as triv­ial.

    This dynam­ic of either dis­miss­ing pri­va­cy con­cerns out­right or focus­ing on tech­nol­o­gy that blocks all sur­veil­lance com­plete­ly, with­out much dis­cus­sion of what parts of our dig­i­tal selves should fall into the gray area of data that should be avail­able, but only with a war­rant or some oth­er safe­guard (and how to imple­ment those safe­guards effec­tive­ly and trans­par­ent­ly), is all part of the larg­er trend of the main­stream­ing of Lib­er­tar­i­an/­pseu­do-anar­chist/a­n­ar­cho-cap­i­tal­ist think­ing that revolves around the aban­don­ment of the idea that we can cre­ate a gov­ern­ment by, of, and for the peo­ple that does­n’t pro­ceed to abuse the peo­ple.

    It’s an unfor­tu­nate sit­u­a­tion because now we appear to be fac­ing a rewrite of the dig­i­tal pri­va­cy laws that don’t extend 4th amend­ment rights to meta­da­ta and the robust debate over how to han­dle exact­ly this kind of sit­u­a­tion has­n’t real­ly hap­pened. Instead, we get some­thing like “If the gov­ern­ment will not be stew­ards of our rights, we can encode our rights into our sys­tem.”:

    Pan­do Dai­ly
    Snow­den praised for fight­ing gov­ern­ment sur­veil­lance… by group that LOVES cor­po­rate sur­veil­lance

    By Mark Ames
    On Feb­ru­ary 20, 2015
    Last Fri­day, NSA whistle­blow­er Edward Snow­den Skyped into a Wash­ing­ton DC Mar­riott Hotel con­fer­ence hall to proud­ly accept “The Stu­dents For Lib­er­ty Alum­nus of the Year Award.”

    The Stu­dents For Lib­er­ty describes itself as “a rapid­ly grow­ing net­work of pro-lib­er­ty stu­dents from all over the world.” Their big award was giv­en to Snow­den for “ini­ti­at­ing a glob­al con­ver­sa­tion on the bal­ance of pow­er between gov­ern­ments and peo­ples that has led to and con­tin­ues to bring about mean­ing­ful reforms to intru­sive, abu­sive, and unjust gov­ern­ment sur­veil­lance pro­grams.”

    If your award is con­cerned about how the gov­ern­ment is using tech­nol­o­gy to sur­veil cit­i­zens then Edward Snow­den is an uncon­tro­ver­sial win­ner. Not only did Snow­den expose gov­ern­ment sur­veil­lance but, as a for­mer intel­li­gence con­trac­tor, he exposed how much gov­ern­ment sur­veil­lance is han­dled by pri­vate com­pa­nies.

    In accept­ing his award, Snow­den told the audi­ence: “As they take the pri­vate records of all our lives, and they aggre­gate a dossier, how can that be said to be con­sti­tu­tion­al?”

    All of which makes it slight­ly shock­ing to dis­cov­er the iden­ti­ty of anoth­er recent win­ner of Stu­dents For Liberty’s big award: Peter Thiel, the founder of one of the NSA’s biggest con­trac­tors, Palan­tir Tech­nolo­gies. If a gov­ern­ment is try­ing to dig through pri­vate records and aggre­gate a dossier, Palan­tir is the com­pa­ny they call.

    Snowden’s neme­sis, for­mer NSA chief Kei­th Alexan­der, praised Palantir’s use­ful­ness to the spy agency, for pro­vid­ing “a way of visu­al­iz­ing what’s going on in the net­works.” Alexan­der was talk­ing about net­works of ter­ror­ists, but he was tes­ti­fy­ing because just one year before Stu­dents For Lib­er­ty award­ed Thiel, Palan­tir was caught help­ing the US Cham­ber of Com­merce visu­al­ize net­works of its crit­ics and of Wik­iLeaks’ cir­cle of sup­port­ers — includ­ing Snowden’s clos­est jour­nal­ism con­fi­dante, Glenn Green­wald. (Indeed Green­wald has char­ac­ter­ized Pando’s crit­i­cism of him as a CIA plot hatched by Thiel, whose Founders Fund pre­vi­ous­ly invest­ed around $300k in Pan­do.)

    Stu­dents For Lib­er­ty hon­ored Thiel just three years ago, so it’s not like a sea­soned spy would have to research hard to find out with whom he now shares an “Alum­nus of the Year Award.” In fact, the Palan­tir co-founder was the very first win­ner of the SFL “Alum­nus of the Year” award back in 2012. A quick Google of the award brings up scores of links to Thiel address­ing the Stu­dents For Lib­er­ty.

    In addi­tion to prais­ing Snow­den at last week’s cer­e­mo­ny, Stu­dents For Lib­er­ty also award­ed their “Event of the Year” to anti-Marx­ist lib­er­tar­i­an stu­dents at Hon­duras’ Nation­al Uni­ver­si­ty for brave­ly col­lab­o­rat­ing with the uni­ver­si­ty admin­is­tra­tion to suc­cess­ful­ly destroy a left­wing stu­dent protest cam­paign. Left­ists and jour­nal­ists in Hon­duras have been ter­ror­ized ever since a 2009 US-backed coup over­threw pres­i­dent Manuel Zelaya.

    Despite that, as Edward Snow­den told the Mar­riott con­fer­ence hall packed full of lib­er­tar­i­an Tra­cy Flicks and bud­ding Joe McCarthys, these Stu­dents For Lib­er­ty types are his kind of crowd:

    “I think many of the peo­ple in this room take a more pro-lib­er­ty pro-rights per­spec­tive than oth­ers in the U.S. polit­i­cal agree­ment.”

    Snow­den also revealed him­self as a bud­ding Jeff Jarvis of gov­ern­ment whistle­blow­ers, par­rot­ing old cyberutopi­an plat­i­tudes:

    “If the gov­ern­ment will not be stew­ards of our rights, we can encode our rights into our sys­tem.”

    It’s talk like that that gets Snow­den invit­ed to room­ba around TED Talks stages.

    So what exact­ly is “Stu­dents For Lib­er­ty”? Accord­ing to its web­site, “Stu­dents For Lib­er­ty has grown into the largest lib­er­tar­i­an stu­dent orga­ni­za­tion in the world, with over 800 stu­dent lead­ers sup­port­ing over 1,350 stu­dent groups rep­re­sent­ing over 100,000 stu­dents on all inhab­it­ed con­ti­nents.”

    Like most of the lib­er­tar­i­an nomen­klatu­ra, this group gets most of its mon­ey from the Koch broth­ers. Google, anoth­er cor­po­ra­tion which has worked close­ly with the US gov­ern­ment, recent­ly joined the list of big cor­po­rate spon­sors. SFL’s Board of Advi­sors includes such heroes of free­dom as “His Serene High­ness Prince von Liecht­en­stein” — whose roy­al fam­i­ly rules over an exclu­sive off­shore bank­ing tax haven favored by glob­al bil­lion­aires who think Switzer­land is too trans­par­ent.

    ...

    That’s right, Stu­dents for Lib­er­ty’s back­ers aren’t lim­it­ed to the Koch broth­ers, Google, and oth­er big cor­po­rate spon­sors. The Stu­dents for Lib­er­ty’s board of advi­sors includes Prince Michael of Liecht­en­stein. But note that he’s #38 in the line of suc­ces­sion, so he’s an every­man prince, not some high­fa­lutin prince.

    Con­tin­u­ing...

    ...
    The group was formed in 2008 by Alexan­der McCobin, while he was work­ing in the mar­ket­ing depart­ment of the Cato Insti­tute (neé “The Charles Koch Foun­da­tion”). The idea to form SFL came a year ear­li­er in 2007, while McCobin was in the Charles G. Koch Sum­mer Fel­low Pro­gram at the Insti­tute For Humane Stud­ies, where Charles G. Koch serves as chair­man of the board. (My edi­tor Paul Carr is prob­a­bly get­ting blis­ters jam­ming his fore­fin­ger on the “Koch Alarm” sound effect he plays on Pan­do­LIVE when­ev­er I men­tion the Kochs. But hey, don’t blame me for these two-legged DC car­i­ca­tures, I just reports the facts.)

    In 2009, McCobin and his fiancée were sued by for­mer col­leagues at the Uni­ver­si­ty of Penn­syl­va­nia for alleged­ly mis­ap­pro­pri­at­ing funds from a non­prof­it to help high school stu­dents learn debat­ing skills. McCobin was also the founder of Penn Lib­er­tar­i­ans.

    When McCobin’s group gave their award to Peter Thiel, their “west coast direc­tor” described Thiel on stage as a “per­son­al role mod­el of mine.”

    Indeed, Thiel’s pres­ence was every­where at the Stu­dents For Lib­er­ty schmooz­er this year, even if the man him­self was absent. After Snowden’s skyped appear­ance, lib­er­tar­i­an celebri­ty Ron Paul took the stage with long­time Cato Insti­tute board direc­tor and FoxNews truther Andrew Napoli­tano. Ron Paul’s 2012 cam­paign for pres­i­dent — sup­port­ed by Snow­den and Green­wald — was almost entire­ly fund­ed by Peter Thiel.

    The fol­low­ing night, Stu­dents For Lib­er­ty fea­tured Ron Paul’s stub­by heir, Sen. Rand Paul — whose run for pres­i­dent in 2016 is being fund­ed by Thiel’s co-founder at Palan­tir, Joe Lons­dale, who serves on Rand Paul’s finance team and co-host­ed Sil­i­con Val­ley fundrais­ers.

    In 2011, Palan­tir spon­sored the Elec­tron­ic Fron­tier Foundation’s Pio­neer Awards, whose illus­tri­ous list of win­ners includes Glenn Green­wald and Lau­ra Poitras, the Tor Project, and EFF co-founder Mitch Kapor as well as EFF Fel­low Cory Doc­torow.

    ...

    “When McCobin’s group gave their award to Peter Thiel, their “west coast direc­tor” described Thiel on stage as a “per­son­al role mod­el of mine.”

    Well, does­n’t “Stu­dents for Lib­er­ty” sound nice! Yes indeed:

    ...

    Like most of the lib­er­tar­i­an nomen­klatu­ra, this group gets most of its mon­ey from the Koch broth­ers. Google, anoth­er cor­po­ra­tion which has worked close­ly with the US gov­ern­ment, recent­ly joined the list of big cor­po­rate spon­sors. “SFL’s Board of Advi­sors includes such heroes of free­dom as “His Serene High­ness Prince von Liecht­en­stein” — whose roy­al fam­i­ly rules over an exclu­sive off­shore bank­ing tax haven favored by glob­al bil­lion­aires who think Switzer­land is too trans­par­ent.”

    The group was formed in 2008 by Alexan­der McCobin, while he was work­ing in the mar­ket­ing depart­ment of the Cato Insti­tute (neé “The Charles Koch Foun­da­tion”). The idea to form SFL came a year ear­li­er in 2007, while McCobin was in the Charles G. Koch Sum­mer Fel­low Pro­gram at the Insti­tute For Humane Stud­ies, where Charles G. Koch serves as chair­man of the board

    ...

    Yikes. Well, in defense of Stu­dents for Lib­er­ty, they could be debat­ably worse!

    Still, it’s pret­ty clear that when you ask the ques­tion “who does Stu­dents for Lib­er­ty fight for?” the answer is “the Koch broth­ers and oth­er Lib­er­tar­i­an oli­garchs”. And that’s one of the nice things about a group like Stu­dents for Lib­er­ty: they’re pret­ty trans­par­ent. The cor­po­rate con­nec­tions to orga­ni­za­tions like the EFF and Dig­i­tal Due Process, which are also heav­i­ly backed by Sil­i­con Val­ley, aren’t near­ly as obvi­ous. And now we find our­selves in a sit­u­a­tion where these indus­try-backed groups are push­ing a major over­haul of dig­i­tal pri­va­cy rules that it seems like they should be oppos­ing based on their stat­ed prin­ci­ples and goals.

    It’s all a reminder that, even to this day in the US, the biggest orga­ni­za­tions fight­ing to pro­tect your dig­i­tal data from Big Gov­ern­ment were, them­selves, orga­nized and financed by Big Tech...Big Tech that is increas­ing­ly inter­wo­ven into the mil­i­tary indus­tri­al com­plex. Might there be a con­flict of inter­est here? It seems pos­si­ble.

    Posted by Pterrafractyl | February 24, 2015, 8:23 pm
  7. Here’s anoth­er exam­ple of why future Supreme Court rul­ings on strong encryp­tion and the 5th Amend­ment are going to be very close­ly watched cas­es:

    Boing­Bo­ing
    Report: Dur­ing Cana­da tax raid, Uber “remote­ly encrypt­ed cor­po­rate data”

    By Xeni Jardin at 6:58 am Fri, May 29, 2015

    An item in the French-lan­guage Cana­di­an news­pa­per La Presse that has been mak­ing the Eng­lish-lan­guage rounds this week, rough­ly trans­lat­ed here in part:

    “Uber Engi­neers in San Fran­cis­co tried to remote­ly encrypt data in Uber Cana­da com­put­ers dur­ing a search con­duct­ed by Revenu Québec in Mon­tre­al last week.

    “This is what Revenu Québec claims in a state­ment filed before Judge Jean-Pierre Braun last week, a copy of which La Presse has obtained. Uber sought to chal­lenge this state­ment before the judge, but has not had the oppor­tu­ni­ty, we learn in the injunc­tion Uber also pre­sent­ed in court last week.”

    “Search for Uber Cana­da offices: On May 14, fif­teen Revenu Québec inves­ti­ga­tors con­duct­ed search­es for com­put­er data at the admin­is­tra­tive offices of Uber Cana­da, Notre Dame. Inves­ti­ga­tors are look­ing for evi­dence to prove that Uber Cana­da vio­lates Cana­di­an tax law by not col­lect­ing GST and QST on behalf of its UberX dri­vers.”

    “Around 10:40, one of the inves­ti­ga­tors found that ‘mobile devices such as lap­tops, smart phones and tablets were restart­ed remote­ly’ dur­ing the seizure. Anoth­er inves­ti­ga­tor, who per­formed a sec­ond search in anoth­er office, expe­ri­enced the same, also at 10:40am.”

    More trou­ble for Uber around the cor­ner in Cana­da? We’ll see...

    Posted by Pterrafractyl | May 29, 2015, 6:08 pm
  8. Oh look, a con­sor­tium of 14 mega-banks have pri­vate­ly devel­oped a spe­cial super-secure inter-bank mes­sag­ing sys­tem that uses end-to-end strong encryp­tion and per­ma­nent­ly deletes data. It’s so super-secure
    finan­cial reg­u­la­tors are won­der if they’ll actu­al­ly have access to the data:

    Finan­cial Times

    NY reg­u­la­tor sends mes­sage to Sym­pho­ny

    Ben McLan­na­han in New York and Gina Chon in Wash­ing­ton
    Last updat­ed: July 22, 2015 10:08 pm

    New York’s state bank­ing reg­u­la­tor has fired a shot across the bows of Sym­pho­ny, a mes­sag­ing ser­vice about to be launched by a con­sor­tium of Wall Street banks and asset man­agers, by call­ing for infor­ma­tion on how it man­ages — and deletes — cus­tomer data.

    In a let­ter on Wednes­day to David Gurle, the chief exec­u­tive of Sym­pho­ny Com­mu­ni­ca­tion Ser­vices, the New York Depart­ment of Finan­cial Ser­vices asked it to clar­i­fy how its tool would allow firms to erase their data trails, poten­tial­ly falling foul of laws on record-keep­ing.

    The let­ter, which was signed by act­ing super­in­ten­dent Antho­ny Albanese and shared with the press, not­ed that cha­t­room tran­scripts had formed a crit­i­cal part of author­i­ties’ inves­ti­ga­tions into the rig­ging of mar­kets for for­eign exchange and inter­bank loans. It called for Sym­pho­ny to spell out its doc­u­ment reten­tion capa­bil­i­ties, poli­cies and fea­tures, cit­ing two spe­cif­ic areas of inter­est as “data dele­tion” and “end-to-end encryp­tion”.

    The let­ter marks the first expres­sion of con­cern from reg­u­la­tors over a new ini­tia­tive that has set out to chal­lenge the dom­i­nance of Bloomberg, whose 320,000-plus sub­scribers ping about 200m mes­sages a day between ter­mi­nals using its com­mu­ni­ca­tion tools.

    Peo­ple famil­iar with the mat­ter described the inquiry as an infor­ma­tion gath­er­ing exer­cise, which could con­clude that Sym­pho­ny is a per­fect­ly legit­i­mate enter­prise.

    The NYDFS not­ed that Symphony’s mar­ket­ing mate­ri­als state that “Sym­pho­ny has designed a spe­cif­ic set of pro­ce­dures to guar­an­tee that data dele­tion is per­ma­nent and ful­ly doc­u­ment­ed. We also delete con­tent on a reg­u­lar basis in accor­dance with cus­tomer data reten­tion poli­cies.”

    Mr Albanese also wrote that he would fol­low up with four con­sor­tium mem­bers that the NYDFS reg­u­lates — Bank of New York Mel­lon, Cred­it Suisse, Deutsche Bank and Gold­man Sachs — to ask them how they plan to use the new ser­vice, which will go live for big cus­tomers in the first week of August.

    The reg­u­la­tor said it was keen to find out how banks would ensure that mes­sages cre­at­ed using Sym­pho­ny would be retained, and “whether their use of Symphony’s encryp­tion tech­nol­o­gy can be used to pre­vent review by com­pli­ance per­son­nel or reg­u­la­tors”. It also flagged con­cerns over the open-source fea­tures of the prod­uct, won­der­ing if they could be used to “cir­cum­vent” over­sight.

    The oth­er mem­bers of the con­sor­tium are Bank of Amer­i­ca Mer­rill Lynch, Black­Rock, Citadel, Cit­i­group, HSBC, Jef­feries, JPMor­gan, Mav­er­ick Cap­i­tal, Mor­gan Stan­ley and Wells Far­go. Togeth­er they have chipped in about $70m to get Sym­pho­ny start­ed. Anoth­er San Fran­cis­co-based fund run by a for­mer col­league of Mr Gurle’s, Merus Cap­i­tal, has a 5 per cent inter­est.

    “Sym­pho­ny is built on a foun­da­tion of secu­ri­ty, com­pli­ance and pri­va­cy fea­tures that were built to enable our finan­cial ser­vices and enter­prise cus­tomers to meet their reg­u­la­to­ry require­ments,” said Mr Gurle. “We look for­ward to explain­ing the var­i­ous aspects of our com­mu­ni­ca­tions plat­form to the New York Depart­ment of Finan­cial Ser­vices.”

    ...

    Yes, the usu­al sus­pects for finan­cial high crimes have a brand new mes­sag­ing sys­tem with a fun “per­ma­nent dele­tion” fea­ture and end-to-end encryp­tion that pre­sum­ably no one can break. What could pos­si­bly go wrong? Well, accord­ing to Sym­pho­ny’s back­ers, noth­ing could go wrong because all the infor­ma­tion that banks are required to retain for reg­u­la­to­ry pur­pos­es are indeed retained in the sys­tem. Whether or not reg­u­la­tor’s can actu­al­ly access that retained data, how­ev­er, appears to be more of an open ques­tion:

    New York Busi­ness Jour­nal
    Sym­pho­ny, the ‘What­sApp for Wall Street,’ orches­trates a nuanced response to reg­u­la­to­ry crit­ics

    Michael del Castil­lo Tech­nol­o­gy & Inno­va­tion Edi­tor, Upstart Busi­ness Jour­nal
    Aug 13, 2015, 11:05am EDT

    Sym­pho­ny is tak­ing heat from some in Wash­ing­ton, D.C., D.C. for its What­App-like mes­sag­ing ser­vice that promis­es to encrypt Wall Street’s mes­sages from end to end. At the heart of the con­cern is whether or not the keys used to decrypt the mes­sages will be made avail­able to reg­u­la­tors, or if anoth­er form of back door access will be pro­vid­ed.

    With­out such keys it would be immense­ly more dif­fi­cult to retrace the steps of shady char­ac­ters on Wall Street dur­ing reg­u­la­to­ry inves­ti­ga­tions — an abil­i­ty, which accord­ing to a New York Post report, has result­ed $74 bil­lion in fines over the past five years.

    So, ear­li­er this week Sym­pho­ny took to the blo­gos­phere with a rather detailed expla­na­tion of its plans to be com­pli­ant with reg­u­la­tors. In spite of answer­ing a lot of ques­tions though, one key point was either deft­ly evad­ed, or over­looked.

    What Sym­pho­ny does, accord­ing to the blog post:

    Sym­pho­ny pro­vides its cus­tomers with an inno­v­a­tive “end-to-end” secure mes­sag­ing capa­bil­i­ty that pro­tects com­mu­ni­ca­tions in the cloud from cyber-threats and the risk of data breach, while safe­guard­ing our cus­tomers’ abil­i­ty to retain records of their mes­sages. Sym­pho­ny pro­tects data, not only when it trav­els from “point-to-point” over net­work con­nec­tions, but also the entire time the data is in the cloud.

    How it works:

    Large insti­tu­tions using Sym­pho­ny typ­i­cal­ly will store encryp­tion keys using spe­cial­ized hard­ware key man­age­ment devices known as Hard­ware Secu­ri­ty Mod­ules (HSMs). These mod­ules are installed in data cen­ters and pro­tect an organization’s keys, stor­ing them with­in the secure pro­tect­ed mem­o­ry of the HSM. Firms will use these keys to decrypt data and then feed the data into their record reten­tion sys­tems.

    The crux:

    Sym­pho­ny is designed to inter­face with record reten­tion sys­tems com­mon­ly deployed in finan­cial insti­tu­tions. By help­ing orga­ni­za­tions reli­ably store mes­sages in a cen­tral archive, our plat­form facil­i­tates the rapid and com­plete retrieval of records when need­ed. Sym­pho­ny pro­vides secu­ri­ty while data trav­els through the cloud; firms then secure­ly receive the data from Sym­pho­ny, decrypt it and store it so they can meet their reten­tion oblig­a­tions.

    The poten­tial to store every key-stroke of every employ­ee behind an encrypt­ed wall safe from mali­cious gov­ern­ments and oth­er enti­ties is one that should make Wall Streeters, and those depen­dent on Wall Street resources, sleep a bit bet­ter at night.

    But nowhere in Sym­pho­ny’s blog post does it actu­al­ly say that any of the 14 com­pa­nies which have invest­ed $70 mil­lion in the prod­uct, or any of the forth­com­ing cus­tomers who might sign up to use it, will actu­al­ly share any­thing with reg­u­la­tors. Sure, it will retain all the infor­ma­tion oblig­ed by reg­u­la­tors, which in the right hands is equal­ly use­ful to the com­pa­nies. So there’s no sur­prise there.

    The clos­est we see to any actu­al assur­ance that the Sil­i­con Val­ley-based com­pa­ny plans to share that infor­ma­tion with reg­u­la­tors is that Sym­pho­ny is “designed to inter­face with record reten­tion sys­tems com­mon­ly deployed in finan­cial insti­tu­tions.” Which the­o­ret­i­cal­ly, means the SEC, the DOJ, or any num­ber of reg­u­la­to­ry bod­ies could plug in, assum­ing they had access.

    So, the ques­tions remain, will Sym­pho­ny be build­ing in some sort of back-door access for reg­u­la­tors? Or will it just be stor­ing that infor­ma­tion required of reg­u­la­tors, but for its clients’ use?

    ...

    “So, the ques­tions remain, will Sym­pho­ny be build­ing in some sort of back-door access for reg­u­la­tors? Or will it just be stor­ing that infor­ma­tion required of reg­u­la­tors, but for its clients’ use?”
    As we can see, many reg­u­la­to­ry ques­tions remain. So let’s hope that includes ques­tions like, “If the banks have an unbreak­able inter-bank mes­sag­ing sys­tem that reg­u­la­tors can’t access, aren’t they going to be able to do exact­ly what they did with the mas­sive ‘LIBOR’-rigging con­spir­a­cy, but with no elec­tron­ic paper trail?” It’s an impor­tant ques­tion:

    Bloomberg Busi­ness
    Secret Cur­ren­cy Traders’ Club Devised Biggest Market’s Rates
    Liam Vaugh­an Gavin Finch Bob Ivry
    Decem­ber 19, 2013 — 10:19 AM CST

    Dec. 19 (Bloomberg) — It’s 20 min­utes before 4 p.m. in Lon­don and cur­ren­cy traders’ screens are blink­ing red and green. Some deal­ers have as many as 50 chat rooms crowd­ed onto four mon­i­tors arrayed in front of them like shields. Mes­sages from sales­peo­ple and clients appear, get pushed up by new ones and van­ish from view. Orders are barked through squawk box­es.

    This is the clos­ing “fix,” the thin slice of the day when for­eign-exchange traders buy and sell bil­lions of dol­lars of cur­ren­cy in the large­ly unreg­u­lat­ed $5.3‑trillion-a-day for­eign-exchange mar­ket, the biggest in the world by vol­ume, accord­ing to the Bank for Inter­na­tion­al Set­tle­ments. Their trades help set the bench­mark WM/Reuters rates used to val­ue more than $3.6 tril­lion of index funds held by pen­sion hold­ers, savers and mon­ey man­agers around the world.

    Now reg­u­la­tors from Bern to Wash­ing­ton are exam­in­ing evi­dence first report­ed by Bloomberg News in June that a small group of senior traders at big banks had some­thing else on their screens: details of each other’s client orders. Shar­ing that infor­ma­tion may have helped deal­ers at firms, includ­ing JPMor­gan Chase & Co., Cit­i­group Inc., UBS AG and Bar­clays Plc, manip­u­late prices to max­i­mize their own prof­its, accord­ing to five peo­ple with knowl­edge of the probes.

    “This is a mar­ket where there is no law and peo­ple have turned a blind eye,” said for­mer Sen­a­tor Ted Kauf­man, a Delaware Demo­c­rat who spon­sored leg­is­la­tion in 2010 to shrink the largest U.S. banks. “We’ve been talk­ing about banks being too big to fail. What’s almost as big a prob­lem is banks too big to man­age.”

    ‘Ban­dits’ Club’

    At the cen­ter of the inquiries are instant-mes­sage groups with names such as “The Car­tel,” “The Ban­dits’ Club,” “One Team, One Dream” and “The Mafia,” in which deal­ers exchanged infor­ma­tion on client orders and agreed how to trade at the fix, accord­ing to the peo­ple with knowl­edge of the inves­ti­ga­tions who asked not to be iden­ti­fied because the mat­ter is pend­ing. Some traders took part in mul­ti­ple chat rooms, one of them said.

    The alle­ga­tions of col­lu­sion under­mine one of society’s fun­da­men­tal prin­ci­ples — how mon­ey is val­ued. The pos­si­bil­i­ty that a hand­ful of traders clus­tered in a closed elec­tron­ic net­work could skew the worth of glob­al cur­ren­cies for their own gain with­out detec­tion points to a lack of over­sight by employ­ers and reg­u­la­tors. Since funds buy and sell bil­lions of dol­lars of cur­ren­cy each month at the 4 p.m. WM/Reuters rates, which are deter­mined by cal­cu­lat­ing the medi­an of trades dur­ing a 60-sec­ond peri­od, that means less mon­ey in the pen­sion and sav­ings accounts of investors around the world.

    ‘Col­lu­sive Prac­tices’

    At stake is the integri­ty of a mar­ket that affects the dai­ly val­u­a­tions of pri­vate and pub­lic mon­ey alike, from the $261 bil­lion Sacra­men­to-based Cal­i­for­nia Pub­lic Employ­ees’ Retire­ment Sys­tem to the $237 bil­lion Scot­tish Wid­ows Invest­ment Part­ner­ship in Edin­burgh, from the $4.1 tril­lion Black­Rock Inc. in Man­hat­tan, the world’s largest asset man­ag­er, to the $1.2 tril­lion Tokyo-based Gov­ern­ment Pen­sion Invest­ment Fund, the biggest pen­sion.

    “This is a mar­ket that is far more amenable to col­lu­sive prac­tices than it is to com­pet­i­tive prac­tices,” said Andre Spicer, a pro­fes­sor at the Cass Busi­ness School in Lon­don, who is research­ing the behav­ior of traders.

    ...

    ‘The Car­tel’

    None of the traders or the banks they work for has been accused of wrong­do­ing.

    The inves­ti­ga­tions have had reper­cus­sions across the indus­try. UBS, RBS, Cit­i­group, Deutsche Bank, JPMor­gan and Lloyds Bank­ing Group Plc are ban­ning traders from using multi­bank chat rooms, peo­ple at the firms said. Investors are break­ing their orders into small­er units and using more banks to reduce the oppor­tu­ni­ty for front-run­ning, one of Europe’s largest mon­ey man­agers said.

    One focus of the inves­ti­ga­tion is the rela­tion­ship of three senior deal­ers who par­tic­i­pat­ed in “The Car­tel” — JPMorgan’s Richard Ush­er, Citigroup’s Rohan Ram­chan­dani and Matt Gar­diner, who worked at Bar­clays and UBS — accord­ing to the peo­ple with knowl­edge of the probe. Their banks con­trolled more than 40 per­cent of the world’s cur­ren­cy trad­ing last year, accord­ing to a May sur­vey by Euromoney Insti­tu­tion­al Investor Plc.

    Entry into the chat room was cov­et­ed by non­mem­bers inter­viewed by Bloomberg News, who said they saw it as a gold­en tick­et because of the influ­ence it exert­ed.

    Min­i­miz­ing Loss­es

    Reg­u­la­tors are exam­in­ing whether dis­cus­sions among the traders amount­ed to col­lu­sion — if, with a few key­strokes, they were able to push around rates to boost bank prof­its and their own bonus­es. Traders on the chat deny that, say­ing they were mere­ly match­ing buy­ers and sell­ers ahead of the fix. That way they could min­i­mize loss­es by avoid­ing trades at a time of day when prices typ­i­cal­ly fluc­tu­ate the most, they said.

    The men com­mu­ni­cat­ed via Instant Bloomberg, a mes­sag­ing sys­tem avail­able on ter­mi­nals that Bloomberg LP, the par­ent of Bloomberg News, leas­es to finan­cial firms, peo­ple with knowl­edge of the con­ver­sa­tions said.

    The traders used jar­gon, cracked jokes and exchanged infor­ma­tion in the chat rooms as if they didn’t imag­ine any­one out­side their cir­cle would read what they wrote, accord­ing to two peo­ple who have seen tran­scripts of the dis­cus­sions.

    Ush­er, Ram­chan­dani and Gar­diner, along with at least two oth­er deal­ers over the years, would dis­cuss their cus­tomers’ trades and agree on exact­ly when they planned to exe­cute them to max­i­mize their chances of mov­ing the 4 p.m. fix, two of the peo­ple said. When exchange rates moved their way, they would send writ­ten slaps on the back for a job well done.

    ...

    Entry into the chat room was cov­et­ed by non­mem­bers inter­viewed by Bloomberg News, who said they saw it as a gold­en tick­et because of the influ­ence it exert­ed.
    So it sounds like a big ques­tion going for­ward is whether or not Sym­pho­ny is going to dou­ble as a super-secure ‘gold­en tick­et’ trad­ing plat­form too. Hmmm...how’s that going to work out...

    Posted by Pterrafractyl | August 13, 2015, 12:28 pm
  9. *gasp* You don’t say...:

    Mar­ket­Watch
    Wall Street’s new chat ser­vice is delet­ing prob­lem­at­ic mes­sag­ing
    By Francine McKen­na

    Pub­lished: Aug 14, 2015 3:17 p.m. ET

    For start-up that says it’s focused on secure mes­sag­ing, Sym­pho­ny has been delet­ing a lot of its own mes­sag­ing to the pub­lic about what it pro­vides for its finan­cial ser­vices clients. The firm has been edit­ing out ref­er­ences on its web­site to data dele­tion and its abil­i­ty to help banks keep their data away from the gov­ern­ment.

    The New York Post has pre­vi­ous­ly report­ed that Sym­pho­ny delet­ed a video from its web­site that bragged its soft­ware could help banks avoid bil­lions in fines by mak­ing data dele­tion eas­i­er. Con­tin­u­ing its efforts, Sym­pho­ny has recent­ly delet­ed a sec­tion about data secu­ri­ty from its web­site and addi­tion­al ref­er­ences that empha­size more pri­va­cy via data encryp­tion and per­ma­nent data dele­tion capa­bil­i­ties.

    These were among the removed com­ments: “End-to-End Encryp­tion: Sym­pho­ny is com­plete­ly pri­vate. Your data is 100% pro­tect­ed by encryp­tion keys known only by you, nev­er by us.”

    “Guar­an­teed Data Dele­tion: Sym­pho­ny has designed a spe­cif­ic set of pro­ce­dures to guar­an­tee that data dele­tion is per­ma­nent and ful­ly doc­u­ment­ed.”

    A blog post from July enti­tled, “To Encrypt, or Not to Encrypt?” is also now gone. That post includ­ed a pas­sage tout­ing its encryp­tion capa­bil­i­ties as a way to pro­tect firms’ pri­va­cy. “Our gov­ern­ment offi­cials are con­cerned that their inabil­i­ty to mon­i­tor end-to-end encrypt­ed devices inhibits their role in keep­ing Amer­i­ca safe. Con­verse­ly, Amer­i­cans are con­cerned about pre­serv­ing their right to Pri­va­cy, and encryp­tion helps indi­vid­u­als enforce that right,” read that post.

    A Sym­pho­ny spokes­woman respond­ed that the web­site “was updat­ed as part of our August 3rd prod­uct launch.”

    Sym­pho­ny is no longer pro­mot­ing mes­sag­ing secu­ri­ty fea­tures as a way to pre­vent the gov­ern­ment from get­ting banks data. Instead, text describes “an ‘end-to-end’ secu­ri­ty capa­bil­i­ty that pro­tects com­mu­ni­ca­tions from cyber-threats and the risk of a data breach—while safe­guard­ing our cus­tomers’ abil­i­ty to retain records of their mes­sages.”

    The spokes­woman also said that “Sym­pho­ny does not change reg­u­la­tors’ abil­i­ty to obtain mes­sages from our clients. Sym­pho­ny deliv­ers mes­sages to its clients to down­load, decrypt, and archive, and they are able to pro­vide those mes­sages to reg­u­la­tors just as they would with oth­er com­pli­ant mes­sag­ing sys­tems.”

    ...

    Sym­pho­ny was formed when, in Octo­ber of last year, four­teen of the world’s biggest finan­cial-ser­vices firms, includ­ing Gold­man Sachs, bought instant-mes­sag­ing soft­ware com­pa­ny Per­zo Inc and formed a new com­pa­ny fund­ed by a con­sor­tium of finan­cial firms that includes many big names —Gold­man Sachs, Bank of Amer­i­ca Corp., Bank of New York Mel­lon Corp, Black­Rock Inc., Citadel LLC, Cit­i­group Inc., Cred­it Suisse Group AG, Deutsche Bank AG, J.P. Mor­gan Chase & Co., Jef­feries LLC, Mav­er­ick Cap­i­tal Ltd., Mor­gan Stan­ley, Nomu­ra Hold­ings Inc. and Wells Far­go & Co.. Some of those banks have spent bil­lions to set­tle inves­ti­ga­tions for inter­est-rate rig­ging and cur­ren­cy manip­u­la­tion that rest­ed on evi­dence of instant mes­sages and oth­er elec­tron­ic com­mu­ni­ca­tions between traders in the banks and between them that pro­vid­ed evi­dence of the alleged ille­gal activ­i­ty. Those mes­sages shocked the pub­lic and pros­e­cu­tors and embar­rassed the banks because of their bla­tant dis­re­gard of the law and their irrev­er­ence.

    Last year, while the firm was still called Per­zo, Sym­pho­ny CEO Gurle was inter­viewed and talked about its “zero knowl­edge” secu­ri­ty capa­bil­i­ties.

    The indus­try-led effort to find a sub­sti­tute for Bloomberg LP’s ubiq­ui­tous mes­sag­ing sys­tem may be about control—Bloomberg saves the banks’ data and could be the tar­get of a regulator’s sub­poe­na— but may be more about mon­ey. A Bloomberg ter­mi­nal costs $24,000 a year. Mul­ti­ply that by the thou­sands of ter­mi­nals on every trad­ing floor, and its adds up to anoth­er big cost banks may be try­ing to erase. A Bloomberg LP spokesman declined com­ment.

    Note that when you read:

    ...
    The indus­try-led effort to find a sub­sti­tute for Bloomberg LP’s ubiq­ui­tous mes­sag­ing sys­tem may be about control—Bloomberg saves the banks’ data and could be the tar­get of a regulator’s sub­poe­na— but may be more about mon­ey. A Bloomberg ter­mi­nal costs $24,000 a year. Mul­ti­ply that by the thou­sands of ter­mi­nals on every trad­ing floor, and its adds up to anoth­er big cost banks may be try­ing to erase. A Bloomberg LP spokesman declined com­ment.

    that, yes, it’s cer­tain­ly pos­si­ble that reduc­ing the costs of Bloomer­berg’s mes­sag­ing sys­tem could cer­tain­ly be a fac­tor in Wall Street’s deci­sion to devel­op their own end-to-end encrypt­ed mes­sag­ing sys­tem that can delete data before the gov­ern­ment can see it in addi­tion to a desire to retain max­i­mum con­trol over their data. But also keep in mind the obvi­ous: that the desire to main­tain that con­trol over data that reg­u­la­tors might be inter­est­ed in review­ing is also all about the mon­ey:

    The New York Post
    Wall Street has found a new way to evade pesky probes

    By Kevin Dugan

    August 2, 2015 | 8:02pm

    For­get about Sen. Eliz­a­beth War­ren. The worst scourge on Wall Street is over­ly chat­ty traders.

    Since 2010, the world’s 13 biggest banks have shelled out more than $74 bil­lion to set­tle probes, rang­ing from inter­est-rate rig­ging to cur­ren­cy manip­u­la­tion, where incrim­i­nat­ing exchanges between traders pro­vid­ed key evi­dence, accord­ing to a Post analy­sis of data com­piled by the CCP Research Foun­da­tion.

    “Those crimes may not have been pos­si­ble with­out elec­tron­ic com­mu­ni­ca­tion,” said Bran­don Gar­rett, a pro­fes­sor at the Uni­ver­si­ty of Vir­ginia School of Law.

    The eye-pop­ping fig­ure is a big rea­son why Wall Street is back­ing a new cut­ting-edge com­mu­ni­ca­tions sys­tem.. Sym­pho­ny promis­es to give its clients, includ­ing Gold­man Sachs and JPMor­gan Chase, greater con­trol of their data — and save them “bil­lions of dol­lars in fines,” accord­ing to a com­pa­ny pitch to clients.

    While banks are back­ing the sys­tem, reg­u­la­tors are wary. Last week, New York’s top finan­cial reg­u­la­tor asked Sym­pho­ny Com­mu­ni­ca­tions to explain its encryp­tion and record reten­tion after the start­up tout­ed “guar­an­teed data dele­tion” in its mar­ket­ing mate­ri­als.

    Sym­pho­ny removed a pro­mo­tion­al video from its web­site tout­ing the bil­lions in sav­ings, along with the ref­er­ence to data dele­tion, after the Depart­ment of Finan­cial Ser­vices’ act­ing super­in­ten­dent, Antho­ny Albanese, sent a let­ter to Sym­pho­ny Chief Exec­u­tive David Gurle seek­ing more details.

    ...

    Anoth­er con­cern about Sym­pho­ny — one that hasn’t been made pub­lic — is that it will make it hard­er for reg­u­la­tors to launch probes with­out tip­ping off the poten­tial tar­get, said cur­rent and for­mer law enforce­ment offi­cials.

    Sym­pho­ny requires clients to store chats, emails and oth­er data on their own servers rather than rely­ing on a third par­ty.

    This means when inves­ti­ga­tors sub­poe­na records, they will — in many cas­es — have to get them from the firm that is being probed.

    Sym­pho­ny said it encrypts and stores client data in “the cloud.” Once the client down­loads its own data and has the encryp­tion key, Sym­pho­ny deletes the data from its own servers.

    The sys­tem allows banks to “safe­guard their data from cyber-secu­ri­ty threats, and help pro­tect firms from data breach­es,” the com­pa­ny said in response to ques­tions from The Post.

    It also means inves­ti­ga­tors must get the encryp­tion key from the com­pa­ny to decode it, sources said.

    Sym­pho­ny also promis­es “real-time mon­i­tor­ing” of chat rooms — i.e., eaves­drop­ping. Key­word fil­ters allow com­pli­ance chiefs to pin­point and stop prob­lem­at­ic chats, CEO Gurle told The Post last year, although one law enforce­ment offi­cial said traders can eas­i­ly get around it.

    Some of those chats have been down­right damn­ing.

    “If you ain’t cheat­ing, you ain’t try­ing,” wrote one Bar­clays trad­er in a chat room that was at the cen­ter of the cur­ren­cy-rig­ging probe.

    As we can see, the new mes­sag­ing sys­tem built by and for the indus­try with tens of bil­lions of dol­lars in fines over the past five years and a proven track record of liv­ing by the “If you ain’t cheat­ing, you ain’t trying”-philosophy will offer fun fea­tures like “real-time mon­i­tor­ing” of chat rooms — so it can pre­sum­ably work with Wall Street’s new pro­le-pre­cog sys­tems that mon­i­tor the activ­i­ties of employ­ees and use arti­fi­cial intel­li­gence to sniff out wrong­do­ing from emails and chats (so reg­u­la­tors don’t have to be bur­dened with the task of reg­u­lat­ing *wink*). Pre­sum­ably we’re to assume that the banks’ com­pli­ance chiefs will actu­al­ly end the ille­gal activ­i­ties and not sim­ply tell that employ­ee to stop using lan­guage that sets off the AI and per­ma­nent­ly delete those. Isn’t that help­ful.

    And then there’s this help­ful con­trol-ori­ent­ed fea­ture:

    ...

    Anoth­er con­cern about Sym­pho­ny — one that hasn’t been made pub­lic — is that it will make it hard­er for reg­u­la­tors to launch probes with­out tip­ping off the poten­tial tar­get, said cur­rent and for­mer law enforce­ment offi­cials.

    Sym­pho­ny requires clients to store chats, emails and oth­er data on their own servers rather than rely­ing on a third par­ty.

    This means when inves­ti­ga­tors sub­poe­na records, they will — in many cas­es — have to get them from the firm that is being probed.

    *******
    ‑Knock, Knock

    -Who’s there?

    -A reg­u­la­to­ry agency that would like to see your traders’ mes­sag­ing activ­i­ty, but who is total­ly not inter­est­ing in inves­ti­gat­ing wrong­do­ing at your finan­cial insti­tu­tion so don’t, like, delete any­thing or some­thing like that.

    -Oh, ok, let us get those mes­sages for you. We have noth­ing to hide.

    -Thanks. Hey, why are so many of these mes­sages delet­ed? Oh well, it looks like there def­i­nite­ly won’t be an inves­ti­ga­tion now.

    -Oh dear, we’re real­ly sor­ry to hear that. LOL!

    ***
    Worst. Joke. Ever.

    Ok, that’s not true. Jokes can get far worse.

    Posted by Pterrafractyl | August 17, 2015, 5:40 pm
  10. Mark Ames has a new piece on the the fed­er­al bribery inves­ti­ga­tion involv­ing Ron Paul’s 2012 cam­paign that’s threat­en­ing to implode Rand Paul’s flail­ing 2016 pres­i­den­tial ambi­tions: Two of Rand Paul’s top aides, Jesse Ben­ton and John Tate, recent­ly plead not guilty to brib­ing the influ­en­tial for­mer Iowa state sen­a­tor Kent Soren­son GOP. So we’ll see how that inves­ti­ga­tion goes, but inter­est­ing­ly, the Paul team’s defense is get­ting some help from a rather unex­pect­ed source: Google. When fed­er­al inves­ti­ga­tors issued a war­rant for Jesse Ben­ton’s gmail account last year, Google noti­fied Ben­ton of the war­rant, Ben­ton’s lawyers appealed it, and Google has refused to turn the emails over until a court resolves the issue. This is Google’s stan­dard prac­tice so that, in and of itself, is not exact­ly sus­pi­cious. But as Ames points out, we are get­ting into rather inter­est­ing ter­ri­to­ry here since Google has been a major donor to both Ron and Rand Paul:

    Pan­do Dai­ly
    Google’s lawyers, Ron Paul’s grand­son, and the most depraved pres­i­den­tial cam­paign crime in decades

    By Mark Ames
    , writ­ten on
    August 21, 2015

    It is eas­i­ly the most depraved lit­tle episode of pres­i­den­tial cam­paign crime in decades, wor­thy of Nixon’s CREEP or Boris Yeltsin’s goons, and it’s been almost total­ly ignored by the media—mainstream and oth­er­wise.

    Ron and Rand Paul’s top cam­paign aides, led by the hus­band of Ron Paul’s grand­daugh­ter, brib­ing and extort­ing a crooked Tea Par­ty Iowa politi­cian to endorse the “Ron Paul rEVOLution”—which turns out to have been lit­tle more than a mirage built on fraud, oli­garch cash, and the cred­u­lous fan­tasies of a few thou­sand pim­ply col­lege-aged waf­fendweebs.

    And then there’s the specter of the world’s largest pri­vate sur­veil­lance appa­ra­tus, Google, loom­ing over this story—playing a cen­tral role in the crim­i­nal inves­ti­ga­tion that is both deeply con­flict­ed, and odd­ly con­flict­ing.

    For over a year now, Google has refused to com­ply with fed­er­al war­rants to hand over Gmail accounts of the three indict­ed Paul cam­paign man­agers and oper­a­tors: Jesse Ben­ton, John Tate, and Dim­itrios Kesari, who all have held senior posts in Rand Paul’s var­i­ous cam­paigns and PACs. (Many of the legal fil­ings men­tioned in this arti­cle are embed­ded below.)

    But it goes fur­ther: Ron Paul him­self is named in a fed­er­al sub­poe­na made pub­lic last year. Pros­e­cu­tors want access to the lib­er­tar­i­an hero’s emails, as he appears to be a per­son of inter­est in the crim­i­nal inves­ti­ga­tion, an inves­ti­ga­tion that Google has been hin­der­ing with legal road­blocks and dis­trac­tions.

    ...

    The crimes are bad enough, and I’ll explain them in a minute—but when you have the most pow­er­ful Inter­net com­pa­ny in the world, and one of the largest cor­po­rate lob­by­ists in Wash­ing­ton DC, pro­tect­ing indict­ed crim­i­nals who run pres­i­den­tial cam­paigns for politicians—Ron and Rand Paul—which Google has giv­en thou­sands of dol­lars to in recent years, and whose lib­er­tar­i­an ide­ol­o­gy Google has sup­port­ed in a num­ber of ways and venues. . . . then we’re talk­ing about poten­tial­ly night­mare-sce­nario lev­els of con­flicts-of-inter­est..

    Poten­tial­ly—that’s the key here, because the real sto­ry of Google’s role in this sor­did crime is a bit more com­pli­cat­ed than that, and not entire­ly evil, much as that might frus­trate me and many of our read­ers. Google’s prob­lem in this case rests in its over­whelm­ing monop­oly power—it’s as if the Nixon Tapes were on Google’s servers, along with all of our own per­son­al record­ings, and Google had a pol­i­cy of gen­er­al­ly being a pain in the ass about hand­ing over tape record­ings so as to keep con­sumers lured into spend­ing all their bab­bling moments bab­bling into their tape record­ing prod­uct...only in this case, Google is also a major cam­paign donor to Nixon and his polit­i­cal agen­da. It’s very prob­lem­at­ic, and I’ll save a deep­er dis­cus­sion of Google’s con­flicts in fight­ing gov­ern­ment war­rants for Ron and Rand Paul’s indict­ed felons for anoth­er arti­cle...

    But first, the crime. Let’s start with Kent Soren­son, a mean, dumb, thumb-head­ed prairie bump­kin who so far stands as the only per­son con­vict­ed of a series of felonies involv­ing the Ron Paul 2012 cam­paign, after Soren­son pled guilty last year to crimes—including fil­ing fal­si­fied fed­er­al elec­tion reports, and obstruc­tion of jus­tice, crimes that could car­ry a max­i­mum sen­tence of 25 years behind bars.

    Soren­son was, until recent­ly, Iowa state Sen­a­tor Soren­son, Iowa’s lead­ing fire­breath­ing Tea Par­ty rad­i­cal who vowed to “burn down” Des Moines when he won his seat in the state’s upper cham­ber in 2010. Soren­son talked the God-talk, bashed gays, the poor, drug users, and immi­grants, which made him a dar­ling among Tea Par­ty lib­er­tar­i­ans like Ron Paul, who per­son­al­ly endorsed Sorsenson’s run for state sen­ate in 2010.

    Among the bills Soren­son pushed—a state Con­sti­tu­tion­al amend­ment ban­ning same-sex civ­il mar­riages; a “birther” law aimed at Oba­ma, requir­ing pres­i­den­tial can­di­dates to pro­duce their birth cer­tifi­cates; a law forc­ing indi­gent wel­fare recip­i­ents to sub­mit to ran­dom drug tests—and denial of ben­e­fits if they failed the tests.

    Nat­u­ral­ly, it was lat­er discovered—after he was elect­ed— that Soren­son had been bust­ed in 1992 deliv­er­ing a bag­gie of weed and tak­ing $30 cash from a drug infor­mant, for which the Tea Par­ty fire­brand was con­vict­ed of an aggra­vat­ed mis­de­meanor and sen­tenced to six months in coun­ty jail. He was 20 years old; he served five days. When the sto­ry came out in 2011, he blamed anoth­er guy and claimed to have mend­ed his ways. But it was also dis­cov­ered that he’d welched on his child sup­port pay­ments, had his wages gar­nished, was penal­ized again for fail­ing again, was charged but cleared of domes­tic vio­lence, and had declared bank­rupt­cy on his mort­gage and stu­dent loans debts, which he blamed on usu­ri­ous inter­est rates. In oth­er words, a typ­i­cal mean dumb white lowlife.

    Last year, after Soren­son was first con­vict­ed of tak­ing bribe mon­ey from Ron Paul and lying about it, he was sub­ject­ed to manda­to­ry drug tests of the sort he vot­ed to impose on Iowa’s poor­est residents—and yes, Soren­son failed his own drug tests — not once, but three times.

    And just last month, police arrest­ed Soren­son again for alleged­ly beat­ing his wife.

    But in our offi­cial nar­ra­tive, as far as all the media har­rumphers and pun­dits were con­cerned, Soren­son was a seri­ous Tea Par­ty evan­gel­i­cal, dri­ven by con­ser­v­a­tive prin­ci­ples, no mat­ter how much those prin­ci­ples might ruf­fle main­stream two-par­ty Estab­lish­ment feath­ers, by gum!—just like Ron Paul. In ear­ly 2011, Sorenson’s endorse­ment was some­thing tak­en seri­ous­ly, as a mat­ter of weighty Tea Par­ty principle—and he threw in ear­ly for Michele Bach­mann. As it turns out, he endorsed her, and became her Iowa cam­paign co-chair­man, on a more famil­iar prin­ci­ple: Pay­ment in kind. In secret and in vio­la­tion of Iowa Sen­ate ethics (and fed­er­al laws, once those bribes became fal­si­fied reports), the Bach­mann cam­paign paid Sen. Soren­son near­ly $8,000 per month in a clunky scheme in which Bach­mann funds went through a cou­ple of dum­my com­pa­nies and into Sorenson’s pock­et.

    This is how pol­i­tics works, folks; it’s not what they teach you in mid­dle school civics class­es, but jour­nal­ists should’ve got­ten over that lit­tle shock­er by now.

    In pub­lic, Soren­son said his endorse­ment of Michele Bach­mann was all on account of shared deep Chris­t­ian lib­er­tar­i­an prin­ci­ples. Mean­while, towards the end of 2011, as the Iowa cau­cus­es were draw­ing near, Ron Paul’s grand­son-by-mar­riage, Jesse Ben­ton, and his fel­low staffers, hav­ing learned Soren­son was for sale (appar­ent­ly every­one but the media knew it), opened nego­ti­a­tions to buy Sen. Sorenson’s sup­port by out­bid­ding Bach­mann. It helped that Ron Paul was rais­ing mon­ey hand over fist com­pared to Bach­mann, thanks to all the Sil­i­con Val­ley and extrac­tion indus­try bil­lion­aires who love Paul’s vision of gov­ern­ment with­out tax­a­tion or reg­u­la­tion or wel­fare or help of any kind for any­one or any­thing, but their pri­vate prop­er­ty, which is always in need of armed pro­tec­tion...

    Accord­ing to a recent­ly unsealed indict­ment, in late Octo­ber 2011, Ben­ton — who also led his uncle Rand Paul’s Super­PAC until just recent­ly, in case I haven’t made this fam­i­ly point clear enough — sent an email to Soren­son and Sorenson’s top aide offer­ing to take over pay­ing Sorenson’s $8,000/month bribes in return for Soren­son switch­ing his alle­giance from Bach­mann to Dr. Paul. Both Soren­son and Dr. Paul’s peo­ple agreed to delay Sorenson’s switch until after a meet­ing of Iowa Repub­li­cans, where he’d strength­en his own posi­tion with­in the par­ty, on the eve of the big cau­ca­sus, as a prin­ci­pled Tea Par­ty Chris­t­ian lib­er­tar­i­an.

    Then from mid-Novem­ber 2011 until late Decem­ber, a Ron Paul oper­a­tive, Dim­itrios Kesari, made numer­ous calls to Soren­son to nego­ti­ate and lob­by for the bribe-and-switch deal. A few days before the switch, around Christ­mas 2011, Soren­son agreed with Ron Paul’s cam­paign heads to write up a press release in-advance explain­ing how his Tea Par­ty prin­ci­ples moved him to aban­don Bach­mann for Ron Paul. Sen. Soren­son then sent his draft state­ment to the Ron Paul 2012 cam­paign chiefs for editing—his grand­daugh­ter’s hus­band Jesse Ben­ton, his fam­i­ly oper­a­tive Kesari, and John Tate, the head of a Ron/Rand Paul lib­er­tar­i­an orga­ni­za­tion called Cam­paign For Lib­er­ty, who also served as an offi­cer in Rand Paul’s Super­PAC. And in case Soren­son dou­ble-crossed Ron Paul over his planned dou­ble-cross of Michelle Bach­mann, Dr. Paul’s cam­paign chiefs had read­ied a plan to smear Soren­son and ruin his life by leak­ing select emails of their pay­off nego­ti­a­tions.

    Soren­son agreed to switch to Ron Paul in exchange for being put on an $8,000 a month under-the-table salary, plus a $100,000 pay­off to Sorenson’s per­son­al PAC. Being a thumb-head, Soren­son demand­ed a $25,000 check, and Dr. Paul’s oper­a­tive, Kesari, agreed, hand­ing him a check in the name of Kesari’s wife’s jew­el­ry com­pa­ny at an Iowa din­er. But as soon as Soren­son got that big fat $25,000 check, he wasn’t sure what he should do with it. So he just held onto it, fig­ur­ing it would be use­ful lat­er (and it was useful—to fed­er­al pros­e­cu­tors). Two days after get­ting the $25,000 check, on Decem­ber 28, 2011, Soren­son appeared at an ear­ly after­noon ral­ly for Bach­mann at Piz­za Ranch, still play­ing the role of her campaign’s co-chairman—but he kept silent through­out the Bach­mann ral­ly, claim­ing he couldn’t speak because he’d just had den­tal work done and his mouth was so numb “he was afraid he would drool on him­self,” accord­ing to the Des Moines Reg­is­ter.

    After the Piz­za Ranch ral­ly for Bach­mann, Sen. Soren­son skulked away in his car, and showed up to a Ron Paul 2012 ral­ly (“Soren­son said he drove to Paul’s event, called a Paul staffer and asked: ‘Do you guys want me on board?’”—reported the Des Moines Reg­is­ter) and jumped on the stage in a fake-spon­ta­neous Tea Par­ty moment of lib­er­tar­i­an pas­sion, announc­ing that his con­science had com­pelled him, at the spur of the moment, to switch alle­giance to the Ron Paul rEV­O­Lu­tion!

    ...

    Sorenson’s betray­al was meant to land as a punch to the gut, to shock and awe Bach­mann into total sub­mis­sion, los­ing her co-chair like that. What the Ron Paul hicks didn’t expect was that Bach­mann — a prairie hick of a dif­fer­ent sub­species of mean-and-dumb, the kind of prairie hick that self-destruc­ts unless under con­stant 24/7 watch from a slick polit­i­cal min­der — would expose the whole scam. Bach­mann went straight to the press and spilled the beans, that Soren­son had been bribed by Ron Paul’s cam­paign, and that Soren­son had even told her that they were going to bribe him. Which was true—Sorenson had been bar­gain­ing with her, try­ing to lever­age the Paul campaign’s offer to squeeze a bet­ter counter-offer bribe out of Bach­mann.

    Imme­di­ate­ly after Bachmann’s sui­ci­dal state­ment, her top aides ran to the media and said no-no-no-, you know how crazy Michele is, cuck­oo! cuck­oo!... noth­ing of the sort was going on, we’re all hon­or­able peo­ple here, Ron Paul’s fam­i­ly mem­ber includ­ed. Because, obvi­ous­ly, there was the fear that if any­one decid­ed to look into the alle­ga­tions, they’d find that Bachmann’s cam­paign was guilty of the same crime.

    And accord­ing to last year’s sub­poe­na, the FBI wants access not only to Ron Paul’s and his cam­paign staffers’ emails, but to Bachmann’s and her staffers too.

    * * * *

    Bachmann’s state­ment about Paul’s bribes caused a brief con­tro­ver­sy among the media, which didn’t want to believe such a thing could hap­pen in Amer­i­ca, and espe­cial­ly not from the cam­paign of that real-life 21st C Jim­my Stewart—albeit a hick-fas­cist Con­fed­er­ate Jim­my Stew­art, but earnest and “authen­tic” all the same, accord­ing to the rubes in the media, push­ing Paul as the peren­ni­al anti-estab­lish­ment hero. Among the con­spir­a­tors, how­ev­er, it caused a real pan­ic, and a brief change of plans.

    The next day, Decem­ber 29, Ben­ton & team had Sen. Soren­son issue a defi­ant state­ment that basi­cal­ly said, “You think I get paid for my prin­ci­ples? Wait till you see the FEC fil­ings, then you’ll see that Bach­mann is a liar and no one’s pay­ing me any­thing, by gum!” And then Soren­son and the Paul capos pro­ceed­ed to forge their FEC fil­ings to fun­nel their pay­ments to Soren­son through a pair of dum­my front com­pa­nies. Not exact­ly the sharpest con­men, but brains aren’t much of a require­ment for suc­cess as a con artist. An emp­ty con­science, some cun­ning, and the stu­pid sense that you and your tes­ti­cles are smarter than every­one else—those are much more impor­tant qual­i­ties.

    ...

    CUT TO: Sep­tem­ber, 2013. One of Sorenson’s true-believ­er Chris­t­ian aides couldn’t stom­ach the sleaze, spilled the beans and incrim­i­nat­ing emails, and land­ed Soren­son in an ethics com­mit­tee inves­ti­ga­tion that he couldn’t crawl out of. At this point, for­mer Ron-now-Rand Paul oper­a­tive Kesari jet­ted to neigh­bor­ing flat state Nebras­ka so as to not look sus­pi­cious, and gunned it straight to Iowa to get that moth­er­fuck­ing $25,000 check from Soren­son that the lug­head nev­er cashed.

    Accord­ing to a fed­er­al indict­ment,

    Kesari [the Paul oper­a­tive] flew to Oma­ha, Nebras­ka, back­tracked to Sen­a­tor Sorenson’s home in Iowa, required that he and Sen­a­tor Soren­son show each oth­er that nei­ther was wear­ing a record­ing device, and then asked that Sen­a­tor Soren­son either return to Kesari or alter the $25,000 check that Kesari pre­vi­ous­ly gave to Sen­a­tor Sorenson...which Sen­a­tor Soren­son refused to do.

    One thing Sen. Soren­son had some expe­ri­ence with was rat­ting out oth­ers. He rat­ted out the pot deal­er he got bust­ed with and got his sen­tence reduced to five days and pro­ba­tion, and lat­er, in office, vot­ed to turn up the heat in the War On Drugs (fun­ny how this didn’t both­er Ron Paul’s prin­ci­pled peo­ple); and last year, after FBI agents raid­ed Sorenson’s home and took his and his family’s com­put­ers, Soren­son copped a plea. Now the feds have the very top peo­ple in both Ron and Rand Paul’s cam­paigns for pres­i­dent going back to 2007, cam­paigns heav­i­ly under­writ­ten by Sil­i­con Val­ley bil­lion­aires and true believ­ers...

    This past week has been an active one in the government’s case against Jesse Ben­ton, John Tate and Dim­itrios Kesari—the South­ern Iowa Dis­trict Court ruled that they were such a risk for leak­ing con­fi­den­tial doc­u­ments that they could only view gov­ern­ment evi­dence on CDs stored in their lawyers’ offices.

    On Thurs­day of this week, Jesse Ben­ton and John Tate appeared before the court and pled not guilty on a num­ber counts that mir­ror the Water­gate charges 40 years ago: con­spir­a­cy to “know­ing­ly defraud the Unit­ed States”; “know­ing­ly and will­ful­ly fal­si­fy, con­ceal and cov­er up by a trick, scheme and device a mate­r­i­al fact in a mat­ter with­in the juris­dic­tion of the exec­u­tive branch”; “know­ing­ly cause the con­ceal­ing, cov­er­ing up, falsification...with the intent to impede obstruct, and influ­ence the inves­ti­ga­tion...” and so on.

    Mean­while, the Court just sided with Google that it still wasn’t required to com­ply with the FBI war­rant just yet and allow access to all the Gmail accounts that the feds demand­ed last year. As Google was care­ful to point out in its fil­ings, the com­pa­ny has made sure to pre­serve and pro­tect all email com­mu­ni­ca­tions from those list­ed on the war­rant — includ­ing pre­sum­ably Ron Paul’s emails — to pre­vent any­one from try­ing to scrub or alter them. So Google is essen­tial­ly com­ply­ing, and they’re going to even­tu­al­ly hand them over, in all like­li­hood, and it will be some very incrim­i­nat­ing mate­r­i­al that could dri­ve a barbed stake in the heart of libertarianism’s First Fam­i­ly...

    The fun­ny thing is that real lib­er­tar­i­ans don’t even nec­es­sar­i­ly believe that bribery and fraud are legit­i­mate crimes, if car­ried out in self-inter­est. For the most part, even main­stream lib­er­tar­i­ans from the CATO Insti­tute argue that bribery should be legal.

    And yet—because lib­er­tar­i­ans have para­dox­i­cal­ly trans­formed in recent years into the most sanc­ti­mo­nious loud-mouthed whin­ers in the polit­i­cal are­na, this is one of those ugly, sleazy, low-rent cor­rup­tion scan­dals, going all the way into the Paul fam­i­ly gene pool, that won’t sit well with the young, cred­u­lous males who give the lib­er­tar­i­an cult its ener­gy.

    Most of all, how­ev­er, this sto­ry final­ly answers the ques­tion that all the hun­dreds of qua­si-griz­zled, qua­si-cyn­i­cal cam­paign trail jour­nal­ists failed to answer: What hap­pened to Rand Paul’s pres­i­den­tial cam­paign, the most hyped-up, pro­mot­ed can­di­da­cy of anyone’s over the past two years? The lib­er­al media has been drool­ing over Rand Paul like he’s the sec­ond com­ing, the Con­fed­er­ate with the heart of gold that all mid­dle-class lib­er­als dream of. I heard a lot of suck­ers claim that the Koch broth­ers had sud­den­ly decid­ed, after all these years of sup­port­ing their pet Pauls, that Rand was not to their lik­ing, too much of a light­weight, or some­thing like that. Because you know the Kochs only go with Very Seri­ous Gravitas‑y Heavyweights—the Her­man Cains, Michele Bach­manns, Scott Walk­ers…

    I’ve learned since com­ing back here that Amer­i­can polit­i­cal jour­nal­ists mis­take their sneer­ing for cyn­i­cism. Cyn­i­cism is what you learn in a place like Rus­sia, which isn’t as far from the US as one would think (or hope). It nev­er cross­es a smug sneery journalist’s mind that the pol­i­tics they’re report­ing on is as cor­rupt as a tin­pot dictator’s, that all the cant about prin­ci­ples is cap­i­tal to be cashed, and cash it they do. Because pol­i­tics is about divid­ing up tril­lions of dol­lars in wealth and pow­er and priv­i­lege, not about high-mind­ed debates in three-point­ed hats.

    Those cam­paign dona­tions that all the bor­ing, unread­able non­prof­it watch­dog sites report on—that’s the dull account­ing stuff for pub­lic con­sump­tion. The real game is the payoff—the check cashed, the dum­my com­pa­ny that gets the wire trans­fer. First you have to be will­ing to see that it’s there.

    “The next day, Decem­ber 29, Ben­ton & team had Sen. Soren­son issue a defi­ant state­ment that basi­cal­ly said, “You think I get paid for my prin­ci­ples? Wait till you see the FEC fil­ings, then you’ll see that Bach­mann is a liar and no one’s pay­ing me any­thing, by gum!” And then Soren­son and the Paul capos pro­ceed­ed to forge their FEC fil­ings to fun­nel their pay­ments to Soren­son through a pair of dum­my front com­pa­nies. Not exact­ly the sharpest con­men, but brains aren’t much of a require­ment for suc­cess as a con artist. An emp­ty con­science, some cun­ning, and the stu­pid sense that you and your tes­ti­cles are smarter than every­one else—those are much more impor­tant qual­i­ties.”
    Well that explains a lot. And it also rais­es the ques­tion of just what the Paul team’s tes­ti­cles are rec­om­mend­ing at this point. Hmmm....how about try­ing to turn this inves­ti­ga­tion into a ral­ly­ing cry of gov­ern­ment over­reach:

    Moth­er Jones
    Google Won’t Let the Gov­ern­ment See the Emails of Rand Paul’s Aides.
    The inter­net giant is defend­ing the right of an indict­ed Rand Paul aide to keep his emails out of gov­ern­ment hands.

    —By Russ Choma
    | Wed Aug. 19, 2015 6:00 AM EDT

    The three Rand Paul aides who were indict­ed ear­li­er this month are doing their best to turn the gov­ern­ment case against them into an exam­ple of gov­ern­ment over­reach, and Google has tak­en their side in the fight.

    In the sum­mer of 2014, fed­er­al inves­ti­ga­tors began prob­ing whether Ron Paul’s 2012 pres­i­den­tial cam­paign had paid Iowa state Sen. Kent Soren­son for his endorse­ment. After Soren­son con­fessed, inves­ti­ga­tors focused on three oth­er men, includ­ing cur­rent pres­i­den­tial can­di­date Rand Paul’s nephew-in-law, Jesse Ben­ton, whose email account sup­pos­ed­ly con­tained evi­dence.

    After a brief skir­mish with Ben­ton’s attor­ney about access­ing Ben­ton’s emails, FBI agents got a search war­rant that enti­tled them to read the emails with­out Ben­ton’s coop­er­a­tion. But the plan did not go smooth­ly. Ben­ton has a Gmail account, and Google’s pol­i­cy is to noti­fy users when their accounts have been hit with a search war­rant. Ben­ton’s attor­ney, Roscoe Howard, prompt­ly filed a motion to block the search war­rant, alleg­ing that it was improp­er, and Google stopped coop­er­at­ing with the FBI.

    That was almost a year ago. Two weeks ago, Ben­ton and two oth­er top Paul aides, John F. Tate and Dim­itri Kesari, were indict­ed on fed­er­al charges, includ­ing con­spir­a­cy, cam­paign finance vio­la­tions, and mak­ing false state­ments. Pros­e­cu­tors accused the men of pay­ing Soren­son more than $73,000, hid­ing the pay­ments by fun­nel­ing them through a third par­ty, and lying on cam­paign finance fil­ings to cov­er them up.

    The FBI still has­n’t got­ten ahold of Ben­ton’s emails. Last week, a judge ruled that the FBI had a right to the emails, but once again, Ben­ton resist­ed and Google agreed.

    “Fright­en­ing­ly, the gov­ern­ment still main­tains that it has the right to tram­ple Mr. Benton’s pri­va­cy rights and look through every sin­gle one of Mr. Benton’s emails, just as if his email account were a ware­house full of doc­u­ments,” Howard wrote. “The government’s state­ment under­scores its true intent—to con­duct a fish­ing expe­di­tion.”

    The gov­ern­ment has now demand­ed that Google be held in con­tempt if the com­pa­ny does­n’t imme­di­ate­ly turn over the emails, and it has argued that Ben­ton and his attor­ney can raise their con­cerns at tri­al if they don’t like the way the search war­rant was obtained. Most peo­ple don’t learn they’re the tar­get of a search war­rant until it has already been exe­cut­ed, which means they don’t have the oppor­tu­ni­ty to chal­lenge the war­rant until the evi­dence appears in court. But access­ing emails is not like kick­ing down a door and find­ing a gun: Google con­trols access to the emails on its serv­er, so the com­pa­ny’s refusal to com­ply with the FBI—and its will­ing­ness to tell Ben­ton about the warrant—not only changes the dynam­ic in this par­tic­u­lar case; it could also cre­ate a prece­dent for oth­ers.

    Han­ni Fakhoury, a senior staff coun­sel with the Elec­tron­ic Fron­tier Foun­da­tion, said courts have not yet set­tled the ques­tion of how spe­cif­ic or broad email search war­rants should be, and this case is one of the most promi­nent illus­tra­tions of how users can fight back.

    “This case is smack in the mid­dle of the debate,” Fakhoury says. “This is a very high-pro­file and dra­mat­ic exam­ple of it, because we’re talk­ing about half a mil­lion emails.”

    Howard, Ben­ton’s attor­ney, wrote in one fil­ing that his client had coop­er­at­ed ful­ly with inves­ti­ga­tors and pro­vid­ed a 50,000-page list of all the emails in his account, which may con­tain as many as 500,000 emails. Howard argues that the gov­ern­men­t’s search war­rant is sim­ply too broad, and that Ben­ton’s Gmail account con­tains both per­son­al and polit­i­cal cor­re­spon­dence.

    Google has now offi­cial­ly joined the fight. Its lawyer, Guy Cook, told the court that the com­pa­ny will not turn over Ben­ton’s emails.

    “Google can­not be held in con­tempt sim­ply for allow­ing Mr. Ben­ton to exer­cise his appel­late rights and await­ing the dis­trict court’s rul­ing on the warrant’s valid­i­ty,” Cook wrote. The com­pa­ny’s posi­tion is that it will release emails only after the con­flict over the search war­rant has been resolved in court.

    A Google spokes­woman declined to dis­cuss the case specif­i­cal­ly but said the com­pa­ny won’t com­ply with over­ly broad requests.

    “When we receive a sub­poe­na or court order, we check to see if it meets both the let­ter and the spir­it of the law before com­ply­ing,” she said. “And if it does­n’t, we can object or ask that the request is nar­rowed. We have a track record of advo­cat­ing on behalf of our users.”

    Fakhoury says Twit­ter and Face­book in the past have also noti­fied their users about search war­rants on their accounts, but that com­pa­nies have become bold­er in recent years.

    “What’s changed post-Snow­den is that they are more out­spo­ken about it, and they’re more will­ing to inter­ject more direct­ly in sit­u­a­tions,” he says. If com­pa­nies don’t coop­er­ate with the gov­ern­ment, as in Google’s case, they may be held in con­tempt; if they coop­er­ate and the war­rant lat­er turns out to be invalid, they would face no legal penal­ty. But their clients—people with social media or email accounts—want pro­tec­tion if a search war­rant is issued. Com­pa­nies “go out on a limb like this because it’s a good busi­ness prac­tice for them, to look like they stick up for users,” Fakhoury notes.

    The fight over Ben­ton’s emails was kept secret for much of the past year, but it became pub­lic after the recent indict­ments. Ben­ton’s attor­ney wel­comed the increase in pub­lic­i­ty, if only to attract atten­tion to the bat­tle. “This Court should unseal this mat­ter so that the oth­er Defen­dants can be a part of this dis­cus­sion and so that the pub­lic can be aware of the government’s tac­tics,” he wrote last week.

    Howard’s legal fil­ings are lit­tered with ref­er­ences to the gov­ern­men­t’s intru­sive desire to “tram­ple” Ben­ton’s rights. That may be part of a strat­e­gy to claim that the gov­ern­ment is bul­ly­ing polit­i­cal opponents—a poten­tial­ly potent argu­ment in the lib­er­tar­i­an sphere of Rand Paul sup­port­ers where Ben­ton and his code­fen­dants have made their liv­ing.

    ...

    With a court recent­ly rul­ing that the FBI could indeed search Ben­ton’s gmail account, and Google con­tin­ue to refuse access as a show­case of their ded­i­ca­tion to their users’ pri­va­cy, it’s sure look­ing like we could see Google and Ben­ton join hands in try­ing to spin this into a case of the gov­ern­ment “tram­pling” Ben­ton’s rights. And as Han­ni Fakhoury with the Elec­tron­ic Fron­tier Foun­da­tion points out, courts have not yet set­tled the ques­tion of how spe­cif­ic or broad email search war­rants should be, and this case is one of the most promi­nent illus­tra­tions of how users can fight back:

    The gov­ern­ment has now demand­ed that Google be held in con­tempt if the com­pa­ny does­n’t imme­di­ate­ly turn over the emails, and it has argued that Ben­ton and his attor­ney can raise their con­cerns at tri­al if they don’t like the way the search war­rant was obtained. Most peo­ple don’t learn they’re the tar­get of a search war­rant until it has already been exe­cut­ed, which means they don’t have the oppor­tu­ni­ty to chal­lenge the war­rant until the evi­dence appears in court. But access­ing emails is not like kick­ing down a door and find­ing a gun: Google con­trols access to the emails on its serv­er, so the com­pa­ny’s refusal to com­ply with the FBI—and its will­ing­ness to tell Ben­ton about the warrant—not only changes the dynam­ic in this par­tic­u­lar case; it could also cre­ate a prece­dent for oth­ers.

    Han­ni Fakhoury, a senior staff coun­sel with the Elec­tron­ic Fron­tier Foun­da­tion, said courts have not yet set­tled the ques­tion of how spe­cif­ic or broad email search war­rants should be, and this case is one of the most promi­nent illus­tra­tions of how users can fight back.

    “This case is smack in the mid­dle of the debate,” Fakhoury says. “This is a very high-pro­file and dra­mat­ic exam­ple of it, because we’re talk­ing about half a mil­lion emails.”

    A half a mil­lion emails is quite a large num­ber, but then again, this is the email account of one of the key staffers for a pres­i­den­tial cam­paign. Plus, the emails are from 2011–2014, which make sense for an inves­ti­ga­tion for a bribery scan­dal involv­ing a 2012 pres­i­den­tial cam­paign although it’s not unimag­in­able that a case could be made for nar­row­ing that time-frame.

    It all rais­es a gut-wrench­ing pos­si­bil­i­ty: On the one hand, if the FBI’s war­rant real­ly was over­ly broad and sub­se­quent rul­ings agree that it was over­ly broad, Jesse Ben­ton and the Pauls sort of get to claim vic­to­ry and pos­si­bly kill the inves­ti­ga­tion, although its pos­si­ble that the FBI could still nar­row the search war­rant and get the evi­dence it needs. On the oth­er hand, if it turns out the FBI’s war­rant real­ly was over­ly broad but sub­se­quent court rul­ings find oth­er­wise, the case could set a prece­dent basi­cal­ly gives the gov­ern­ment access to your entire email his­to­ry for all sorts of oth­er crim­i­nal cas­es that don’t involve sleazy pols brib­ing each oth­er when even when that full email his­to­ry isn’t remote­ly need­ed or rel­e­vant. So we real­ly have to hope that the FBI was being aggres­sive (because these were sleazy pols brib­ing each oth­er which is dis­gust­ing) but not too aggres­sive, because oth­er­wise the Paul clan’s bribery scan­dal ends up becom­ing a case of ‘the lit­tle guy vs the Big Bad Gov­ern­ment’ regard­less of the out­come.

    It’s also a reminder that the array of new ques­tions relat­ed to the 4th and 5th amend­ments and pri­va­cy rights aren’t lim­it­ed to top­ics like whether or not Apple or Google can make smart­phones with unbreak­able encryp­tion and under what con­di­tions should some­one be forced to hand over their pass­word. In this case, the pow­er to turn over that infor­ma­tion isn’t in the hands of Ben­ton or some unbreak­able-encryp­tion smart­phone user that’s the only per­son with the pass­word. It’s in the hands of Google, and now Google appears to be will­ing to defy court orders and risk con­tempt of court charges, pos­si­bly as some sort of cor­po­rate brand­ing scheme. And until we get some sort of res­o­lu­tion on the case, it leaves open a num­ber of legal ques­tions over what hap­pens if incrim­i­nat­ing evi­dence is co-min­gled with a mas­sive amounts of per­son­al data that almost assured­ly has noth­ing to do with any inves­ti­ga­tion.

    So if you’re plan­ning on brib­ing some politi­cians, keep in mine that it’s not yet clear whether or not you should be using an unbreak­able super-encryp­tion phone, where even Google or Apple can’t access the con­tent and you might be able to plead the 5th Amend­ment, or just stick with Google ser­vices like gmail where, in the event of a war­rant, Google’s cor­po­rate legal team sud­den­ly becomes your legal team. Choos­ing the right smart­phone pack­age for your cam­paign’s polit­i­cal oper­a­tives just got a lot more com­pli­cat­ed.

    Posted by Pterrafractyl | August 22, 2015, 4:38 pm
  11. It looks like Rand Paul’s cam­paign aid, Jesse Ben­ton, who was under FBI inves­ti­ga­tion for brib­ing Iowa state sen­a­tor Ken Soren­son in 2012 as part of Ron Paul’s pres­i­den­tial cam­paign, is out of options. A US Dis­trict Judge just ruled that Google must turn over the emails and if Ben­ton wants to appeal he can do it lat­er. And Google is agree to com­ply with the rul­ing and turn over the emails:

    Asso­ci­at­ed Press
    Feds Win Fight for Access to Indict­ed Paul Aide’s Gmail
    DES MOINES, Iowa — Aug 28, 2015, 4:13 PM ET

    Fed­er­al pros­e­cu­tors pre­vailed Fri­day in their year­long fight to force Google Inc. to turn over the emails of an indict­ed Repub­li­can con­sul­tant with close ties to Ron and Rand Paul.

    U.S. Dis­trict Judge John Jar­vey reject­ed a request to quash a war­rant order­ing Google to give the FBI the con­tents of Jesse Ben­ton’s Gmail account, which he used to work on Ron Paul’s 2012 pres­i­den­tial cam­paign and Sen­ate Major­i­ty Leader Mitch McConnel­l’s 2014 re-elec­tion bid.

    ...

    Under Jar­vey’s order, Google will be legal­ly required to divulge tens of thou­sands of emails sent and received by Ben­ton between March 2011 and July 2014.

    Guy Cook, a lawyer for Google, said Fri­day that the com­pa­ny would respect the order. Lawyers for Ben­ton and the Jus­tice Depart­ment declined to com­ment.

    Jar­vey’s rul­ing appears to end a dis­pute that has got­ten atten­tion in lib­er­tar­i­an and tech­nol­o­gy cir­cles as a test of the gov­ern­men­t’s abil­i­ty to broad­ly review email accounts dur­ing crim­i­nal inves­ti­ga­tions.

    Ben­ton gave the FBI per­mis­sion to search the account last year, but he with­drew it days lat­er after inves­ti­ga­tors start­ed comb­ing through his email. An FBI agent then applied for a war­rant to search and seize parts of the account, which a mag­is­trate judge approved based on prob­a­ble cause that a crime was com­mit­ted.

    After Google received the war­rant, the com­pa­ny told Ben­ton that it intend­ed to com­ply with the request unless he filed a legal chal­lenge. Ben­ton’s attor­ney filed a motion to quash the war­rant, argu­ing that it was over­ly broad, vio­lat­ed his pri­va­cy rights and amount­ed to a fish­ing expe­di­tion.

    Pros­e­cu­tors argued that the war­rant was law­ful and tai­lored to the evi­dence of wrong­do­ing they had uncov­ered relat­ed to improp­er pay­ments to Sen. Kent Soren­son, who flipped from sup­port­ing Michele Bach­mann to Ron Paul days before the 2012 cau­cus­es.

    U.S. Mag­is­trate Judge Helen Adams upheld the war­rant Aug. 10. Google then sought to give Ben­ton time to appeal the order, resist­ing the gov­ern­men­t’s request to imme­di­ate­ly pro­duce the emails.

    Adams last week put the rul­ing on hold so Ben­ton could appeal to the dis­trict judge, Jar­vey, who sided with the gov­ern­ment in a terse order Fri­day. He said the law does­n’t give Ben­ton the abil­i­ty to chal­lenge the exe­cu­tion of a search war­rant before­hand. Instead, Ben­ton could lat­er seek to sup­press any emails the gov­ern­ment wants to use against him in the crim­i­nal case by argu­ing their seizure was uncon­sti­tu­tion­al.

    Pros­e­cu­tors have said they will review the emails and seize only those that are rel­e­vant to their inves­ti­ga­tion. They pledge to fil­ter out all oth­ers, includ­ing those pro­tect­ed by attor­ney-client priv­i­lege.

    Well, it’ll be inter­est­ing to see what they find.

    It’ll also be inter­est­ing to see if we don’t start see­ing some of the con­tents of those emails show­ing up in the media as a result of leaks by Ben­ton him­self while this entire inves­ti­ga­tion is ongo­ing. Why? Because that’s sort of what they were plan­ning on doing to the bribed Iowa state sen­a­tor, Ken Soren­son, if he did­n’t agree to accept the bribe. And it’s some­thing gov­ern­ment pros­e­cu­tors are specif­i­cal­ly wor­ried about in their cur­rent inves­ti­ga­tion:

    Moth­er Jones
    Feds Say Rand and Ron Paul Aides Planned to Smear Local Pol If Pay­off Failed

    The dirty pol­i­tics case that has snared top advis­ers to Rand Paul gets dirt­i­er.

    —By Russ Choma
    | Fri Aug. 14, 2015 2:04 PM EDT

    Since last week’s indict­ments of three top polit­i­cal aides to Ron and Rand Paul, new details have emerged about the Ron Paul cam­paign’s scheme in 2012 to buy the endorse­ment of Kent Soren­son, who was then an influ­en­tial Repub­li­can state sen­a­tor in Iowa. In the lat­est court fil­ing, fed­er­al pros­e­cu­tors assert that the Paul aides planned to smear Soren­son if he refused to accept a bribe. This case will like­ly con­tin­ue to dog pres­i­den­tial can­di­date Rand Paul, who has at times employed all three men. Two of the indict­ed aides, Jesse Ben­ton (who is mar­ried to Rand Paul’s niece) and John Tate, were run­ning the main super-PAC sup­port­ing Rand Paul’s pres­i­den­tial cam­paign. Fol­low­ing the indict­ments, each of them took a leave of absence from the super-PAC.

    A fed­er­al grand jury charged Ben­ton, Tate, and Dim­itri Kesari with mul­ti­ple felonies, accus­ing them of orga­niz­ing a secret effort to pay Soren­son more than $73,000 just days before the Iowa cau­cus­es to change his endorse­ment from Michele Bach­mann to Ron Paul. Kesari is a long­time Paul fam­i­ly oper­a­tive: He worked for Ron Paul’s pres­i­den­tial cam­paigns and Rand Paul’s 2010 Sen­ate cam­paign, as well as Sen­ate Major­i­ty Leader Mitch McConnel­l’s reelec­tion effort last year.

    Pros­e­cu­tors are gen­er­al­ly required to share their evi­dence with a defen­dant to allow him or her to pre­pare for a tri­al. But on Thurs­day, Jus­tice Depart­ment lawyers asked the fed­er­al judge in charge of the case for per­mis­sion to with­hold from these defen­dants copies of cer­tain sen­si­tive doc­u­ments, such as the grand jury tran­script and wit­ness state­ments. The defen­dants will be allowed to review the infor­ma­tion, but the pros­e­cu­tors don’t want to hand over the mate­r­i­al. They say they have rea­son to believe the defen­dants might leak sen­si­tive doc­u­ments to the media. Dur­ing the pre-indict­ment inquiry, the pros­e­cu­tors claim, inves­ti­ga­tors found emails show­ing that the three Paul aides were pre­pared to leak doc­u­ments to harm Soren­son in 2012 if they could­n’t obtain his endorse­ment for Ron Paul.

    “Those com­mu­ni­ca­tions show that the defen­dants, who are career polit­i­cal oper­a­tives, were will­ing to leak sen­si­tive doc­u­ments regard­ing Soren­son to the press to suit their own ends,” Ray­mond Hulser, chief of the Depart­ment of Jus­tice’s pub­lic integri­ty divi­sion, stat­ed. “That his­to­ry gives the gov­ern­ment con­cern as to what the defen­dants (as opposed to their coun­sel) might do with copies of inter­view reports and grand jury tran­scripts of Soren­son and the oth­er wit­ness­es in this case.”

    Ben­ton’s attor­ney, Roscoe Howard, says he can­not com­ment because he’s prepar­ing a response to file in court. But the rev­e­la­tion adds a new wrin­kle to the case. leaked pub­licly by a for­mer Ron Paul aide in 2013 indi­cate that Soren­son was approached by the Ron Paul cam­paign about his will­ing­ness to switch sides, and he respond­ed with a lengthy list of demands that includ­ed a salary of $8,000 a month and a $100,000 dona­tion to his polit­i­cal action com­mit­tee.

    Under Iowa Sen­ate ethics rules, a law­mak­er can­not sell his endorse­ment to a pres­i­den­tial cam­paign. Fol­low­ing an Iowa Sen­ate inves­ti­ga­tion that found Soren­son accept­ed pay­ments from a com­pa­ny tied to the Ron Paul cam­paign, Soren­son resigned his seat in 2013. Last August, he plead­ed guilty to cam­paign finance charges. Soren­son is cur­rent­ly await­ing sen­tenc­ing.

    Update: The lawyer for Jesse Ben­ton has respond­ed to the gov­ern­men­t’s accu­sa­tion that his client planned to leak doc­u­ments to smear Soren­son if he did not agree to endorse Ron Paul. In a fil­ing made to the fed­er­al court, Ben­ton’s attor­ney, Roscoe Howard, said pros­e­cu­tors are refer­ring to an email Ben­ton sent in late 2011, around the time Soren­son switched from endors­ing the Bach­mann cam­paign to endors­ing the Paul cam­paign. In the email, Howard not­ed, Ben­ton “threat­ened to expose Mr. Soren­son, believ­ing that Mr. Soren­son was try­ing to black­mail the 2012 RP Cam­paign, if Mr. Soren­son did not make up his mind on whether to com­mit to the Ron Paul Cam­paign.”

    Howard wrote that it was a “a knee-jerk, emo­tion­al reac­tion” and point­ed out that Ben­ton nev­er fol­lowed through.

    ...

    Yes, Ben­ton was threat­en­ing to black­mail the guy he was brib­ing, but accord­ing to his lawyer it was just because Ben­ton was was con­cerned that Soren­son was try­ing to black­mail Ron Paul’s cam­paign:

    ...
    Update: The lawyer for Jesse Ben­ton has respond­ed to the gov­ern­men­t’s accu­sa­tion that his client planned to leak doc­u­ments to smear Soren­son if he did not agree to endorse Ron Paul. In a fil­ing made to the fed­er­al court, Ben­ton’s attor­ney, Roscoe Howard, said pros­e­cu­tors are refer­ring to an email Ben­ton sent in late 2011, around the time Soren­son switched from endors­ing the Bach­mann cam­paign to endors­ing the Paul cam­paign. In the email, Howard not­ed, Ben­ton “threat­ened to expose Mr. Soren­son, believ­ing that Mr. Soren­son was try­ing to black­mail the 2012 RP Cam­paign, if Mr. Soren­son did not make up his mind on whether to com­mit to the Ron Paul Cam­paign.”

    Howard wrote that it was a “a knee-jerk, emo­tion­al reac­tion” and point­ed out that Ben­ton nev­er fol­lowed through.
    ...

    They prob­a­bly weren’t going to leak that email.

    Posted by Pterrafractyl | August 29, 2015, 5:16 pm
  12. It looks like Sym­pho­ny, the new strong­ly-encrypt­ed mes­sag­ing sys­tem made by and for Wall Street’s ‘usu­al sus­pects’, has a strat­e­gy for assuag­ing its crit­ics: turn this into a fight about Big Gov­ern­ment and the inva­sion of pri­va­cy while tout­ing how it will keep all those text mes­sages nice and safe from hack­ers so reg­u­la­tors can access them when they request them:

    Amer­i­can Banker
    Note to Crit­ics: Bank-Backed Mes­sage Ser­vice Not Back­ing Down
    Pen­ny Cros­man
    By Pen­ny Cros­man
    Sep­tem­ber 1, 2015

    For a rel­a­tive­ly sim­ple soft­ware prod­uct that has not been released yet, the instant mes­sag­ing ser­vice Sym­pho­ny — which is backed by fif­teen large banks — has gen­er­at­ed a remark­able amount of buzz.

    A lot of it has been neg­a­tive, led by pol­i­cy­mak­ers such as Sen­ate Bank­ing Com­mit­tee mem­ber Eliz­a­beth War­ren, who says the encrypt­ed ser­vice would com­pro­mise reg­u­la­tors’ abil­i­ty to root out fraud in big banks like the Libor rate-rig­ging scan­dal.

    Sym­pho­ny Com­mu­ni­ca­tion Ser­vices’ chief exec­u­tive, David Gurle, has held sev­er­al meet­ings with reg­u­la­tors from var­i­ous agen­cies. He insists that in spite of the con­tro­ver­sy and reg­u­la­tors’ ques­tion­ing, the ser­vice will launch Sept. 15 as planned.

    To suc­ceed Gurle will have to focus the dis­cus­sion on the mer­its of the sys­tem and pri­va­cy con­cerns and away from crit­ics’ opin­ions about its users, one observ­er said.

    “These are shots across the bow at Sym­pho­ny’s investors, whom they per­ceive as bad actors, not at Sym­pho­ny itself,” said David Weiss, senior ana­lyst at Aite Group. “There’s no reg­u­la­to­ry over­sight of Sym­pho­ny as a com­pa­ny by any of these folks.”

    The case of the instant mes­sag­ing ser­vice that banks love and reg­u­la­tors shake their head at rais­es broad ques­tions about the best ways to secure data, pro­tect data pri­va­cy and com­ply with reg­u­la­to­ry man­dates, as well as whether gov­ern­ments should be allowed to have “back doors” to indus­try data — ques­tions that affect all banks and their ven­dors.

    Con­tro­ver­sial Soft­ware
    Sym­pho­ny start­ed as an in-house mes­sag­ing project at Gold­man Sachs. The bank worked with Gurle, who then was run­ning a secure instant mes­sag­ing start­up called Per­zo, and formed a con­sor­tium that bought out Per­zo and renamed it Sym­pho­ny Com­mu­ni­ca­tions LLP.

    ...

    The key dif­fer­ence between Sym­pho­ny and the incum­bents is its abil­i­ty to not only encrypt every mes­sage, but to allow each bank to hold the encryp­tion keys to its own com­mu­ni­ca­tions archive. Instant Bloomberg does not have such encryp­tion built in and reg­u­la­tors have been able to review bank mes­sages with­out hav­ing to ask the bank for them.

    For banks that use Sym­pho­ny, reg­u­la­tors would not have such “back-door” access to mes­sages. To access records, they would need to sub­poe­na a bank for them, which is the nor­mal pro­ce­dure.

    In July the New York State Depart­ment of Finan­cial Ser­vices sent a let­ter to Sym­pho­ny’s man­age­ment, ask­ing ques­tions about how it encrypts data and stores mes­sages; oth­er reg­u­la­to­ry agen­cies have fol­lowed suit. In August, Sen. War­ren, D‑Mass., sent let­ters to six bank reg­u­la­to­ry agen­cies about it and was quot­ed in many pub­li­ca­tions warn­ing that Sym­pho­ny could be used to cir­cum­vent com­pli­ance and reg­u­la­to­ry review.

    “The com­mu­ni­ca­tions that Sym­pho­ny will allow com­pa­nies to hide from ‘gov­ern­ment spy­ing’ — such as text mes­sages and chat-room tran­scripts — have proven to be key evi­dence in pre­vi­ous reg­u­la­to­ry and com­pli­ance cas­es that have uncov­ered crim­i­nal action by Wall Street,” War­ren wrote in a let­ter to the Con­sumer Finan­cial Pro­tec­tion Bureau. “If banks are now mak­ing this infor­ma­tion more dif­fi­cult for reg­u­la­tors to obtain and inter­pret, it could pre­vent reg­u­la­tors from iden­ti­fy­ing and pre­vent­ing future ille­gal behav­ior.”

    Gurle sees the issue of pro­vid­ing back doors to gov­ern­ments as part of the nation­al pri­va­cy debate.

    “You have to take two steps back and look at this from the big pic­ture,” he said. “On one side, there’s pri­va­cy which we do have to pro­tect. That’s a right we’ve earned over the course of our his­to­ry. On the oth­er hand, there are peo­ple who have bad inten­tions who have a desire for pri­va­cy. This requires the gov­ern­ment to find dif­fer­ent ways of get­ting infor­ma­tion.”

    If fed­er­al reg­u­la­tions were to require Sym­pho­ny to change its encryp­tion pol­i­cy and store keys so that it could pro­vide gov­ern­ment agen­cies with access to mes­sages, those rules would log­i­cal­ly also apply to oth­er mes­sag­ing appli­ca­tions that use encryp­tion, includ­ing What­sApp, Face­book and Apple iMes­sage, Gurle said.

    “I’ll give you my dream sce­nario: [pol­i­cy­mak­ers] do under­stand val­ue in encryp­tion, for their work they do in reg­u­lat­ing the finan­cial mar­kets and for the peo­ple being reg­u­lat­ed,” he said. “Encryp­tion is the right tech­nol­o­gy going for­ward. I think we’ve solved the ques­tion of encryp­tion and com­pli­ance in a way that’s sat­is­fac­to­ry.”

    Built-In Safe­guards
    Encrypt­ed mes­sages can­not be mod­i­fied, for instance. And the same type of back door that lets a gov­ern­ment agency view mes­sages could poten­tial­ly be accessed by a hack­er, Gurle and oth­ers said.

    Reg­u­la­tors’ con­cerns are overblown, said a banker involved in the project who spoke off the record.

    “It’s not Sym­pho­ny’s respon­si­bil­i­ty to make the data avail­able — it’s the bank’s respon­si­bil­i­ty,” the banker said. “If the reg­u­la­tor needs to see infor­ma­tion, they’ll need to go to the bank direct­ly.”

    As for the type of col­lu­sion that occurred in the Libor rate-rig­ging case, Sym­pho­ny would auto­mat­i­cal­ly block such behav­ior because no more than two banks can access a chat room at any one time, the banker said.

    Gurle said he has explained to sev­er­al reg­u­la­tors that Sym­pho­ny helps banks com­ply with reg­u­la­tions. “We’ve edu­cat­ed them about how our sys­tem works, how we pro­tect our cus­tomers’ pri­va­cy, how we pro­tect data manip­u­la­tion so they can be sure that what’s being record­ed is com­pli­ant with [New York state reg­u­la­to­ry] stan­dards,” he said. The talks are ongo­ing.

    What Banks Like
    The fif­teen finan­cial insti­tu­tions behind Sym­pho­ny — Gold­man Sachs, Bank of Amer­i­ca Mer­rill Lynch, JPMor­gan Chase, Cit­i­group, Mor­gan Stan­ley, Wells Far­go, Bank of New York Mel­lon, Black­Rock, Citadel, Cred­it Suisse, Deutsche Bank, HSBC, Jef­feries, Mav­er­ick Cap­i­tal and Nomu­ra — first and fore­most like the secu­ri­ty fea­tures that would pro­tect their pro­pri­etary com­mu­ni­ca­tions.

    “Sym­pho­ny is the safest way to chat in the mar­ket today,” said the exec­u­tive who spoke off the record. “That’s a result of the encryp­tion tech­nol­o­gy that’s been built into the plat­form. … You could poten­tial­ly hack it and get a pack­et, and it would be mean­ing­less to you.”

    At the same time, the banker said, the banks will be ful­ly com­pli­ant with reg­u­la­to­ry require­ments.

    “We would have the keys and the capa­bil­i­ty to decode mes­sages so reg­u­la­tors can see what they need to see,” the banker said. “We’re not hid­ing the mes­sages, but keep­ing them from peo­ple who should­n’t have access, like hack­ers.”

    The soft­ware also has cer­tain com­pli­ance safe­guards: for instance, it does not allow sales­peo­ple and research peo­ple to talk to each oth­er, per the Chi­nese wall banks are sup­posed to observe.

    Sym­pho­ny also pro­vides “smart fil­ters” to help users find use­ful infor­ma­tion. “Say you’re a buy-side ana­lyst, and you’re receiv­ing lots of inbound infor­ma­tion and you spend a lot of time skim­ming through that look­ing for things that mat­ter to you and to your port­fo­lio,” Gurle said. A smart fil­ter could more quick­ly sift through mes­sages, Twit­ter feeds and oth­er sources for rel­e­vant infor­ma­tion.

    Over time, the plat­form will take on added capa­bil­i­ties, such as email and video, the banker said. It also allows more fil­ter­ing, to let banks iden­ti­fy any improp­er behav­ior more quick­ly.

    Yes, the CEO of Sym­pho­ny real­ly made this argu­ment:

    ...
    Sym­pho­ny Com­mu­ni­ca­tion Ser­vices’ chief exec­u­tive, David Gurle, has held sev­er­al meet­ings with reg­u­la­tors from var­i­ous agen­cies. He insists that in spite of the con­tro­ver­sy and reg­u­la­tors’ ques­tion­ing, the ser­vice will launch Sept. 15 as planned.

    To suc­ceed Gurle will have to focus the dis­cus­sion on the mer­its of the sys­tem and pri­va­cy con­cerns and away from crit­ics’ opin­ions about its users, one observ­er said.

    “These are shots across the bow at Sym­pho­ny’s investors, whom they per­ceive as bad actors, not at Sym­pho­ny itself,” said David Weiss, senior ana­lyst at Aite Group. There’s no reg­u­la­to­ry over­sight of Sym­pho­ny as a com­pa­ny by any of these folks.
    ...

    So peo­ple are con­cerned about the banks they per­ceive as ‘bad actors’ using a sys­tems that requires trust in those bad actors because it’s the bad actors, and not Sym­pho­ny, that con­trol access to the encypt­ed mes­sages, and the argu­ment by Sym­pho­ny is not to wor­ry because the bad actors, that hap­pen to be investors Sym­pho­ny, don’t actu­al­ly have any reg­u­la­to­ry over­sight over the com­pa­ny. Well that sure makes all those con­cerns just melt away!

    And, of course, as an anony­mous banker involved in the project points out, “It’s not Sym­pho­ny’s respon­si­bil­i­ty to make the data avail­able — it’s the bank’s respon­si­bil­i­ty,” :

    ...
    Reg­u­la­tors’ con­cerns are overblown, said a banker involved in the project who spoke off the record.

    It’s not Sym­pho­ny’s respon­si­bil­i­ty to make the data avail­able — it’s the bank’s respon­si­bil­i­ty,” the banker said. “If the reg­u­la­tor needs to see infor­ma­tion, they’ll need to go to the bank direct­ly.”
    ...

    And that’s all part of why it’s going to be very inter­est­ing to see how much Wall Street attempts to turn this into a ‘pri­vate sec­tors vs Big Broth­er’ pol­i­cy debate. Because if Wall Street’s ‘bad actors’ are the keep­ers of the keys, the best way to gen­er­ate pub­lic sup­port for that sys­tem is to make the enti­ties that might want those keys (the gov­ern­ment and hack­ers) seem even worse:

    ...
    Gurle sees the issue of pro­vid­ing back doors to gov­ern­ments as part of the nation­al pri­va­cy debate.

    “You have to take two steps back and look at this from the big pic­ture,” he said. “On one side, there’s pri­va­cy which we do have to pro­tect. That’s a right we’ve earned over the course of our his­to­ry. On the oth­er hand, there are peo­ple who have bad inten­tions who have a desire for pri­va­cy. This requires the gov­ern­ment to find dif­fer­ent ways of get­ting infor­ma­tion.”

    If fed­er­al reg­u­la­tions were to require Sym­pho­ny to change its encryp­tion pol­i­cy and store keys so that it could pro­vide gov­ern­ment agen­cies with access to mes­sages, those rules would log­i­cal­ly also apply to oth­er mes­sag­ing appli­ca­tions that use encryp­tion, includ­ing What­sApp, Face­book and Apple iMes­sage, Gurle said.

    “I’ll give you my dream sce­nario: [pol­i­cy­mak­ers] do under­stand val­ue in encryp­tion, for their work they do in reg­u­lat­ing the finan­cial mar­kets and for the peo­ple being reg­u­lat­ed,” he said. “Encryp­tion is the right tech­nol­o­gy going for­ward. I think we’ve solved the ques­tion of encryp­tion and com­pli­ance in a way that’s sat­is­fac­to­ry.”

    ...

    “Sym­pho­ny is the safest way to chat in the mar­ket today,” said the exec­u­tive who spoke off the record. “That’s a result of the encryp­tion tech­nol­o­gy that’s been built into the plat­form. … You could poten­tial­ly hack it and get a pack­et, and it would be mean­ing­less to you.”

    At the same time, the banker said, the banks will be ful­ly com­pli­ant with reg­u­la­to­ry require­ments.

    “We would have the keys and the capa­bil­i­ty to decode mes­sages so reg­u­la­tors can see what they need to see,” the banker said. “We’re not hid­ing the mes­sages, but keep­ing them from peo­ple who should­n’t have access, like hack­ers.”
    ...

    “If fed­er­al reg­u­la­tions were to require Sym­pho­ny to change its encryp­tion pol­i­cy and store keys so that it could pro­vide gov­ern­ment agen­cies with access to mes­sages, those rules would log­i­cal­ly also apply to oth­er mes­sag­ing appli­ca­tions that use encryp­tion, includ­ing What­sApp, Face­book and Apple iMes­sage, Gurle said.”

    Wall Street’s love-hate rela­tion­ship with the Cypher­punk rev­o­lu­tion is about to get a lot more lov­ing.

    Posted by Pterrafractyl | September 3, 2015, 11:03 am
  13. Sym­pho­ny, Wall Street’s fan­cy new bank-to-bank mes­sag­ing sys­tem that sports super-encryp­tion even the gov­ern­ment can’t break, just went live. And they did so only after com­ing to an agree­ment with the New York Depart­ment of Finan­cial Ser­vices over con­cerns that Sym­pho­ny’s clients were going to be hid­ing incrim­i­nat­ing evi­dence from reg­u­la­tors: Sym­pho­ny agrees to keep copies of client mes­sages for sev­en years. Addi­tion­al­ly, for four banks — Gold­man Sachs, Deutsche Bank, Cred­it Suisse and Bank of New York Mel­lon — that are both investors in Sym­pho­ny and, in most cas­es, per­pe­tra­tors of the giant Libor-rig­ging car­tel arranged via a chat sys­tem, they also have to give copies of their encryp­tion keys to an inde­pen­dent cus­to­di­an.

    So with those safe­guards in place, Wall Street’s con­trolled infor­ma­tion black hole is now a real­i­ty:

    Re/Code
    Mes­sag­ing Ser­vice Sym­pho­ny Dodges Reg­u­la­to­ry Action Ahead of Launch

    By Arik Hes­sel­dahl

    Sep­tem­ber 14, 2015, 6:59 PM PDT

    Sym­pho­ny, the secure mes­sag­ing com­pa­ny backed by 15 Wall Street banks, will launch on Tues­day after ham­mer­ing out a deal with a reg­u­la­to­ry agency that once threat­ened to shut down the first real chal­lenge to the Bloomberg Ter­mi­nal.

    Three years in the mak­ing, Sym­pho­ny was born out of des­per­a­tion among the world’s most pow­er­ful finan­cial firms and invest­ment hous­es to break free of Bloomberg’s stran­gle­hold on finan­cial soft­ware, data and news. Long before peo­ple used Face­book, MySpace, Twit­ter or AOL Instant Mes­sen­ger, finan­cial pro­fes­sion­als depend­ed on the ter­mi­nal to chat with and keep track of one anoth­er. Today, the ter­mi­nal con­fers sta­tus and priv­i­lege to the more than 325,000 finan­cial pros who pay $24,000 a year to use it.

    Symphony’s cloud-based mes­sag­ing ser­vice does two things: It uses advanced encryp­tion tech­niques in order to keep sen­si­tive mes­sages — instant mes­sages most­ly — locked up and out of the hands of hack­ers. But since it’s designed for finan­cial com­pa­nies, which are required by law to keep copies of their mes­sages for sev­er­al years in case reg­u­la­tors or law enforce­ment ever needs them for an inves­ti­ga­tion, it has also been designed to work in con­cert with what­ev­er com­pli­ance tools those com­pa­nies have in place.

    So when the New York Depart­ment of Finan­cial Ser­vices raised sus­pi­cions over the sum­mer that banks might use Symphony’s encryp­tion tech­nol­o­gy to avoid the pry­ing eyes of reg­u­la­tors, it seemed plau­si­ble that the com­pa­ny could face restric­tions on how it does busi­ness.

    That didn’t hap­pen. Instead, on Mon­day Sym­pho­ny announced a deal with the DFS under which it agreed to store for sev­en years copies of mes­sages that its clients send on the ser­vice. Addi­tion­al­ly, four banks (Gold­man Sachs, Deutsche Bank, Cred­it Suisse and Bank of New York Mel­lon) which are both cus­tomers of and investors in Sym­pho­ny agreed to turn over copies of their encryp­tion keys to an inde­pen­dent cus­to­di­an. When a reg­u­la­tor wants to review encrypt­ed mes­sages, they will be able to decrypt them upon request.

    “The agree­ment is anoth­er pos­i­tive devel­op­ment on the eve of Symphony’s launch,” the com­pa­ny said in a state­ment emailed to Re/code. “Symphony’s plat­form safe­guards against cyber-threats while strength­en­ing cus­tomers’ com­pli­ance oper­a­tions and facil­i­tat­ing their abil­i­ty to meet their reg­u­la­to­ry oblig­a­tions. Sym­pho­ny can store data secure­ly for as long as its cus­tomers request, and its end-to-end encryp­tion ensures mes­sages are secure. Sym­pho­ny pro­vides state-of-the-art cyber-secu­ri­ty for insti­tu­tions oper­at­ing in com­plex reg­u­la­to­ry envi­ron­ments.”

    It’s not entire­ly the end of the reg­u­la­to­ry road for Sym­pho­ny: Over the sum­mer Sen. Eliz­a­beth War­ren wrote a let­ter to fed­er­al reg­u­la­tors express­ing wor­ries sim­i­lar to those of DFS, and there are ques­tions pend­ing too from inter­na­tion­al reg­u­la­to­ry bod­ies. But none of them are espe­cial­ly wor­ry­ing to CEO David Gurle.

    “We’ve engaged in a series of meet­ings with reg­u­la­tors where we demon­strate that we have capa­bil­i­ties that can be used by reg­u­la­tors to car­ry out any kind of inves­ti­ga­tion they may want to do,” he told Re/code in an inter­view ear­li­er this month. “What we do enhances the abil­i­ty of our clients to meet their legal and reg­u­la­to­ry oblig­a­tions, but it also gives them the added ben­e­fit of secure com­mu­ni­ca­tions.”

    ...

    Note that, while this is cer­tain­ly a major vic­to­ry for the Sym­pho­ny, it’s also is just the New York state finan­cial reg­u­la­tor that gave Sym­pho­ny the green light. Fed­er­al and inter­na­tion­al reg­u­la­tors have yet to weight in:

    ...
    It’s not entire­ly the end of the reg­u­la­to­ry road for Sym­pho­ny: Over the sum­mer Sen. Eliz­a­beth War­ren wrote a let­ter to fed­er­al reg­u­la­tors express­ing wor­ries sim­i­lar to those of DFS, and there are ques­tions pend­ing too from inter­na­tion­al reg­u­la­to­ry bod­ies. But none of them are espe­cial­ly wor­ry­ing to CEO David Gurle.
    ...

    Also note that, while four of Sym­pho­ny’s investors have agreed to com­ply with addi­tion­al rules man­dat­ing that copies of their encryp­tion keys be kept with an inde­pen­dent enti­ty, that still leaves ten oth­er large finan­cial enti­ties (Bank of Amer­i­ca, Black­Rock, Citadel, Cit­i­group, Jef­feries Group LLC, JPMor­gan Chase & Co, Mav­er­ick Cap­i­tal Ltd, Mor­gan Stan­ley, Nomu­ra Hold­ings Inc and Wells Far­go & Co), many with high­ly ques­tion­able reg­u­la­to­ry track records, that are pre­sum­ably going to be using Sym­pho­ny too, just not under the reg­u­la­to­ry author­i­ty of the DFS.

    Will those oth­er large firms also agree to addi­tion­al scruti­ny and over­sight as Sym­pho­ny’s debut gets under­way? We’ll have to wait and see, but it’s worth not­ing that DFS “believes that the require­ments includ­ed in today’s agree­ments should apply to all reg­u­lat­ed finan­cial insti­tu­tions using Sym­pho­ny in the future”:

    Finan­cial Times
    Sym­pho­ny reach­es data deal with reg­u­la­tor.

    Gina Chon in Wash­ing­ton and Ben McLan­na­han in New York
    Sep­tem­ber 14, 2015 5:36 pm

    Gold­man Sachs and Deutsche Bank are among four banks that have reached a record-keep­ing agree­ment with a New York reg­u­la­tor to set­tle con­cerns that some fea­tures of Sym­pho­ny, the mes­sag­ing tool, could ham­per inves­ti­ga­tions.

    The Depart­ment of Finan­cial Ser­vices, which has inves­ti­gat­ed the poten­tial rig­ging of for­eign exchange mar­kets that involved cha­t­room mes­sages, was con­cerned about the capa­bil­i­ties of Sym­pho­ny, which is backed by some of Wall Street’s biggest insti­tu­tions, includ­ing its “guar­an­teed data dele­tion” func­tion.

    The DFS agree­ment, which also includes Cred­it Suisse and Bank of New York Mel­lon, takes some reg­u­la­to­ry pres­sure off Sym­pho­ny ahead of its launch Tues­day. The start up recent­ly struck a deal with Dow Jones to offer news con­tent in its ser­vice as it looks to bat­tle Bloomberg, the mar­ket leader.

    As part of the agree­ment with DFS, Sym­pho­ny for sev­en years will retain cha­t­room and oth­er elec­tron­ic com­mu­ni­ca­tion sent through its plat­forms to or from the banks. The banks will also store dupli­cate copies of decryp­tion keys for their mes­sages with inde­pen­dent enti­ties.

    In July, the DFS sent a let­ter to the banks under its juris­dic­tion ask­ing for more infor­ma­tion about Symphony’s fea­tures, such as “end-to-end encryp­tion”.

    “We are pleased that these banks did the right thing by work­ing coop­er­a­tive­ly with us to help address our con­cerns about this new mes­sag­ing plat­form,” said act­ing DFS super­in­ten­dent Antho­ny Albanese. “This is a crit­i­cal issue since chats and oth­er elec­tron­ic records have pro­vid­ed key evi­dence in inves­ti­ga­tions of wrong­do­ing on Wall Street.”

    It is unclear whether the 10 oth­er finan­cial insti­tu­tions that back Sym­pho­ny, but are not under DFS over­sight, will agree to sim­i­lar terms. The DFS said it “believes that the require­ments includ­ed in today’s agree­ments should apply to all reg­u­lat­ed finan­cial insti­tu­tions using Sym­pho­ny in the future”.

    In August, Sen­a­tor Eliz­a­beth War­ren sent a let­ter to six fed­er­al finan­cial reg­u­la­tors rais­ing con­cerns about Sym­pho­ny, say­ing the ser­vice appears to “to put com­pa­nies on notice — with a wink and a nod — that they can use Sym­pho­ny to reduce com­pli­ance and enforce­ment con­cerns”.

    Sym­pho­ny has since mod­i­fied its web­site. It no longer refers to the “guar­an­teed data dele­tion” and states that Sym­pho­ny can be con­fig­ured to oper­ate with a customer’s archiv­ing sys­tem, includ­ing mes­sages that can be decrypt­ed.

    ...

    So it’s unclear whether or not those 10 oth­er Sym­pho­ny investors will com­ply with the addi­tion­al encryp­tion-key rules, but DFS cer­tain­ly thinks they should and should also apply to all finan­cials insti­tu­tions using Sym­pho­ny in the future. As Sym­pho­ny ush­ers in the era of black hole dig­i­tal record keep­ing for Wall Street this week, that gap between what reg­u­la­tors see as nec­es­sary and what Wall Street is actu­al­ly doing is some­thing worth keep­ing in mind.

    Posted by Pterrafractyl | September 15, 2015, 6:31 pm
  14. If you’re very patient and a fan of Tor but find it lack­ing in cryp­to­graph­i­cal­ly-prov­able anonymi­ty, it’s good you’re patient, because a much slow­er, but more secure, ver­sion of Tor is com­ing at some point:

    Vice
    Moth­er­board
    ‘Dis­sent,’ a New Type of Secu­ri­ty Tool, Could Marked­ly Improve Online Anonymi­ty

    Writ­ten by J.M. Porup

    Sep­tem­ber 16, 2015 // 04:00 AM EST

    Researchers at the Dis­sent Project are build­ing a new kind of anonymi­ty tool that, when used in con­junc­tion with the Tor anonymi­ty net­work, could sig­nif­i­cant­ly improve online anonymi­ty.

    Unlike Tor’s onion rout­ing archi­tec­ture, which routes inter­net traf­fic through a series of “onion lay­ers” to obscure your iden­ti­ty, Dis­sent imple­ments a din­ing cryp­tog­ra­phers net­work, or DC-net, which makes pos­si­ble cryp­to­graph­i­cal­ly-prov­able anonymi­ty.

    The din­ing cryp­tog­ra­phers prob­lem was first pro­posed in 1988 by cryp­tog­ra­ph­er David Chaum, and involves cryp­tog­ra­phers try­ing to anony­mous­ly prove to each oth­er whether or not the NSA paid their restau­rant bill. (It’s a long sto­ry. You can read the paper here.)

    DC-nets are hard­er to con­cep­tu­al­ize than onion-rout­ing. The key take­away is that, unlike onion rout­ing, DC nets offer cryp­to­graph­i­cal­ly prov­able anonymity—although at a much slow­er speed than Tor. For appli­ca­tions that do not require real-time inter­ac­tion with anoth­er per­son or web­site, Dis­sent offers much stronger anonymi­ty than Tor.

    “One of the most impor­tant things to under­stand about Dis­sent,” project lead Bryan Ford said over a Sig­nal call, “is that it’s not going to be a drop-in replace­ment for Tor, at least not in its cur­rent form.”

    The prob­lem is that achiev­ing prov­able anonymi­ty in a DC-net is that it’s slow—slower than Tor. “DC-nets work because every­one broad­casts all their pack­ets to every­one else,” Ford explained. “This ensures that a small num­ber of dis­hon­est actors can­not de-anonymize the channel...but it also slows things down.”

    Rather, he explained, as a DC-net, Dis­sent offers a prov­ably anony­mous way to pub­lish, well, dissent—broadcast com­mu­ni­ca­tion such as blog­ging, microblog­ging (e.g. Twit­ter), or IRC.

    “If you use DC nets to try to han­dle 10,000 con­cur­rent point-to-point uni­cast com­mu­ni­ca­tion chan­nels, which is what Tor nor­mal­ly does, it’s not going to scale very well,” Ford said.

    One poten­tial use for Dis­sent that would bol­ster a weak­ness of Tor, he explained, would be to cre­ate a pri­va­cy-pre­serv­ing wifi net­work­ing lay­er.

    “Think of it as an enhanced router that has local area anonymi­ty built in,” Ford said. “Any time you’re using this router, you’re using din­ing cryp­tog­ra­phers anonymi­ty, and all the nodes around the base sta­tion are indis­tin­guish­able from each oth­er.”

    The anony­mous LAN could be a home or a neigh­bor­hood or a cam­pus net­work or even a cor­po­rate net­work.

    This would pro­tect users against one of Tor’s weak­ness­es: the entry guard.

    “If you’re using Tor to get anonymi­ty,” Ford said, “you are very sen­si­tive to any fail­ure of the secu­ri­ty of your entry guard—the first node that your con­nec­tion is going to. If that node is com­pro­mised or out to get you, there’s not much you can do. An attack­er is prob­a­bly going to get you soon, if they don’t imme­di­ate­ly.”

    Ford hopes to make Tor entry guards more robust by mak­ing them part of a local Dis­sent DC-net. “So even if the entry guard is com­pro­mised,” he said, “even if the whole Tor path is com­pro­mised, the entry guard would still not be able to de-anonymize you.”

    Roger Din­gle­dine, co-founder of the Tor Project, is opti­mistic about the future of Dis­sent. “Bryan Ford’s stuff is good research, well respect­ed in the field,” he wrote in an email. “His designs are more amenable to proofs of secu­ri­ty than Tor (good), but the trade­off is that they don’t scale as well (bad), and they’re not as resilient to real-world things like denial of ser­vice attacks. That does­n’t make them use­less; it just means they’re far ear­li­er in the devel­op­ment process than Tor is.”

    Ford and his team have been work­ing on Dis­sent for more than four years. He has high con­fi­dence that Dis­sent is sol­id under the hood, but more appli­ca­tion-lay­er soft­ware engi­neer­ing is need­ed before it will be ready for pub­lic use. “The anonymi­ty engine works, it’s avail­able, you can down­load the code,” he said. End users want­i­ng to take it for a spin may have to wait a while, though. He’s reluc­tant to name a date for appli­ca­tion release, but hopes to have some­thing for users to play with by ear­ly next year.

    Tor isn’t going away any time soon. But, as Din­gle­dine empha­sizes, more research into anony­mous com­mu­ni­ca­tion is need­ed.

    ...

    And in case you were curi­ous if Dis­sent, like Tor, is fund­ed by DARPA....and...*drum roll*...let’s take a look at the Dis­sent project acknowl­edge­ments:

    ...
    Acknowl­edge­ments
    This mate­r­i­al is based upon work sup­port­ed by the Nation­al Sci­ence Foun­da­tion under Grant No. CNS-0916413, and sup­port­ed by the Defense Advanced Research Agency (DARPA) and SPAWAR Sys­tems Cen­ter Pacif­ic, Con­tract No. N66001-11-C-4018. Any opin­ions, find­ings and con­clu­sions or rec­om­men­da­tions expressed in this mate­r­i­al are those of the author(s) and do not nec­es­sar­i­ly reflect the views of the Nation­al Sci­ence Foun­da­tion, the Defense Advanced Research Agency (DARPA), and SPAWAR Sys­tems Cen­ter Pacif­ic.

    Posted by Pterrafractyl | September 22, 2015, 9:15 pm
  15. Just FYI, if you can say you’ve nev­er been a vic­tim of some sort of ‘ran­somware’ attack that’s great, but it’s going to be a lot hard­er to say that in the future once the ran­somware bonan­za begins now that it’s known that a sin­gle enti­ty may be behind the mas­sive $325 mil­lion Cryp­towall 3.0 ran­somware rack­et:

    The Reg­is­ter
    Lone wolves could be behind mul­ti-mil­lion dol­lar Cryp­towall ran­somware rack­et
    Top tech firms say group is ‘immense­ly suc­cess­ful’

    30 Oct 2015 at 05:57, Dar­ren Pauli

    A sin­gle group could be behind the mon­strous Cryp­towall 3.0 ran­somware, wide­ly con­sid­ered to be one of the most men­ac­ing threats to end users that has fleeced vic­tims of mil­lions of dol­lars.

    Intel Secu­ri­ty, Palo Alto Net­works, Fortinet, and Syman­tec under the Cyber Threat Alliance have probed the net scourge reveal­ing that the attack­ers are thought to be a sin­gle enti­ty. That the­o­ry’s based on com­mon­al­i­ties in the Bit­coin wal­lets they use to receive ran­som pay­ments.

    The find­ings are con­tained in the report Lucra­tive Ran­somware Attacks (PDF). The doc­u­ment details the com­plex­i­ties of the ran­somware men­ace that has forced users and busi­ness­es to pay crim­i­nals hun­dreds or thou­sands of dol­lars in indi­vid­ual ran­soms for a key that can decrypt files.

    The authors assert that “... as a result of exam­in­ing this finan­cial net­work, it was dis­cov­ered that a num­ber of pri­ma­ry wal­lets were shared between cam­paigns, fur­ther sup­port­ing the notion that all of the cam­paigns, regard­less of the cam­paign ID, are being oper­at­ed by the same enti­ty.”

    “When we exam­ined the BTC (Bit­coin) trans­ac­tion net­work stem­ming from the [ran­som Bit­coin] wal­lets to what we con­sid­ered to be final wal­lets, the finan­cial impact was sub­stan­tial.

    “A major­i­ty of these BTC address­es are used to laun­der the mon­ey into legal chan­nels or to pay for ser­vices relat­ed to the cam­paigns, such as exploit kits or bot­nets used to send spam email.”

    The group runs a well-oiled machine that the top tech team says has been “immense­ly suc­cess­ful” in fleec­ing cash. Author­i­ties said ear­li­er this year that that Cryp­toWall had squeezed US$18 mil­lion from US vic­tims alone in a lit­tle over a year.

    The encryp­tion used by the mal­ware is regard­ed as sol­id, with no known side-chan­nel attacks through which less-pro­fes­sion­al and anti­quat­ed ran­somware vari­ants could be reversed with­out requir­ing pay­ment.

    It is so pro­fes­sion­al that mul­ti­ple secu­ri­ty types and sys­tem admin­is­tra­tors have told this reporter they rec­om­mend their clients and boss­es just pay up.

    This week the FBI shocked no one in the secu­ri­ty indus­try by rec­om­mend­ing busi­ness­es just pay the crim­i­nals.

    Cryp­towall ran­som pay­ments are also high­ly devel­oped, with com­plex trans­ac­tion flows that are hard to trace and span hun­dreds of Bit­coin address­es.

    About half of vic­tims are based in the Unit­ed States, how­ev­er Aus­tralia is dis­pro­por­tion­ate­ly rep­re­sent­ed in vic­tim bases with at least 8000 infec­tions hit­ting antipodean com­put­ers in the first six months of this year.

    So-called facil­i­ta­tors help pet­ty crim­i­nals enter the game by pair­ing them with ran­somware writ­ers, illic­it web traf­fic barons, and exploit kit deliv­ery groups.

    ...

    “This week the FBI shocked no one in the secu­ri­ty indus­try by rec­om­mend­ing busi­ness­es just pay the crim­i­nals.”

    That’s the bad ran­somware news this week. But there has been some recent good news. If you’re a vic­tim the ‘Coin­Vault’ ran­somware scam and you haven’t yet paid the ran­som but would still like to decrypt your files, there’s a new free tool you should learn about:

    Secu­ri­ty Week
    Group Behind Cryp­toWall 3.0 Made $325 Mil­lion: Report

    By Eduard Kovacs on Octo­ber 30, 2015

    Researchers rep­re­sent­ing secu­ri­ty com­pa­nies that are part of the Cyber Threat Alliance have con­duct­ed an in-depth inves­ti­ga­tion into the cyber­crim­i­nal oper­a­tions lever­ag­ing Cryp­toWall 3.0 ran­somware.

    ...

    While experts haven’t found a way to decrypt files encrypt­ed by Cryp­toWall 3.0, not all ran­somware is as effi­cient when it comes to hold­ing files for ran­som. Kasper­sky announced this week that it has obtained all the decryp­tion keys, rough­ly 14,000, need­ed to recov­er files encrypt­ed by Coin­Vault and Bit­cryp­tor ran­somware.

    Kaspersky’s ini­tia­tive was launched in April in col­lab­o­ra­tion with law enforce­ment author­i­ties in the Nether­lands. Vic­tims of Coin­Vault and Bit­cryp­tor are pro­vid­ed a free tool that they can use to decrypt their files.

    The announce­ment that all Coin­Vault encryp­tion keys have been obtained comes after last month Dutch police report­ed arrest­ing two indi­vid­u­als sus­pect­ed of using this piece of ran­somware to infect com­put­ers around the world.

    “The announce­ment that all Coin­Vault encryp­tion keys have been obtained comes after last month Dutch police report­ed arrest­ing two indi­vid­u­als sus­pect­ed of using this piece of ran­somware to infect com­put­ers around the world.”
    Yep, it appears that it was just two Dutch hack­ers behind the glob­al Coin­Vault scam. Oops. But if they had­n’t, they would pre­sum­ably still be out there ran­som­ing peo­ple’s data.

    It’s all a reminder that the glob­al nature if the inter­net, while awe­some in many ways, also cre­ates a rather tempt­ing tar­get for dig­i­tal crim­i­nals since their poten­tial list of crime vic­tims now includes every­one on the plan­et with an inter­net con­nec­tion.

    It’s also a reminder to not get to ‘click-hap­py’ with your email attach­ments.

    Posted by Pterrafractyl | October 31, 2015, 6:45 pm
  16. Dig­i­tal com­mu­ni­ca­tions tech­nol­o­gy, like all tech­nol­o­gy, is a dou­ble-edged sword. But here’s a reminder that dig­i­tal com­mu­ni­ca­tion tech­nolo­gies in par­tic­u­lar is, some­what iron­i­cal­ly, a dou­ble-edged sword that soci­ety has a hard time actu­al­ly talk­ing about:

    The Los Ange­les Times

    FBI can’t fig­ure out how to unlock encrypt­ed phone in San Bernardi­no inves­ti­ga­tion

    By Bri­an Ben­nett

    Feb­ru­ary 9, 2016, 2:45 PM

    FBI tech­ni­cians have been unable to unlock encrypt­ed data on a cell­phone that belonged to the ter­ror­ist cou­ple who killed 14 peo­ple in San Bernardi­no on Dec. 2, the FBI direc­tor said Tues­day.

    The fail­ure, the sec­ond such case in recent months, has left inves­ti­ga­tors in the dark about at least some of the mar­ried cou­ple’s com­mu­ni­ca­tions before they were killed in a shootout with police.

    “We still have one of those killers’ phones that we haven’t been able to open,” FBI Direc­tor James B. Comey told the Sen­ate Intel­li­gence Com­mit­tee. “It has been two months now and we are still work­ing on it.”

    FBI inves­ti­ga­tors have strug­gled to retrace the move­ments and plans of Syed Rizwan Farook and his wife, Tash­feen Malik, before and after they attacked a hol­i­day par­ty at the Inland Region­al Cen­ter.

    The encrypt­ed data could shed light on why Farook left a bag with sev­er­al home­made pipe bombs in the con­fer­ence room, whether they con­sid­ered addi­tion­al attacks, or whether the cou­ple was in com­mu­ni­ca­tion with any­one about their plans before the attack.

    So far, the FBI has said that it has found no evi­dence indi­cat­ing the cou­ple had received any out­side direc­tion or sup­port. Farook, a coun­ty health inspec­tor, had become self-rad­i­cal­ized via the Inter­net and he and his wife pledged alle­giance to Islam­ic State on the day of the mass shoot­ing.

    Comey did not describe the phone’s mod­el or say if it belonged to Farook or Malik.

    Sev­er­al cell­phone mod­els, includ­ing Apple’s iPhone 6 and Sam­sung’s Galaxy S6, use advanced encryp­tion algo­rithms that scram­ble all the data on the device when a pin code is set.

    Encrypt­ed cell­phones and text mes­sag­ing apps have made it hard­er for inves­ti­ga­tors and intel­li­gence ser­vices to track sus­pect­ed plots in real time, or trace loca­tions and con­nec­tions once they acquire a sus­pec­t’s device, Comey said.

    In Decem­ber, Comey said that one of two gun­man who sought to attack a Muham­mad car­toon con­test in Gar­land, Texas, last May 3 had exchanged 109 elec­tron­ic mes­sages with “an over­seas ter­ror­ist” that morn­ing.

    “We have no idea what he said, because those mes­sages were encrypt­ed,” he told the Sen­ate Judi­cia­ry Com­mit­tee at the time.

    ...

    Law enforce­ment offi­cials have warned for more than a year about their inabil­i­ty to access data on encrypt­ed phones, even after a cell­phone com­pa­ny or car­ri­er is served with a war­rant.

    Com­pa­nies insist they don’t keep a sep­a­rate, “back door” key to unscram­ble the device’s mem­o­ry because that would weak­en secu­ri­ty and pri­va­cy.

    “I don’t want a back door. ... I would like peo­ple to com­ply with court orders, and that is the con­ver­sa­tion I am try­ing to have,” Comey said Tues­day.

    “I don’t want a back door. ... I would like peo­ple to com­ply with court orders, and that is the con­ver­sa­tion I am try­ing to have.”
    Keep in mind that FBI direc­tor Comey says:

    “I don’t want a back door. ... I would like peo­ple to com­ply with court orders, and that is the con­ver­sa­tion I am try­ing to have,”

    it’s basi­cal­ly a non­sense state­ment since the abil­i­ty of com­pa­nies to com­ply with those court orders would require the com­pa­nies them­selves to have a ‘back door’, which clear­ly isn’t the case when deal­ing with the types of phones used by the San Bernadi­no ter­ror­ists. But also keep in mind that Comey is using the same argu­ment fre­quent­ly used by pri­va­cy activists in defense of strong encryp­tion with­out ‘back doors’ who pro­claim that author­i­ties should just get a war­rant. It’s a reminder that there’s a LONG way to go before soci­ety arrives at some sort of con­sen­sus, even a tem­po­rary con­sen­sus, regard­ing the prop­er bal­ance to strike with these types of tech­nolo­gies since the debate being fed to the pub­lic at large on all sides is still large­ly inco­her­ent.

    With that in mind, here’s an arti­cle about a recent Har­vard study that found that law enforce­men­t’s claims that strong encryp­tion is hin­der­ing their inves­ti­ga­tions are wild­ly overblown. While that might sound like the kind of find­ings that would please pri­va­cy activist, they prob­a­bly won’t be super enthu­si­as­tic about the rest of the study’s find­ings:

    CNet
    Law enforce­men­t’s encryp­tion claims overblown, study finds

    The surge in Inter­net-con­nect­ed devices will offer ample new sur­veil­lance oppor­tu­ni­ties, accord­ing to a Har­vard study.

    Feb­ru­ary 1, 2016 5:00 PM PST

    by Steven Musil

    Encryp­tion may not pro­tect crim­i­nals as much as we have been led to believe.

    The FBI and oth­er law enforce­ment author­i­ties are exag­ger­at­ing the extent that crim­i­nals are using encryp­tion to avoid sur­veil­lance, or “go dark,” accord­ing to a study released Mon­day by Har­vard. The study, which includ­ed par­tic­i­pa­tion from cur­rent and for­mer intel­li­gence offi­cials, found that myr­i­ad new Inter­net-con­nect­ed tech­nolo­gies such as smart-home prod­ucts allow new oppor­tu­ni­ties for sur­veil­lance activ­i­ties.

    “The ‘going dark’ metaphor does not ful­ly describe the future of the gov­ern­men­t’s capac­i­ty to access the com­mu­ni­ca­tions of sus­pect­ed ter­ror­ists and crim­i­nals,” said the study (PDF), pub­lished by the Berk­man Cen­ter for Inter­net and Soci­ety at Har­vard.

    The report con­ced­ed that the increased avail­abil­i­ty of encryp­tion prod­ucts impedes gov­ern­ment sur­veil­lance under cer­tain cir­cum­stances. But it also con­clud­ed that the bur­geon­ing mar­ket for Inter­net-con­nect­ed devices will “like­ly fill some of these gaps and...ensure that the gov­ern­ment will gain new oppor­tu­ni­ties to gath­er crit­i­cal infor­ma­tion from sur­veil­lance.”

    The study’s find­ings come amid a mount­ing war of words between tech com­pa­nies and pol­i­cy mak­ers, who con­tend that ter­ror­ist groups are ben­e­fit­ing from encryp­tion, the tech­nol­o­gy that jum­bles com­mu­ni­ca­tions and files so that only the intend­ed recip­i­ent can read them. Tech com­pa­nies have become increas­ing­ly dili­gent about includ­ing encryp­tion in prod­ucts and ser­vices in the wake of rev­e­la­tions about US gov­ern­ment sur­veil­lance pro­grams from doc­u­ments leaked by for­mer NSA con­trac­tor Edward Snow­den.

    Apple’s iMes­sage text mes­sage pro­gram uses encryp­tion, as does Face­book’s What­sApp. Google, Yahoo and a bunch of oth­er tech com­pa­nies have begun scram­bling infor­ma­tion sent between their servers. These secu­ri­ty fea­tures, which aim to keep pry­ing eyes from see­ing what’s going on inside, are often now turned on by default and easy to use.

    After dead­ly attacks in Paris late last year, ques­tions arose about whether the tech­nol­o­gy indus­try has a duty to help the gov­ern­ment view encrypt­ed con­ver­sa­tions in the name of stop­ping ter­ror­ism. Tech com­pa­nies have coun­tered that it’s impos­si­ble to let gov­ern­ment agen­cies break encryp­tion with­out let­ting crim­i­nals do the same.

    The Har­vard study pre­dict­ed that a host of Inter­net-con­nect­ed devices, includ­ing TVs, cars, cam­eras, ther­mostats and even toast­ers, come packed with sen­sors and wire­less con­nec­tiv­i­ty that offer new oppor­tu­ni­ties for track­ing sus­pects.

    “Law enforce­ment or intel­li­gence agen­cies may start to seek orders com­pelling Sam­sung, Google, Mat­tel, Nest or ven­dors of oth­er net­worked devices to push an update or flip a dig­i­tal switch to inter­cept the ambi­ent com­mu­ni­ca­tions of a tar­get,” the study said. “These are real prod­ucts now.”

    The pletho­ra of Inter­net-con­nect­ed devis­es also rais­es dif­fi­cult ques­tions about con­sumer pri­va­cy that need to be addressed, the study sug­gest­ed.

    “We should be think­ing now about the respon­si­bil­i­ties of com­pa­nies build­ing new tech­nolo­gies, about new oper­a­tional pro­ce­dures and rules to help the law enforce­ment and intel­li­gence com­mu­ni­ties nav­i­gate the thick­et of issues that will sure­ly accom­pa­ny these trends,” the study con­clud­ed.

    ...

    “The report con­ced­ed that the increased avail­abil­i­ty of encryp­tion prod­ucts impedes gov­ern­ment sur­veil­lance under cer­tain cir­cum­stances. But it also con­clud­ed that the bur­geon­ing mar­ket for Inter­net-con­nect­ed devices will “like­ly fill some of these gaps and...ensure that the gov­ern­ment will gain new oppor­tu­ni­ties to gath­er crit­i­cal infor­ma­tion from sur­veil­lance.”
    That’s right, accord­ing to the study, the Inter­net of Things is going to fill our world with so many net­worked devices filled with all sorts of sen­sors that we basi­cal­ly don’t need to wor­ry about strong encryp­tion block­ing inves­ti­ga­tions because there’s going to be so many sur­veil­lance alter­na­tives that could also be used to spy on us beyond our per­son­al com­put­ers and smart­phones. Law enforce­ment is sim­ply going to start turn­ing the Inter­net of Things into a new spy net­work:

    ...

    The Har­vard study pre­dict­ed that a host of Inter­net-con­nect­ed devices, includ­ing TVs, cars, cam­eras, ther­mostats and even toast­ers, come packed with sen­sors and wire­less con­nec­tiv­i­ty that offer new oppor­tu­ni­ties for track­ing sus­pects.
    “Law enforce­ment or intel­li­gence agen­cies may start to seek orders com­pelling Sam­sung, Google, Mat­tel, Nest or ven­dors of oth­er net­worked devices to push an update or flip a dig­i­tal switch to inter­cept the ambi­ent com­mu­ni­ca­tions of a tar­get,” the study said. “These are real prod­ucts now.”

    ...

    Now, it’s unclear if being able to turn inter­net con­nect­ed refrig­er­a­tors into a wifi spy­ing devices would be of any help at all in the San Bernadi­no inves­ti­ga­tion. But it does high­light one of the dis­turb­ing aspects of the dig­i­tal future: con­cerns over your per­son­al dig­i­tal pri­va­cy are going to be a lot hard­er to ade­quate­ly address when we’re all immersed in a sea of poten­tial spy devices. And if law enforce­ment can use this grow­ing infra­struc­ture, you can bet the per­son­al data col­lec­tion indus­tries are going to be using those capa­bil­i­ties too.

    So the over­all mes­sage of the study appears to be “strong encrypt with­out back doors all you want, you’re still going to be high­ly sur­veil­l­able because there’s no pos­si­ble way all these new devices are also going to strong­ly encrypt­ed and unhack­able too.” And that’s prob­a­bly going to be the case for a large num­ber of inter­net con­nect­ed devices unless con­sumers are will­ing to pay extra to buy the hack-proof, strong­ly encrypt­ed inter­net con­nect­ed toast­er.

    Still, that’s just the sta­tus of things today. As homes become “smart homes” and all our devices start get­ting hooked up togeth­er in one big net­work, your hack­able toast­er could end up being a gate­way into the rest of your devices and be an avenue for seri­ous dam­age (imag­ine devices that could be hacked to over­heat and start a fire or some­thing). So who knows, fol­low­ing a few Inter­net of Things mega-hacks that cause wide­spread phys­i­cal dam­age, turn­ing inter­net con­nect­ed devices into untam­per­a­ble and unhack­able black box­es might be stan­dard oper­at­ing pro­ce­dure. And giv­en the way tech­nol­o­gy seems to devel­op, super-dam­ag­ing Inter­net of Things mega-hacks seem like one of those events that’s basi­cal­ly an inevitabil­i­ty and prob­a­bly a future New Nor­mal.

    So enjoy the tem­po­rary qua­si-moot­ness of the debates over strong encryp­tion and ‘back doors’ while we enjoy the explo­sion of the Inter­net of Things. Let’s just hope that process involves most­ly just spy­ing and does­n’t include too many actu­al explo­sions.

    Posted by Pterrafractyl | February 10, 2016, 4:12 pm
  17. Rem­i­nis­cent of Uber’s pre­vi­ous attempt to remote­ly encrypt cor­po­rate data before Cana­di­an inves­ti­ga­tors to seize it, Uber just gave us anoth­er exam­ple of how encryp­tion is going to help the com­pa­nies that behave like Uber unfor­tu­nate­ly con­tin­ue behav­ing like Uber.

    How so? Well, in this case, Uber hired a pri­vate intel­li­gence firm, Ergo, to inves­ti­gate Andrew Schmidt, a labor lawyer suing them for anti-trust vio­la­tions. And, as Uber is prone to do, the inves­ti­ga­tion was so over-the-top and bor­der­ing on fraud that a judge ruled that Uber has to turn over its com­mu­ni­ca­tion with Ergo to the plain­tiffs.

    But here’s the catch: those com­mu­ni­ca­tions almost all took place via Wickr, an encrypt­ed chat app that auto-deletes mes­sages after a set peri­od. So now there’s no way to estab­lish whether or not Uber approved of Ergo’s ille­gal tac­tics. Oh well:

    The Verge

    How Uber secret­ly inves­ti­gat­ed its legal foes — and got caught

    Faced with a class action suit, the com­pa­ny hired a CIA-linked intel­li­gence firm to look into the plain­tiffs and their lawyer, but a judge says they may have gone too far

    By Rus­sell Bran­dom and Andrew Hawkins on July 10, 2016 05:00 pm

    When a young labor lawyer named Andrew Schmidt first filed suit against Uber in Decem­ber of last year, he couldn’t have pre­dict­ed it would make him a tar­get. Schmidt’s suit was a legal long shot, alleg­ing that Uber CEO Travis Kalan­ick coor­di­nat­ed surge pric­ing in vio­la­tion of anti-trust laws — but those legal argu­ments would soon be over­shad­owed by some­thing much stranger.

    A few weeks after the case was filed, Schmidt found out he was being inves­ti­gat­ed. Accord­ing to a court dec­la­ra­tion made by Schmidt and his col­leagues, some­one had called one of Schmidt’s lawyer friends in Col­orado to ask some strange ques­tions, claim­ing it was for a project “pro­fil­ing up-and-com­ing labor lawyers in the US.” What was the nature of his rela­tion­ship with the plain­tiff? Who was the dri­ving force behind the law­suit? Calls were also alleged­ly made to acquain­tances of Schmidt’s client, Spencer Mey­er, with a sim­i­lar pro­pos­al to pro­file “up-and-com­ing researchers in envi­ron­men­tal con­ser­va­tion.”

    Schmidt reached out to Kalanick’s lawyers, but they said Uber wasn’t involved, writ­ing back, “Who­ev­er is behind these calls, it is not us.”

    A month lat­er, those same lawyers called back to admit that wasn’t strict­ly true. Schmidt and his client were being inves­ti­gat­ed by a secre­tive research firm, staffed by vet­er­ans from the CIA and the Nation­al Secu­ri­ty Coun­cil, on behalf of Uber’s top exec­u­tives. As soon as the law­suit was filed, those exec­u­tives took an inter­est in Schmidt and his client, send­ing out oper­a­tives to dig up what they could find on Uber’s new antag­o­nists.

    That inves­ti­ga­tion has turned into a legal dis­as­ter for Uber, and the pre­sid­ing judge has already ruled the evi­dence con­sti­tutes “a rea­son­able basis to sus­pect the per­pe­tra­tion of fraud.” The result is a rare win­dow into how one of the most pow­er­ful and liti­gious com­pa­nies in the world responds to a major class action law­suit. As Uber con­tin­ues to attract new law­suits and accu­sa­tions, the inves­ti­ga­tion into Schmidt and his col­leagues shows just how far the com­pa­ny will go to defend its posi­tion, both inside and out­side the court­room.

    Accord­ing to inter­nal Uber emails, the inves­ti­ga­tion began with a note from Uber’s gen­er­al coun­sel, Sal­lie Yoo. The day that Schmidt filed the com­plaint against Kalan­ick, Yoo sent an email to Uber’s chief secu­ri­ty offi­cer, say­ing, “Could we find out a lit­tle more about this plain­tiff?” The request was for­ward­ed to the company’s head of Glob­al Threat Intel­li­gence, Math­ew Hen­ley.

    By the end of the week, Hen­ley was on the phone with a cor­po­rate research firm called Ergo, also known as Glob­al Pre­ci­sion Research LLC, ask­ing for help with “a sen­si­tive, very under-the-radar inves­ti­ga­tion.” After a few emails, Hen­ley worked out the terms of the deal with an Ergo exec­u­tive named Todd Ege­land. It would be a “lev­el two” inves­ti­ga­tion, the mid­dle of the three lev­els of work offered by Ergo. It would be drawn from sev­en source inter­views con­duct­ed over the course of 10 days, for which Uber would pay $19,500. As with any Ergo inves­ti­ga­tion, the con­fi­den­tial­i­ty of the client was para­mount, and sources were nev­er meant to know who was pay­ing for the research. “We do quite a bit of this work for law firms,” Ege­land reas­sured him. (Ergo did not respond to requests for com­ment.)

    There was one oth­er wrin­kle, expand­ing the scope beyond Schmidt’s client to Schmidt him­self. “I sug­gest that you may also wish for some details on the plaintiff’s rela­tion­ship with the lawyer,” Ege­land wrote to Hen­ley in one email. “They out­ward­ly appear to be at least col­lege, if not life-long, friends.”

    Hen­ley approved the deal, writ­ing back, “All looks good guys, thanks.”

    From there, the facts of the inves­ti­ga­tion become less clear. Accord­ing to Schmidt and his team, Ergo con­tact­ed 28 dif­fer­ent friends or co-work­ers of the plain­tiff, each time claim­ing to be look­ing for infor­ma­tion on “up-and-com­ing researchers in envi­ron­men­tal con­ser­va­tion” or some­thing sim­i­lar­ly vague. The plain­tiffs say those claims were false, and could be grounds for fraud.

    Uber was tread­ing on dan­ger­ous ground by even com­mis­sion­ing the inves­ti­ga­tion, some experts say. “This is a very unusu­al sit­u­a­tion and one that rais­es real risks,” says Michael Volkov of the Volkov Law Group, who has writ­ten exten­sive­ly on third-par­ty due dili­gence. “Going around and con­duct­ing inter­views of peo­ple asso­ci­at­ed with the case, who may become wit­ness­es, is real­ly unseem­ly.”

    It’s not uncom­mon for firms to do basic back­ground research on a plain­tiff or oppos­ing coun­sel. Face­book engaged in a sim­i­lar inves­ti­ga­tion with a firm called Kroll a 2011 case con­test­ing Zucker­berg’s own­er­ship of the com­pa­ny, although no impro­pri­ety by the inves­ti­ga­tors was ever alleged. But that research is typ­i­cal­ly con­duct­ed through online search­es and pub­lic records requests, and any­thing involv­ing direct con­tact with pos­si­ble par­ties to the case is seen as far more del­i­cate. “Com­mis­sion­ing the inves­ti­ga­tion with­out mean­ing­ful guid­ance on how it is con­duct­ed shows either naivete or that they just did not care about com­ply­ing with appro­pri­ate restric­tions on such inves­ti­ga­tions,” Volkov says.

    The judge hear­ing Uber’s case appears to have agreed. On June 7th, Judge Rakoff ruled that Schmidt and his col­leagues had shown enough evi­dence to pro­vide a rea­son­able per­cep­tion of fraud, giv­ing plain­tiffs the right to exam­ine emails and oth­er doc­u­ments exchanged between Uber and Ergo. Accord­ing to the rul­ing, Ergo’s inves­ti­ga­tion was “rais­ing a seri­ous risk of per­vert­ing the process of jus­tice before this court.” With that rul­ing, what began as an antitrust case has become a par­al­lel case about exact­ly how far Ergo went, and how much Uber knew about it.

    The impli­ca­tions go far beyond a sin­gle case. Uber is cur­rent­ly lit­i­gat­ing 70 dif­fer­ent fed­er­al law­suits, which range from accu­sa­tions of wage theft to fun­da­men­tal ques­tions of work­er clas­si­fi­ca­tion. Any one of those cas­es could be a tempt­ing tar­get for third-par­ty research firms like Ergo. Accord­ing to a sworn depo­si­tion from an Ergo employ­ee, this was the fourth time Uber hired the com­pa­ny for research, although it’s unclear whether the oth­er cas­es involved an active tri­al. Giv­en the vol­ume of cas­es against Uber and the rou­tine way in which the inves­ti­ga­tion was assigned, it’s plau­si­ble the com­pa­ny was con­tract­ing with oth­er research firms.

    It’s not the first time Uber has shown an appetite for research­ing the company’s crit­ics. In a pri­vate din­ner in 2014, Uber exec­u­tive Emil Michael out­lined a plan to spend a mil­lion dol­lars col­lect­ing oppo­si­tion research on jour­nal­ists who cov­er Uber unfa­vor­ably, sug­gest­ing the com­pa­ny could inves­ti­gate “your per­son­al lives, your fam­i­lies.” Uber’s CEO lat­er con­demned the com­ments, and there’s no indi­ca­tion such a pro­gram was ever put into place.

    Found­ed in 2006, Ergo pro­vides data analy­sis and busi­ness con­sult­ing for a range of pri­vate clients, accord­ing to its web­site, but its main goal is the deliv­ery of “ground truth and action­able intel­li­gence obtain­able only from front­line sources.” It boasts of work­ing on 800 projects in 120 coun­tries, from search­ing for fraud in Iraqi ship­ping deals to advis­ing on Ugan­dan oil con­tracts. It is head­quar­tered in New York City, but has offices in Phoenix, Ari­zona and Yan­gon, Myan­mar.

    The com­pa­ny’s founder, Ran­dolph Post “R.P.” Eddy, has a long his­to­ry of work in both coun­tert­er­ror­ism and diplo­ma­cy. He served as direc­tor of coun­tert­er­ror­ism at the White House Nation­al Secu­ri­ty Coun­cil dur­ing the Clin­ton admin­is­tra­tion, chief of staff to US Ambas­sador to the Unit­ed Nations Richard Hol­brooke, and senior pol­i­cy offi­cer for UN Sec­re­tary-Gen­er­al Kofi Annan. Eddy helped found the New York Police Department’s coun­tert­er­ror­ism cen­ter, serves on numer­ous boards and think tanks, and has appeared fre­quent­ly on nation­al tele­vi­sion in his capac­i­ty as an expert on ter­ror­ism. Ege­land, the firm’s man­ag­ing direc­tor, tes­ti­fied that pri­or to work­ing at Ergo, he served at the Cen­tral Intel­li­gence Agency for 28 years.

    Uber com­mu­ni­cat­ed with Ergo large­ly over encrypt­ed chan­nels. Hen­ley explained in one email that this was nec­es­sary to “avoid poten­tial dis­cov­ery issues.” (A sub­se­quent Uber fil­ing char­ac­ter­izes the rea­son­ing dif­fer­ent­ly, say­ing encryp­tion was nec­es­sary “to pro­tect against data breach­es of Ergo’s mail servers.”) Ini­tial emails were encrypt­ed with PGP — specif­i­cal­ly the Enig­mail exten­sion — but after a num­ber of emails failed to decrypt, Hen­ley sug­gest­ed mov­ing the con­ver­sa­tion to the encrypt­ed chat app Wickr, say­ing, “Nothing’s worse than the 30 years of attempt­ed PGP mail client inte­gra­tions.”

    Wickr auto­mat­i­cal­ly deletes mes­sages after a pre­set peri­od of time (typ­i­cal­ly 72 hours), and Uber exec­u­tives have tes­ti­fied that it is a com­mon tool for inter­nal com­mu­ni­ca­tions. After Henley’s sug­ges­tion, PGP emails dropped off entire­ly, except to trans­mit some pre­ferred legal lan­guage three days lat­er and sub­mit­ting the final report 12 days after that.

    Pre­sent­ed with a court-man­dat­ed dis­cov­ery order, Uber pro­vid­ed decrypt­ed ver­sions of the PGP emails, but the Wickr con­ver­sa­tions have proven to be more of a chal­lenge. Although email records show Hen­ley exchang­ing Wickr screen names with Ergo exec­u­tives, Hen­ley denied direct­ly com­mu­ni­cat­ing over the ser­vice in a sworn depo­si­tion. Giv­en Wickr’s auto­mat­ic dele­tion sys­tem, that claim is impos­si­ble to dis­prove.

    Uber says it ini­tial­ly reached out to Ergo to assess whether Mey­er, the plain­tiff, posed a direct threat to Kalan­ick. Joe Sul­li­van, Uber’s chief of secu­ri­ty, tes­ti­fied that because Spencer Meyer’s antitrust suit specif­i­cal­ly named Kalan­ick as the defen­dant, as opposed to the $62.5 bil­lion com­pa­ny he runs, it was pru­dent to look into Meyer’s back­ground to see if he “had it in for our CEO.”

    “I’m always on the look­out when sit­u­a­tions arise that could be a cause for con­cern,” Sul­li­van said. “And I’m always care­ful to make sure that we do our dili­gence in those sit­u­a­tions.”

    Sul­li­van also not­ed it was “an unusu­al sit­u­a­tion” for Kalan­ick to be named specif­i­cal­ly in the suit. How­ev­er, Uber pas­sen­gers are sub­ject to user agree­ments that require them to resolve dis­putes through arbi­tra­tion, and suing Kalan­ick may have been a way around that clause. Telling­ly, Uber filed court doc­u­ments July 8th that would com­pel Mey­er to set­tle his case through arbi­tra­tion.

    Despite Sullivan’s con­cerns, inter­nal Ergo emails show more of an inter­est in rep­u­ta­tion­al dam­age than phys­i­cal threat. In one of the first avail­able emails sent while com­pil­ing the report, a super­vi­sor asks, “Do we have enough neg­a­tive things said about Mey­er [the plain­tiff] to write a text box?” When those facts proved hard to come by, the pri­ma­ry inves­ti­ga­tor, Miguel San­tos-Neves, even­tu­al­ly replied, “One did say that he was enam­ored with ideas and may be unfa­mil­iar with the real­i­ties and demands of the real world.” The super­vi­sor replied, “Per­fect.”

    The final report notes that Mey­er “may be par­tic­u­lar­ly sen­si­tive to any actions that tar­nish his pro­fes­sion­al rep­u­ta­tion.” Nei­ther the report nor any of the avail­able com­mu­ni­ca­tions between Ergo and Uber make any ref­er­ence to Mey­er as a pos­si­ble secu­ri­ty threat to Kalan­ick.

    On March 22nd, as Schmidt and his col­leagues were demand­ing answers on the scope of the inves­ti­ga­tion, Ergo arranged a pri­vate meet­ing with Uber’s glob­al threat team. In the meet­ing, Ergo acknowl­edged that the inves­ti­ga­tion had gone beyond the appro­pri­ate scope, blam­ing the over­reach on “an employ­ee who had gone rogue” — appar­ent­ly a ref­er­ence to San­tos-Neves.

    How­ev­er, San­tos-Neves tes­ti­fied that his super­vi­sors nev­er rep­ri­mand­ed him, nor gave any indi­ca­tion that his tac­tic of mis­rep­re­sent­ing him­self in inter­views with Meyer’s acquain­tances vio­lat­ed Ergo’s pro­to­cols. In fact, he implied that it was nec­es­sary in order to shield Uber’s involve­ment. “The con­fi­den­tial­i­ty of our clients is of utmost impor­tance,” San­tos-Neves tes­ti­fied. “One of the ways that we main­tain that con­fi­den­tial­i­ty is by, as I said ear­li­er, craft­ing ques­tions that can, you know, main­tain that con­fi­den­tial­i­ty.” He added, “We can be sort of vague about our inten­tions.”

    In a fil­ing last night, Uber pushed back against the alle­ga­tions of fraud, argu­ing its con­tract with Ergo had spec­i­fied that the inves­ti­ga­tion be both law­ful and pro­fes­sion­al, and nei­ther Kalan­ick nor Uber had any idea an inves­ti­ga­tor might stray beyond that. “Uber took rea­son­able steps to ensure that Ergo com­plied with the law,” the fil­ing reads. “It is undis­put­ed that Uber and Mr. Kalan­ick were unaware that Ergo would use mis­rep­re­sen­ta­tions dur­ing its inves­ti­ga­tion.”

    ...

    “The impli­ca­tions go far beyond a sin­gle case. Uber is cur­rent­ly lit­i­gat­ing 70 dif­fer­ent fed­er­al law­suits, which range from accu­sa­tions of wage theft to fun­da­men­tal ques­tions of work­er clas­si­fi­ca­tion. Any one of those cas­es could be a tempt­ing tar­get for third-par­ty research firms like Ergo. Accord­ing to a sworn depo­si­tion from an Ergo employ­ee, this was the fourth time Uber hired the com­pa­ny for research, although it’s unclear whether the oth­er cas­es involved an active tri­al. Giv­en the vol­ume of cas­es against Uber and the rou­tine way in which the inves­ti­ga­tion was assigned, it’s plau­si­ble the com­pa­ny was con­tract­ing with oth­er research firms.”

    Yeah, we prob­a­bly should­n’t be super shock­ing if it turns out that Uber’s been hir­ing Ergo to fraud­u­lent dig up dirt on Uber’s many plain­tiffs. Of course, giv­en the appar­ent secre­cy that’s involved in Uber’s com­mu­ni­ca­tions with Ergo, we also should­n’t be super shocked if we nev­er find out about the tar­gets of those oth­er inves­ti­ga­tions or at least the con­tent of what they inves­ti­gat­ed. Thanks to fun encrypt­ed chat apps like Wickr that allowed Uber and Ergo to “avoid poten­tial dis­cov­ery issues”:

    ...

    Uber com­mu­ni­cat­ed with Ergo large­ly over encrypt­ed chan­nels. Hen­ley explained in one email that this was nec­es­sary to “avoid poten­tial dis­cov­ery issues.” (A sub­se­quent Uber fil­ing char­ac­ter­izes the rea­son­ing dif­fer­ent­ly, say­ing encryp­tion was nec­es­sary “to pro­tect against data breach­es of Ergo’s mail servers.”) Ini­tial emails were encrypt­ed with PGP — specif­i­cal­ly the Enig­mail exten­sion — but after a num­ber of emails failed to decrypt, Hen­ley sug­gest­ed mov­ing the con­ver­sa­tion to the encrypt­ed chat app Wickr, say­ing, “Nothing’s worse than the 30 years of attempt­ed PGP mail client inte­gra­tions.”

    Wickr auto­mat­i­cal­ly deletes mes­sages after a pre­set peri­od of time (typ­i­cal­ly 72 hours), and Uber exec­u­tives have tes­ti­fied that it is a com­mon tool for inter­nal com­mu­ni­ca­tions. After Henley’s sug­ges­tion, PGP emails dropped off entire­ly, except to trans­mit some pre­ferred legal lan­guage three days lat­er and sub­mit­ting the final report 12 days after that.

    Pre­sent­ed with a court-man­dat­ed dis­cov­ery order, Uber pro­vid­ed decrypt­ed ver­sions of the PGP emails, but the Wickr con­ver­sa­tions have proven to be more of a chal­lenge. Although email records show Hen­ley exchang­ing Wickr screen names with Ergo exec­u­tives, Hen­ley denied direct­ly com­mu­ni­cat­ing over the ser­vice in a sworn depo­si­tion. Giv­en Wickr’s auto­mat­ic dele­tion sys­tem, that claim is impos­si­ble to dis­prove.
    ...

    “Pre­sent­ed with a court-man­dat­ed dis­cov­ery order, Uber pro­vid­ed decrypt­ed ver­sions of the PGP emails, but the Wickr con­ver­sa­tions have proven to be more of a chal­lenge. Although email records show Hen­ley exchang­ing Wickr screen names with Ergo exec­u­tives, Hen­ley denied direct­ly com­mu­ni­cat­ing over the ser­vice in a sworn depo­si­tion. Giv­en Wickr’s auto­mat­ic dele­tion sys­tem, that claim is impos­si­ble to dis­prove.

    Self-delet­ing encrypt­ed mes­sag­ing ser­vices for cor­po­rate com­mu­ni­ca­tions. That sure is con­ven­tient! And almost cer­tain­ly the future. At least the future of cor­po­rate com­mu­ni­ca­tions involv­ing con­tent that could raise “poten­tial dis­cov­ery issues”.

    We’ll see if Uber can use encryp­tion to dodge anoth­er legal bul­let. Either way, it seems like a giv­en that cor­po­rate inves­ti­ga­tions are going to be less and less fea­si­ble as cor­po­ra­tions learn more about all the great legal fea­tures that come with sys­tems like Wickr and make a habit of using them.

    But at least now we know that if you file a law­suit against Uber, you prob­a­bly want to have a chat with your friends and col­leagues about what they should say when they sud­den­ly get ran­dom inquiries about you ‘for a project pro­fil­ing up-and-com­ing lawyers in the US’. Hav­ing your friends and col­leagues inform the mys­tery caller about the judge’s find­ings in this cur­rent case against Uber and the legal impli­ca­tions of fraud­u­lent­ly inves­ti­gat­ing a plain­tiff is one pos­si­ble approach. There are oth­ers...

    Posted by Pterrafractyl | July 14, 2016, 8:29 pm
  18. Here’s a new tech­no­log­i­cal twist to the 5th Amend­ment conun­drums raised by ubiq­ui­tous unbreak­able encryp­tion tech­nol­o­gy on ubiq­ui­tous per­son­al infor­ma­tion gath­er­ing devices (smart­phones): a fed­er­al judge report­ed­ly issued a secret order to a defend­ent accused of pros­ti­tut­ing under­age girls against their will to unlock his iPhone using his fin­ger­print. While the Supreme Court has yet to clar­i­fy the 5th amend­ment issues asso­ci­at­ed with order­ing defen­dants to unlock devices using some sort of bio­met­ric method, that’s still assumed to be more like­ly to be con­sti­tu­tion­al than order­ing some­one to give their pass­code (the “strong box with a key” vs “wall safe with a com­bi­na­tion lock” legal sce­nar­ios). So this order may or may not be con­sti­tu­tion­al. A Super Court rul­ing is going to be required to set­tle the issue.

    But in this case, order­ing the defen­dant to use his fin­ger­print to unlock the phone did­n’t end up unlock­ing the phone. Why? Because iPhones set up to use fin­ger­print scans instead of a pass­word auto­mat­i­cal­ly require a pass­word if the phone had­n’t been unlocked for at least 48 hours. At that point, the phone effec­tive­ly has a “strong box” and much more con­sti­tu­tion­al­ly pro­tect­ed “wall safe” pro­tect­ing its con­tents.

    So while these secret court orders to use fin­ger­prints to unlock a smart­phone phone are rel­a­tive­ly rare at this point, we prob­a­bly should­n’t be sur­prised if there’s a flur­ry of sim­i­lar new court orders now that it’s clear that the “strong boxed” smart­phones just might gain a “wall safe” in 48 hours or less:

    Ars Tech­ni­ca

    Apple’s Touch ID blocks feds—armed with warrant—from unlock­ing iPhone
    Supreme Court has not ruled about com­pelled unlock­ing of fin­ger­print-locked devices.

    David Kravets — 7/24/2016, 11:00 AM

    A Dal­las, Texas man accused of pros­ti­tut­ing under­age girls was secret­ly ordered by a fed­er­al judge to unlock his iPhone using his fin­ger­print, accord­ing to fed­er­al court doc­u­ments that are now unsealed.

    It’s rare that we see a case demand­ing that a phone be unlocked in that man­ner, but we should expect more as the main­stream pub­lic begins embrac­ing fin­ger­print tech­nol­o­gy. Ever since 2013, when Apple pop­u­lar­ized this form of unlock­ing tech­nol­o­gy, legal experts have pre­dict­ed that these types of gov­ern­ment demands would slow­ly become more com­mon. Experts also warned these demands are prob­a­bly not a breach of the Fifth Amend­ment right against com­pelled self-incrim­i­na­tion.

    As an aside, some courts don’t nec­es­sar­i­ly think that com­pelling a sus­pect to reveal their com­put­er pass­code is a con­sti­tu­tion­al vio­la­tion. A Philadel­phia man accused of pos­sess­ing child pornog­ra­phy has been behind bars on a con­tempt charge for more than sev­en months for refus­ing to divulge his pass­word.. The man’s attor­ney claims it’s a con­sti­tu­tion­al vio­la­tion to com­pel his client to assist the author­i­ties with their pros­e­cu­tion. A fed­er­al appeals court has ten­ta­tive­ly agreed to hear the case in Sep­tem­ber as the sus­pect (who has not been charged with a crime) remains in prison.

    The Dal­las fin­ger­print­ing issue involv­ing Mar­tavi­ous Banks Keys was first unearthed by Forbes. The Keys pros­e­cu­tion paints a pic­ture of greed and cru­el­ty, but it also high­lights how far the author­i­ties are will­ing to go to obtain encrypt­ed mate­r­i­al on locked mobile phones.

    Even so, the gov­ern­men­t’s efforts in this instance were not suc­cess­ful, accord­ing to court doc­u­ments. The author­i­ties were unable to access the phone’s con­tents. The rea­son is most like­ly because, if a iPhone that has been fin­ger­print enabled has not been used for at least 48 hours, both the pass­word and fin­ger­print are required to unlock it.

    “Unable to obtain foren­sic aqui­si­tion (sic) of the described device,” a fed­er­al agent wrote in a search war­rant return that was recent­ly unsealed.

    Here’s Mag­is­trate Judge Irma Ramirez’s now-unsealed order demand­ing the defen­dan­t’s coop­er­a­tion: “It is fur­ther ordered that Mar­tavi­ous Banks Keys shall coop­er­ate with the Agent select­ed by the gov­ern­ment in pro­vid­ing his fin­ger­prints to aid in unlock­ing his Apple iPhone Mod­el 5S, cur­rent­ly in the cus­tody of the gov­ern­ment.” The order was issued on May 26.

    Because the lit­i­ga­tion over the defen­dan­t’s iPhone had been shroud­ed in secre­cy, it is unclear whether the gov­ern­ment has accessed the phone’s con­tents via anoth­er method. What’s more, it is not known whether the author­i­ties have sought to com­pel the defen­dant to unlock his phone with his pass­code in addi­tion to his fin­ger­print. Keys remains behind bars, so he is unlike­ly to care if a judge holds him in con­tempt.

    Keys’ attor­ney is John Nichol­son, a fed­er­al pub­lic defend­er in Dal­las. Nichol­son did not imme­di­ate­ly respond for com­ment. Fed­er­al pros­e­cu­tor Cara Foos Pierce also did not imme­di­ate­ly respond for com­ment.

    The law on the top­ic is unset­tled. Only a smat­ter­ing of legal rul­ings have involved some­body being com­pelled to use their fin­ger­prints or dis­close a pass­word. The Supreme Court has yet to rule on either of the hot-but­ton top­ics.

    Many legal schol­ars, how­ev­er, assert that forc­ing some­body to turn over a pass­code is a con­sti­tu­tion­al vio­la­tion because it requires some­body to use their men­tal state against them. But many schol­ars think dif­fer­ent­ly when it comes to fin­ger­prints.

    “But if we move toward authen­ti­ca­tion sys­tems based sole­ly on phys­i­cal tokens or biometrics—things we have or things we are, rather than things we remember—the gov­ern­ment could demand that we pro­duce them with­out impli­cat­ing any­thing we know. Which would make it less like­ly that a valid priv­i­lege against self-incrim­i­na­tion would apply,” Mar­cia Hoff­man, a well-respect­ed pri­va­cy attor­ney, wrote in 2013.

    ...

    “Even so, the gov­ern­men­t’s efforts in this instance were not suc­cess­ful, accord­ing to court doc­u­ments. The author­i­ties were unable to access the phone’s con­tents. The rea­son is most like­ly because, if a iPhone that has been fin­ger­print enabled has not been used for at least 48 hours, both the pass­word and fin­ger­print are required to unlock it.”

    Part of what makes this tech­nol­o­gy that adds “wall safe” pass­word only after an user-set peri­od of time has passed is that it cre­ates a sit­u­a­tion where author­i­ties could rea­son­able won­der, at the moment of arrest, just how much time is left before the 48 hours expires and the phone gets extra con­sti­tu­tion­al pro­tec­tion. Is there 48 hours left before the pass­code require­ment kicks in or 48 sec­onds? Unless you just saw the sus­pect talk­ing on the phone that’s an open ques­tion. So with cas­es like this tak­ing place while the “strong­box vs wall­safe” 5th Amend­ment issue is still head­ing towards the Supreme Court, it will be inter­est­ing to see if this “wall safe on a timer” tech­nol­o­gy ends up mak­ing it con­sti­tu­tion­al­ly eas­i­er for author­i­ties to demand that sus­pects with fin­ger­print-pro­tect­ed iPhones imme­di­ate­ly unlock their phones before the pass­code require­ment gets acti­vat­ed. That would be a bit iron­ic.

    Posted by Pterrafractyl | August 4, 2016, 9:33 pm

Post a comment