Brindle

When will schools tire of involving law enforcement in routine disciplinary matters? Not soon enough, apparently.

Hunter Osborn, a senior at Red Mountain High School in Mesa, AZ, did a "teen" thing. Prompted by other teens who enjoy a good bit of teen lowbrow comedy, Osborn slipped the tip of his penis over his waistband during the football team's photo shoot. Osborn and his crotch-level co-star went unnoticed as yearbooks and game programs containing his exposed penis were published and handed out.

The school, of course, was furious. Instead of handling its own problems, it decided to turn it over to law enforcement -- for reasons only completely understood by school administrators who believe "school discipline" is pronounced "police matter." Perhaps this overreaction was fueled by the school's own editorial lapse, as it only noticed the exposed penis in the photograph after Osborn bragged about it on "social media."

Insanity ensued.

[Osborn] faces 69 counts of indecent exposure, based on the students and staff who were present when the photograph was taken, and one count of furnishing harmful items to minors, according to Mesa Police Department spokesman Steve Berry. He said the investigation is ongoing.

One penis. (And not even a whole one.) 70 criminal charges. And that includes a felony that rubs elbows with producing and distributing child pornography. Never mind the fact that his "victims" (the 69 misdemeanor counts cover the teammates and staff involved in the photo shoot) included the same teammates who dared him to expose himself. And who also "exposed" themselves to him on repeated occasions with no complaints, as one particularly astute AZ Central reader pointed out.

As reader Jim McManus wrote, “This young man is being charged for exposing himself to his teammates during the picture taking, which no one noticed at the time. Approximately 15 minutes later he and all the people he ‘abused’ went back to the locker room and all took off their (clothes) exposing themselves to each other.”

Yes, there's a difference between expected penis exposure and surprise penis exposure, but the bottom line here is that many of Osborn's "victims" had seen his penis repeatedly. No one expects a penis in a group photo, but hey, peer pressure and stupidity can all be found in large quantities on the average high school campus. That the photo was published unaltered is unfortunate, but there's absolutely no reason law enforcement should have been brought in. And if law enforcement was summoned, officers should have told administrators to handle their own problems, rather than amuse themselves by tallying up 69 + 1 criminal charges.

Fortunately, after allowing insanity to have the run of the yard for a few days, rational thought was allowed to cautiously make its way back onto the propety. First, prosecutors dropped the ridiculous "furnishing harmful items to minors" felony charge.

In announcing that his office would not prosecute the felony charge against Hunter Osborn, Montgomery issued a statement reading: “An assessment of the available evidence for the felony charge of Furnishing Harmful Items to Minors, ARS 13-3506.A., leads us to conclude that the evidence does not establish a violation of the statute. MCAO has furthered review of remaining misdemeanor charges submitted by the Mesa Police Department for possible submittal to the Mesa City Prosecutor's Office.”

Shortly thereafter, prosecutors decided the 69 misdemeanor counts weren't worth pursuing either.

A Mesa police spokesman said Wednesday that the case against Hunter Osborn, 19, was returned to police for further investigation but that the case would be closed.

A good thing, too. A strict reading of the state's statute behind the single felony charge suggests Osborn could not have possibly violated it. Indecent exposure, maybe. But not furnishing harmful material to minors.

It is unlawful for any person, with knowledge of the character of the item involved, to recklessly furnish, present, provide, make available, give, lend, show, advertise or distribute to minors any item that is harmful to minors.

The only entities who performed any of the actions were the school and its photographer -- and neither of those did so knowingly.

Even though this ended relatively well, the sad fact is that if it had been handled with any sort of common sense, we never would have heard about it at all.

Permalink | Comments | Email This Story

The concept of "checks and balances" kind of takes a beating when one branch of the government says it's ok to lie to another branch. We've already seen the FBI tell law enforcement agencies -- through extensive NDAs it makes them sign before they can deploy cell site simulators -- that it's better to let suspected criminals walk away from charges than risk allowing details on Stingray devices to make their way into the public domain via submitted evidence.

Many law enforcement agencies appear to be doing exactly that. More than one agency has misled judges with applications for pen register orders and requests for cell site location data -- neither of which provide details on the technology actually being used.

Another memo from the FBI shows the federal agency directly instructing a local law enforcement agency to engage in parallel construction. The memo, obtained by Oklahoma Watch, explicitly spells out what is supposed to happen if cell site simulator use is part of the evidence chain. (h/t Nate Wessler)

Information obtained through use of the equipment is FOR LEAD PURPOSES ONLY, and may not be used as primary evidence in any affidavits, hearings or trials. This equipment provides general location information about a cellular device, and your agency understands it is required to use additional and independent investigative means and methods, such as historical cellular analysis, that would be admissible at trial to corroborate information concerning the location of the target obtained through use of this equipment.

The problem is that this sort of "lead" often leads directly to search warrants of residences where people are located. The Oklahoma City PD is being told to obtain other non-Stingray-related data that could plausibly explain how it managed to located Subject X at Location Y. Officers won't be telling magistrate judges when seeking pen register orders or subpoenas for cell location info. And officers won't be telling defendants or their representation how they managed to be in the right place at the right time with a search warrant.

The memo also notes that the FBI "will use all appropriate legal means" to prevent Stingray use from being uncovered in discovery requests. Apparently, "all appropriate legal means" covers parallel construction.

What sets this apart from the FBI NDAs we've covered here previously is that this memo is limited to the local law enforcement's borrowing of FBI equipment to locate suspects. With the FBI still in control of the device, it's obviously going to be that much more concerned with controlling the narrative.

Clifton Adcock of Oklahoma Watch notes that local law enforcement appears to be using Stingray devices but covering it up through pen register orders. In one case, this has led to a very suspect request from the Oklahoma City PD, suggesting it had borrowed an FBI cell site simulator to locate the defendant.

In one of those cases, a defense attorney, Douglas Parr of Oklahoma City, said he believes a cell site simulator was used to collect his client’s phone data. The client is charged with drug trafficking. During a hearing in Oklahoma County District Court in September 2015, Parr asked an Oklahoma City police detective whether a simulator had been used. The detective, who had requested the order, testified that to his knowledge such a cell site simulator had not been used.

Testimony in the case shows the officer did not file for a trap and trace order with the court until the day he testified in September – more than a year after he conducted the surveillance.

According to the FBI's new rules for Stingray use, warrants must be sought and provide explicit details about the technology being used -- including the facts that Stingrays search every phone in the area while trying to locate devices and that local service may be disrupted during deployments. The DOJ's ruleset arrived a few months after this particular Memorandum of Understanding was signed with the Oklahoma City PD. One would hope a revised version is on the way, if not already in the hands of Oklahoma law enforcement -- one that does a better job of reflecting the DOJ's current stance on warrants and information dissemination.

Permalink | Comments | Email This Story

Last week, the Intercept published Ed Snowden's powerful foreword to Jeremy Scahill's new book The Assassination Complex. The foreword is entitled: Whistleblowing Is Not Just Leaking — It’s an Act of Political Resistance. It's really worth reading. In it, among other things, he does note that there are very different kinds of leaking information. There are situations where you are alerting the public to important information. And then there are... other situations. Like what happened to former CIA Director, General David Petraeus:

Not all leaks are alike, nor are their makers. Gen. David Petraeus, for instance, provided his illicit lover and favorable biographer information so secret it defied classification, including the names of covert operatives and the president’s private thoughts on matters of strategic concern. Petraeus was not charged with a felony, as the Justice Department had initially recommended, but was instead permitted to plead guilty to a misdemeanor. Had an enlisted soldier of modest rank pulled out a stack of highly classified notebooks and handed them to his girlfriend to secure so much as a smile, he’d be looking at many decades in prison, not a pile of character references from a Who’s Who of the Deep State.

That's a pretty good summary of the "high court" situation that lets powerful people like Petraeus get away with passing on such information that could have legitimately put people at risk.

So, it was interesting, just days later, to see a long interview in the Financial Times with David Petraeus, in which he's asked about Snowden (warning: the link may be paywalled). The interview covers many subjects, and the comment on Snowden is quite brief:

Should Edward Snowden be prosecuted, I ask? “Unquestionably,” he replies. “If Snowden had wanted to help that debate he could have very easily been a whistleblower who could have gone to the appropriate organisation and offered his views. He didn’t.”

This is bullshit on so many levels. First, it's bullshit because Petreaus himself got off with barely a wrist slap for his own activity, which had nothing to do with whistleblowing and appeared to be much more dangerous than what Snowden did. Second, as Petreaus absolutely knows, the intelligence community does not treat whistleblowers well. Previous whistleblowers, including Thomas Drake, basically had their lives destroyed as punishment for using the "appropriate" channels for whistleblowing. Hell, just last week, we wrote about yet another case of an intelligence community whistleblower, who used the "appropriate" channels, suddenly having her home raided and her career in shambles.

Third, it's bullshit because even in using the "appropriate" channels, as an NSA contractor, Snowden was not protected from direct retaliation for whistleblowing. Fourth, it's bullshit because the "proper channels" would just be to run it up the line of people who thought it was hunky dory to lie to the American public to reinterpret the PATRIOT Act to enable them to spy on everyone's communications data. That wouldn't have done anything. Fifth, it's bullshit because once the information actually did get out through the press -- which never would have happened through "appropriate channels," it has set in motion a number of changes, among companies, individuals, Congress and the intelligence community. That's the point of whistleblowing, to actually change the behavior through alerting more people to what's going on.

But, really, it seems especially idiotic that someone in Petreaus' position would weigh in so hypocritically on Snowden's situation.

Permalink | Comments | Email This Story

WARNING: Flip is not a success by any means. Watch at your own risk. This is a video of a guy attempting a front flip on a hoverboard. He lands on his head. It looks like he panicked mid-flip and decided to go for a lemondrop instead after forgetting he wasn't on a diving board and there is no pool below. Is he dead now? No, but he's definitely a little shorter. Amazingly, this is still the coolest thing anybody's done on a hoverboard. "Nearly kill yourself?" Exactly. Hit the jump for the video. Thanks to Marion O, who agrees he should have started with a backflip.

We've written a few times now about Sci-Hub -- the website put together by Alexandra Elbakyan, an academic from Kazakhstan. It's a somewhat creative hack on the idea that many academics are more than willing to share PDFs of useful research with each other, basically building a search engine of such research, which is actually stored in a different repository (called LibGen). But the really clever part of Sci-Hub was that it also had some people sharing their login tokens to various research databases, so that if the LibGen doesn't have the document, Sci-Hub uses a login to retrieve the document, deliver it to the user who requested it and then uploads it to LibGen to make it available for anyone else. Publishing giant Elsevier has been particularly upset by all of this -- despite the fact that its argument appears to go 100% against the stated purpose of copyright law.

Remember, this isn't about sharing some sort of commercial music or video or anything. This is about academic research, much of which has been paid for with public tax dollars, and which Elsevier paid no money to create. Elsevier not only gets academics to submit papers for publishing, but to also hand over their copyrights to Elsevier. In some subject areas, it even makes the academics pay to submit their papers for publishing. Then Elsevier gets free editing help from other academics who do peer review for free. Some publications even have unpaid editors as well. And then Elsevier goes out and charges hundreds of thousands of dollars for subscriptions to universities for research it had no hand in creating, for which it paid no money, but where it gets the copyright.

And, of course, copyright had absolutely no incentive in getting this research done in the first place. It's done by academics who are pursuing the subject because of their own interests and the general requirements pushed by universities to get their faculty to publish.

In short, copyright has no role here whatsoever other than to enrich Elsevier. That seems fairly problematic.

Either way, back in December, Elsevier was able to score an injunction against Sci-Hub, such that it lost its domain. As we noted at the time, it was only starting the mole whac'ing process, as Sci-Hub immediately moved to a new domain.

And, yes, it now appears that a complaint from Elsevier has resulted in that new domain getting shut down too, though Sci-hub remains available on other domains including the .bz and .cc top level domains. Oh, and, of course its direct IP address 31.184.194.81. And the site has a Tor hidden site as well. In other words, lots more moles to whac.

In the meantime, this quixotic, and anti-knowledge, anti-education campaign by Elsevier to shut down such a useful tool has only resulted in greater and greater attention for Sci-Hub. Tons of people had never heard of the site before, but the continuing news coverage, which increases each time Elsevier gets petulant and tries to take it down again, has only served as useful advertising for a useful tool.

Elsevier management might want to reconsider its strategy here, seeing as whatever money it's wasting on its lawyers seems to actually be serving as marketing dollars for Sci-Hub.

Permalink | Comments | Email This Story

So we've talked a lot about the Great Firewall of China and how it works. Contrary to what many believe, it's not just a giant government bureaucracy blacklisting content, but a huge ecosystem that partially relies on unpredictability and the lack of intermediary liability protections online. That is, rather than directly say "this and that are blocked," the Chinese government will often just let companies know when they've failed to properly block content and threaten them with serious consequences. Because of this, you get a culture of overblocking, to avoid running afoul of the demands. This is one of the reasons why we believe that strong intermediary liability protections are so important. Without them, you're basically begging for widespread censorship to avoid legal consequences.

And, in many ways, it works quite well in China. Yes, sophisticated users know how to use VPNs and proxies and to get around the blocks, but many people do not. But something interesting is happening in China right now, as one of the largest and most successful internet companies there appears to be challenging the censorship regime. First, it's important to recognize that in China, one subject that is absolutely, without question, censored, is anything relating to the Tiananmen Square protests and crackdown of 1989. On the internet in China, it's as if the event never happened. People have tried workarounds, using euphemisms and wordplay, but eventually those get disappeared down the memory hole too. There was even that time the censors banned the term "big yellow duck," after people replaced the famous tanks in the "tank man" photo with giant rubber ducks: But something odd happened yesterday. Suddenly, on Baidu (which is like the Google of China), searches related to the tank man and other symbols of the Tiananmen Square protests were showing up on Baidu. Clay Shirky, who has been living in China recently, posted details on his Twitter feed, which is well worth reading:

China's https://t.co/G1q2OYdfSV unblocks search results for 虫堂臂挡车 (known to us as tank man, from Tiananmen massacre) pic.twitter.com/DU2X3RZnWv

— Clay Shirky (@cshirky) May 6, 2016

It appears that this is something of a reaction to the Chinese government announcing that it will be investigating Baidu's advertising practices, following the death of a young man from cancer, who had kicked up quite a lot of attention after he had tried an "experimental" cancer treatment he discovered via an ad on Baidu. When it didn't work, he blamed Baidu for allowing the ad, and when he passed away there was a public outcry. In response, the government announced plans to investigate Baidu's ad practices. It appears that Baidu loosening the padlocks on Tiananmen Square might be a response to that, which lots of people seem to think is playing with a fire in a manner that will almost certainly leave the company burned.

This is a direct & blatant refusal to play by the rules. Baidu has a lot of power behind the scenes, but even then, this looks like treason.

— Clay Shirky (@cshirky) May 6, 2016

This will probably end soon - hearing from friends in Beijing that some searches are censored again - but it will cause months of trouble.

— Clay Shirky (@cshirky) May 6, 2016

Young, educated Chinese are so used to cat and mouse censorship that when they see something like this, they screenshot immediately.

— Clay Shirky (@cshirky) May 6, 2016

At a conservative guess, there've been a billion screenshots taken of various banned images, jokes, and memes during the last day.

— Clay Shirky (@cshirky) May 6, 2016

Shirky has a lot more to say, including some further speculation that perhaps there was growing tension from last year, after the Chinese government basically made use of Baidu to fire a denial of service at GitHub. The fact that the packets came via Baidu was, as Shirky notes, a PR blackeye for Baidu at a time when the company wants to expand beyond China. Shirky also deleted a tweet that originally said "this has to backfire," noting how central media and internet censorship is to the current regime.

The brief dropping of the censorship appears to be (again, Shirky notes no one knows for sure -- but many people seem to believe) Baidu trying to let the Chinese government know that it has become powerful enough to make trouble for the government, so it's not just a one way street in terms of who holds the power. Of course, that seems like an incredibly risky move to make if you really don't have enough power to stand up to the government.

We may never know all the details of what's going on, but it's a brief, if fascinating, view into some of what's going on in China today with the Great Firewall, and the increasing power of some of its most successful companies. But it's also a reminder of why we should be so thankful for strong intermediary liability protections in the US, and how not having such protections is a sure path to censorship.

Permalink | Comments | Email This Story

Congress is simply fed up with the FCC's pesky new habit of standing up to giant cable and broadband companies. Congress was outraged when the FCC announced it wanted to stop states from letting large ISPs write horrible, protectionist state laws. Congress was outraged when the FCC announced it wanted to pass actual, functioning net neutrality rules. Congress was even outraged when the FCC decided to raise the standard definition of broadband to 25 Mbps, since it only served to highlight a lack of competition for next-generation broadband service.

Now, not too surprisingly, Congress is just pissed that the FCC wants to try and bring some competition to the cable set top box space.

The FCC recently announced that it plans to craft rules requiring that cable operators deliver their existing content (at the same price and with the same copy protection) to third-party hardware without the need for a clunky CableCARD. The cable industry has been having an incredible, epic hissy fit over the announcement, not only because it would endanger $21 billion in captive annual revenue from set top box rental fees, but it would drive consumers to hardware delivering a wider variety of legacy TV alternatives than ever before.

Part of the cable industry's ingenious plan to stop the FCC has involved funding an ocean of misleading editorials that try to claim the FCC's plan will somehow boost piracy, hurt privacy, "steal the future," and even harm ethnic diversity. Spend a few minutes perusing the news wires and you'll find hundreds of such editorials, all penned by a wide variety of cable industry-tied consultants, think tankers, and others, suddenly pretending to be objective analysts just really worried about the welfare of consumers. It is too much, as usual, for news outlets to bother highlighting any financial conflicts of interest these authors might have.

In addition to pummeling the press with a parade of misleading editorials, the other wing of the cable industry's brilliant strategy to stop the FCC involves convincing loyal Congressional allies -- whose approval ratings are about on part with the cable industry -- to whine like petulant children.

A new letter from sixty Congressmen and women (pdf) reads as if it was written by a cable industry lobbyist (because it probably was), deriding the FCC for daring to interrupt the cable industry's glorious history of innovation with a pesky quest for better, cheaper, consumer-facing hardware:

"The Federal Communications Commission's recently proposed rules on the Competitive Availability of Navigation Devices, if adopted, will jeopardize the incredible evolution of video distribution services enabled by generally reasonable regulation. Imposing new, onerous regulations on pay-TV providers would produce very few benefits for consumers, while potentially harming the viability of these providers. The particular obligations being considered by the FCC are all the more troubling because they would mandate compliance with technical standards that do not yet exist, injecting even greater uncertainty into the marketplace.

How horrible! Except it's not true. The FCC's proposal as it currently stands (pdf) says that cable providers can use any technology they see fit, and any copy protection they'd like, to ensure their content can be delivered to third-party hardware under the FCC's rules. In fact, Comcast recently demonstrated how non-onerous it was by offering its content via apps on Samsung and Roku devices. Again, the FCC's proposal isn't difficult or onerous, but it does put a giant crack in the side of the cable industry's walled garden, of which clunky, outdated, closed cable boxes are a cornerstone.

Knowing how hated cable providers generally are, the Senators (including traditional telecom allies like Marsha Blackburn and Bob Latta) try to insist they're solely worried about the impact the FCC's plan will have on small cable providers. But not before penning some additional, gushing adoration of the incredible quality the cable industry provides:

"Consumers today enjoy unprecedented access to some of the highest-quality television programming ever produced, which they can watch anytime, anywhere, on a wide variety of devices. Given this proliferation of consumer choice, it is concerning the Commission continues to consider a proposal that will place significant technical and competitive burdens on pay-TV providers operating in an increasingly competitive environment, particularly small providers who serve as the communications backbone of their communities.

That's very sweet, but many of those smaller cable operators are getting out of the cable industry anyway. Many have noted that as smaller companies, they lack the scale and by proxy leverage to negotiate deals that could make offering TV sustainable in the face of unrelenting broadcaster price hikes. As such, many say they're planning to exit the TV business anyway and focus on broadband and other services. The CEO of one such smaller cable company, Cable ONE, this week wrote a missive calling the pay TV Industry a tragedy of the commons, one that ends horribly in the face of real disruption.

I personally still think it makes more sense for the FCC to focus its regulatory calories on broadband competition, net neutrality and zero rating -- and let the old cable box die organically in the face of streaming alternatives. But given the relatively glacial pace of cord cutting and continued, entrenched power of companies like Comcast, I can also understand the FCC's logic in wanting to accelerate that process so it doesn't take the lion's share of the next decade.

That said, while it's nice that Latta, Blackburn and friends are just so damn worried about consumers and small cable companies, there's simply no debating the fact that the cable industry's opposition to the FCC's plan is rooted in just one thing: fear. Fear of losing control of monopoly power. Fear of losing $21 billion in annual captive revenue. Fear of third-party set tops that present consumers with actual choice instead of the expensive illusion of choice. And while it's sweet to yell "how high" when the cable industry demands they jump, it's not clear who Congress and the cable industry actually think they're fooling when they pretend -- after thirty years of abysmal service -- to actually give a flying damn about consumer welfare.

Permalink | Comments | Email This Story

Read 5 remaining paragraphs | Comments

By now, most people are aware that Facebook advertisements can be quite targeted in nature, whether by age, gender, or location. Most people also are aware of the level of spending by politicians and government for Facebook ads to get their messages out to their targeted audience. But just how targeted can Facebook ads be in the service of politicians? Well, for that we turn to the story of Lisa Murkowski, Senator from Alaska, and her attempt to get a road built between two towns in her state.

Alaska Senator Lisa Murkowski has been trying for years to convince the Interior Department to allow Alaska to build a 11-mile road through a wildlife refuge to make two remote towns in the state more easily accessible. But the Interior Department has balked, citing environmental concerns; the area is a habitat for migratory birds. In order to convince Department officials to change their minds, Murkowski recently targeted them—and only them—with a video ad on Facebook.

How did she do this? Well, she produced a video advertisement and bought ads on Facebook that were set to run specifically during lunchtime hours and geo-targeted 1849 C Street, N.W. in Washington D.C.. That address is the building for the Interior Department. That's fairly precise targeting, I think, which is why it's actually quite impressive that the advertisement appeared in the newsfeeds seven-thousand times as it ran and the video had been clicked on well over two-thousand times. But exactly how precise was the geo-location portion of this advertisement?

Well, it depends on how big the building is. A spokesperson from Facebook directed me to a help page explaining how to target people in a specific location (which it can determine from GPS coordinates off their smartphone or, less reliably, from the IP address of their computer). The most granular option is targeting a location with a radius of one kilometer, or a little over half a mile.

So if you were targeting a workplace with a one-mile long campus, like Facebook itself, you could be guaranteed to show an ad only to people in its buildings. But the Department of Interior takes up just one city block. So when Murkowski targeted the Interior Department’s address, she was actually targeting not just that building, but all the people and buildings in a half-mile radius.

Which probably led to some very confused people in nearby buildings wondering what the hell this video about a road in Alaska was doing in their newsfeed. This does come off as perhaps a tad unseemly, but I view this kind of targeted advertising less negatively than I do traditional lobbying efforts. And it's not exactly clear whether all of those views had any real effect on the policy-makers, as the Interior Department still opposes the building of the road as of the date of this writing.

Still, it's a brave new world out there for anyone looking to influence policy-makers.

Permalink | Comments | Email This Story

In the US, you can be given a gun and a chance to catch bullets for your country at age 18. Three years after that, the US government will finally allow you to purchase your own alcohol. At 21, you can finally be the "adult" in "adult beverages." Except in some states. Some states tie booze purchases to morality. (I mean, even more so. It's subject everywhere to "sin taxes.")

As we covered here earlier, the state of Idaho says adults can drink booze and watch movies meant for mature audiences, but not always simultaneously. In Idaho, state police have been busting theaters for showing certain movies while serving alcohol, thanks to statutes that say it's illegal to serve up both booze and "simulated sexual acts."

In Idaho, theaters are trying to get the law ruled unconstitutional -- pointing out that the law is only selectively enforced (cops raid theaters showing "Fifty Shades of Gray" rather than "American Sniper," even though both contain depictions of sexual acts) and allows the state to use liquor statutes to regulate speech.

Over in Utah, the same problem exists. The theater targeted here -- Brewvies -- isn't taking the state to court. Yet. Instead, it's fighting to stay alive. It appears a bunch of cops went to see a movie they probably wanted to see anyway while on the clock and handed the theater an ultimatum.

Brewvies is facing a fine of up to $25,000 fine and could lose its liquor license after undercover officers attended a screening of Marvel's R-rated antihero film "Deadpool" in February.

The state says playing "Deadpool" while serving booze violates Utah law because the movie includes nudity and simulated sex, including a suggestive scene in the film's credits involving a cartoon unicorn. The obscenity law is generally used to regulate strip clubs, which are required to have dancers wear G-strings and pasties if the club serves liquor.

It also bans showing any film with sex acts or simulated sex acts, full-frontal nudity or the "caressing" of breasts or buttocks if at businesses with liquor licenses.

In addition to seeking funds to pay the threatened fine, the theater is hoping to raise enough to seek an injunction against the statute on the same grounds as the challenge in Idaho: that liquor laws are being abused to regulate First Amendment activity.

The theater is seeking $75,000 and Deadpool himself, Ryan Reynolds, has already pitched in.

The theater has since set up a gofundme page and has raised, at the time of writing, $17,352 out of its $75,000 goal. $5,000 of that came from Deadpool star Ryan Reynolds himself.

The underlying problem is the state's insistence on deciding what the right combination of booze and entertainment should be for a state full of adults who are legally allowed to do other things far more "adult" than having a beer while watching a movie that contains depictions of sexual activity. Why either activity is OK when enjoyed separately, but somehow a problem when combined, is something only the state pretends to comprehend. These are leftover laws meant to regulate sexually-oriented businesses like strip clubs and porn theaters, but they're being used to extract fees from theater owners who want to treat adults like adults. Like any other badly-written law, it's being enforced selectively with an eye on easy citations and excessive fines.

Permalink | Comments | Email This Story

If you think about it, practically every type of security product in the market provides security through surveillance. Surveillance is the act of keeping a close watch over someone or something in order to prevent or detect. In law enforcement it’s looking for crime but in an IT sense it’s monitoring for cyber activity. Either way, for the surveilled it totally invades privacy.

IT security products work just like the FBI watches you from a sedan or the NSA listens to your phone calls. Web application firewall products read all of your web traffic. Your desktop antivirus installs itself with privileged administrative access to all of the systems. It sees every single thing stored on your disc and everything going across the network. Your email/web malware detection software is reading all the emails that are coming back and forth and looking at all of your web traffic. This is essentially security through surveillance. These systems then scan these payloads for malicious activity and then interpret results. They work just like surveillance from our government agencies. They read everything to and from your device in order to prevent or detect malicious activity.

Is security through surveillance even really feasible or appropriate in the mobile world?

There are two problems with surveillance-based security on mobile devices. First, these are hybrid use devices so privacy is a big concern. Second, surveillance-based security does not provide sufficient coverage to be effective on mobile devices. Let’s take a closer look at both of these problems.

Employees realize when they are on the company’s desktop using the company’s web browser and connected to corporate resources then the company has to be able to scan email and web traffic. Employees understand that they give up their privacy at work. The company has to limit an employee going to an inappropriate site or downloading malware which may end up affecting a bunch of corporate systems. There is no expectation of privacy in the corporate environment while sitting at your desk. Employees know they are being watched.

Mobile is a hybrid use device.

Employees don’t take desktops in their pockets and go home for the weekend with them. If one does or happens to have a BYO device, they don’t want to be surveilled on Saturday afternoon when browsing for personal reasons or paying bills online. However, if we use the security through surveillance model, the company is still reading all of your emails and seeing all of your web traffic during your personal use on the weekends.

A surveillance security model is insufficient for mobile.

The desktop is wired to a corporate network and the only way traffic gets in and out of that device is an input device like a USB or keyboard or its network connection. Companies restrict the use or scan USBs when they connect, presume the keyboard is safe and scan the network for intrusions and malware. Done, secure. Now let’s take the same practice and apply it to our mobile devices.

Applying the same procedures to mobile devices isn’t as effective. Mobile devices don’t just have two input methods. There is Bluetooth. They have IR and NFC. They have Wi-Fi, and cellular. Plus, the the cell chip has has more radios in itself. So the problem is you can’t provide enough surveillance on a mobile device by observing its network traffic.

If you solely observed network traffic to secure a mobile device you won’t detect a number of attacks. You won’t see Stagefright. By observing the cell phone service traffic, you won’t see a man-in-the-middle attack on Wi-Fi. By only looking for malware by scanning email traffic, you wouldn’t see the fact that an SMS spear phishing campaign sends users into a browser with malicious JavaScript content. Another Bluetooth device could come within a few feet of a device and begin to communicate and you won’t see this attack or any of the preceding examples.

How do you secure mobile without invading user privacy?

There needs to be a different approach for mobile devices. Companies aren’t equipped to surveil either corporate or BYO devices from cyberattacks since there are so many privacy issues and communication methods on smartphones.

That’s why Zimperium has a completely different approach. Zimperium is not security by surveillance. Zimperium’s proprietary z9 engine runs on the device to detect threats at the device level without needing an internet connection. This unique approach creates the most private and unobtrusive way to secure mobile devices. Since the detection resides on the device there isn’t any personally identifiable information sent to a cloud service in order to facilitate detection. Furthermore, the level of threat information collected is configurable and customizable to a company’s unique privacy requirements.

For more information on how your mobile policies affect your mobile security strategies, please join Zimperium’s next webinar featuring 451 Research on “How to Balance Mobility, Security and Privacy” on May 11.

 

Sarah Ryley at ProPublica has a fascinating, depressing, and exhaustive report on the NYPD's apparent ongoing civil rights abuses. Under the guise of policing "nuisance businesses," certain precincts are targeting minority-owned businesses -- usually small bodegas, laundromats, etc. -- with abatement actions that force owners to either lose their source of income or capitulate to the NYPD's overreaching demands.

One business owner was hit with a "nuisance abatement" action -- one which could lead to his laundromat being closed for at least 30 days -- after undercover officers twice sold stolen goods to store customers. Sung Cho's laundromat had nothing to do with either sale, other than being open for business when the sales were made. Despite Cho's lack of culpability in the selling of stolen goods, the NYPD portrayed his business as a "facilitator" of illegal activity and hit his store with a restraining order.

As Ryley reports, the nuisance abatement program is prone to abuse, what with its one-sided court process (NYPD files complaint and asks for restraining orders without notifying the business owner or allowing them to challenge the orders) and very loose definition of "facilitation." While the statute does provide that business owners must be given a chance to challenge an order within three business days of being presented with it, the NYPD routinely serves orders on Thursday or Friday, forcing businesses to close over the weekend, normally their busiest sales days.

The article points out that most of these orders are served by officers in precincts where the minority population is the majority, suggesting once again that the NYPD regularly engages in biased policing. A judge who has presided over abatement cases lends some credence to this conclusion.

“You never see the white bar owner from the Meatpacking District in here; it’s always some bodega owner from Uptown,” said the judge, who asked not to be named. “It’s a complete double standard.”

In terms more familiar to Techdirt's audience, nuisance abatement enforcement is nothing more than law enforcement trolling.

Once served with nuisance abatement actions, business owners are faced with a choice. They can fight the case and remain shut down until it’s resolved, earning no income. Or they can agree to the NYPD’s demands, sign a settlement, and reopen. As a result, cases tend to get resolved very quickly.

When not using sales of stolen goods to customers to push nuisance abatement actions, the NYPD also likes to use sales of alcohol to minors as leverage -- despite the fact there's an entire arm of enforcement as well as a separate government agency in place to deal with liquor license violations. As Ryley points out, doubling up on enforcement allows the city to punish business owners twice for these violations. And some of the busts are highly questionable. The ProPublica piece contains footage of a contested sting "buy:" a two-second "interaction" in a busy convenience store where the undercover buyer obscured the beer can with his hand and tossed a dollar at a clerk who was in the middle of handling another customer's transaction.

The ends here appears to be the expansion of the NYPD's already-robust surveillance powers. The laundromat owner faced with losing his business agreed to the PD's "settlement offer" -- one that gave the NYPD uninterrupted, warrantless access to his place of business.

He agreed to pay a $2,000 fine, maintain cameras that the NYPD can access at any time, and to allow the police to conduct warrantless searches. If anyone is even accused of breaking the law at his business again — whether a store employee or not — he faces escalating penalties: closures that would increase from 30 days to 60 days to 90 days to a full year with each alleged offense; fines climbing as high as $15,000.

Perhaps most damaging of all, the terms continue in perpetuity, even if the business changes hands.

This isn't an aberration. This is the standard operating procedure. Other businesses facing NYPD abatement orders have not only installed cameras and agreed to warrantless searches, but have also put $1000 credit card readers in place that store personally-identifiable info on every customer that uses them -- and which all can be accessed anytime by police officers without a warrant.

An NYPD official contacted by ProPublica isn't shy about the desire to expand the NYPD's surveillance dragnet.

Robert Messner, who heads the NYPD’s Civil Enforcement Unit, which handles the cases, said during an interview with the Daily News in December that his unit does not keep a database of the businesses required to maintain cameras. He said their purpose is to make neighborhoods safer and to help police solve crimes.

“We want everybody to install cameras. We think that’s the greatest,” he said.

He's also not afraid to say why he prefers nuisance abatement proceedings to other statutes the NYPD has at its disposal to handle these sorts of "problems."

When asked about the Padlock Law in December, Messner said the last case filed under it was “15 years ago maybe.”

He said the padlock law “was a creaky old law” that cost a lot of police resources and often resulted in protracted litigation.

“This thing,” Messner said, referring to the nuisance abatement law, “is simple and elegant.”

Yes, there's nothing more "simple and elegant" than greasing your own wheels. The "Padlock Law" -- instituted during Bill Bratton's first run at the top of the NYPD -- allowed business owners to contest the orders and allegations in court before being threatened with a business closure. The new way -- now more than 15 years old -- deprives business owners of any meaningful form of due process, which makes it much easier to use the threat of a business shutdown to coerce owners into providing the NYPD with 24-hour warrantless access and a larger surveillance footprint.

Permalink | Comments | Email This Story

Everything everyone saw in cop shows as evidence linking people to crimes -- the hair left on someone's clothing, the tire tracks leading out to the road, the shell casings at the scene, etc. -- is all proving to be about as factual as the shows themselves.

While much of it is not exactly junk science, much of it has limited worth. What appears to indicate guilt contains enough of a margin of error that it could very easily prove otherwise. Science Magazine is taking a look at the standbys of forensic science and what's being done to ensure better presentations of evidence in the future.

On a September afternoon in 2000, a man named Richard Green was shot and wounded in his neighborhood south of Boston. About a year later, police found a loaded pistol in the yard of a nearby house. A detective with the Boston Police Department fired the gun multiple times in a lab and compared the minute grooves and scratches that the firing pin and the interior of the gun left on its cartridge casings with those discovered on casings found at the crime scene. They matched, he would later say at a pretrial hearing, “to the exclusion of every other firearm in the world.”

[...]

So how could the detective be sure that the shots hadn’t been fired from another gun?

The short answer, if you ask any statistician, is that he couldn’t. There was some unknown chance that a different gun struck a similar pattern. But for decades, forensic examiners have sometimes claimed in court that close but not identical ballistic markings could conclusively link evidence to a suspect—and judges and juries have trusted their expertise. Examiners have made similar statements for other forms of so-called pattern evidence, such as fingerprints, shoeprints, tire tracks, and bite marks.

Six years ago, the National Academy of Sciences found that these forensic standbys had a much larger margin of error than was portrayed in court by detectives and expert witnesses. It recommended the margin of error be delivered along with the testimony to head off future verdicts based on faulty evidence.

To date, not much has changed. While actual junk science like bite marks has largely been discarded by prosecutors, the others remain, even as their reliability has been constantly questioned. The FBI loved hair analysis, right up to the point that it determined its witnesses had overstated test results 90% of the time in the two decades prior to 2000.

Even fingerprints, which have long been considered unassailable because of their supposed uniqueness, aren't much better. Some of it has to do with the presumption that every fingerprint is so unique even a partial print can eliminate suspects. The rest of its issues lie with those matching the prints.

One study of 169 fingerprint examiners found 7.5% false negatives—in which examiners concluded that two prints from the same person came from different people—and 0.1% false positives, where two prints were incorrectly said to be from the same source. When some of the examiners were retested on some of the same prints after 7 months, they repeated only about 90% of their exclusions and 89% of their individualizations.

The NIST has given $20 million to the Center for Statistics and Applications in Forensic Evidence (CSAFE) to come up with a better way to present this sort of evidence -- one that clearly accounts for any uncertainties in the results or processes. CSAFE is still trying to figure out how to present this as a number/rating. But that might not be the only problem. The other issue is that juries and judges may not find specifics about forensic reliability to play much of a part in deciding guilt or innocence.

In a 2013 study, for instance, online participants had to rate the likelihood of a defendant’s guilt in a hypothetical robbery based on different kinds of testimony from a fingerprint examiner. It didn’t seem to matter whether they were simply told that a print at the scene “matched” or was “individualized” to the defendant, or whether the examiner offered further justification—the chance of an error is “so remote that it is considered to be a practical impossibility,” for example. In all those cases, jurors rated the likelihood of guilt at about 4.5 on a 7-point scale. “As a lawyer, I would have thought the specific wording would have mattered more than it did,” Garrett says. But if subjects were told that the print could have come from someone else, they seemed to discount the fingerprint evidence altogether.

The other part of the problem is the people who perform the tests. Multiple incidents where evidence was falsified or not properly tested have been uncovered. The evidence is only as good as the processes, and if steps are skipped because of sloppiness or laziness, the evidence's credibility becomes highly questionable -- not just for the specific instance where results were faked, but for every test this person has touched.

There's no possible way to eliminate honest errors, much less prevent anyone from falsifying results. In both cases, the problems are caught after the damage has been done. Humans are the most unpredictable part of the chain of evidence but also an irreplaceable part. CSAFE will be working with forensics labs to create best practices, but it can do nothing to prevent the lazy and/or incompetent from completely ignoring the proper steps.

Problems are also present higher up the chain. When bad science or bad practices result in questionable evidence, it's often extremely difficult to have convictions resulting from them overturned.

What’s troubling, [federal judge Nancy] Gertner says, is that when judges accept junk science, an appeals court rarely overrules them. Attaching a numerical probability to evidence, as CSAFE hopes to do, “would certainly be interesting,” she says. But even a standard practice of critically evaluating evidence would be a step forward. “The pattern now is that the judges who care about these issues are enforcing them, and the judges who don’t care about these issues are not.”

In this way, the courts are no better than labs where shoddy work is done. Variations in personality undermine the dispassionate nature of science, making it susceptible to human prejudices rather than the strength of the evidence itself.

Permalink | Comments | Email This Story

A court has found that Amazon engaged in deceptive practices by not obtaining "informed consent" about in-app charges, especially with apps targeted at children. The finding is perhaps unsurprising, as the world of microtransactions relies greatly on a minimum number of steps between app makers (and app purveyors like Amazon) and users' wallets.

What's more surprising is the opinion itself, which arrived in redacted form. Both the FTC and Amazon obviously wanted to keep parts of the opinion from being made public. The problem is that whoever handled the redaction process blew it.

Coughenor released two rulings -- a complete decision, which was marked as "sealed" and a decision for the public, which was marked as "redacted." That redacted version has large swaths of text covered with black bars, but the opinion can be read in its entirety by cutting and pasting it into another file.

The unintended consequence of this screw-up is that the public can now see what the government and Amazon wanted to prevent the public from knowing -- which is exactly the sort of stuff the public should know, as Public Citizen's Scott Michelman explains.

The redactions included a good deal of information that was central to court's decision, including the evidence showing what Amazon officials knew and when, the FTC's estimate of damages, the length of the injunction the FTC was seeking, and more. All of these are of great public importance to understanding what Amazon was doing, what the FTC argued to the court, and why the court ruled as it did.

It's not as though any sort of trade secrets or confidential government techniques are hiding behind the retractions. Much of what is redacted appears to have been for the benefit of Amazon, which does not come out of this surprise un-redaction looking good.

[I]n developing its Kindle Fire tablet, Amazon identified "soccer parents" as a key target customer base, referring to them as "low-hanging fruit." (Dkt. No. 121 at 8; see also Dkt. No. 122 at 3.)

[...]

[T]he evidence demonstrates that Amazon was aware that many customers did not understand in-app purchases when they were first implemented. In a confidential document regarding Amazon's marketing plan for launching in-app purchases, the company acknowledged that "'IAP' isn't a concept widely known by customers." (Dkt. No. 120 at 5.) And, despite its assertion that "[c]ustomers are not looking for apps based on how much they cost," the company was aware that customers' top searches in selecting apps indicate that customers were seeking free apps to use. (Id. at n. 2; five of the top searches included the word "free.") Amazon was aware that in many instances, the person initiating the in-app purchase was a child: in a document discussing company strategy to promote increases in in-app purchasing, Amazon acknowledged "the disconnect between the account owner (e.g., parent) and the app user (e.g., child)."

[...]

Moreover, regardless of its reputation for customer service, it is Amazon's stated policy that in-app purchases are final and nonrefundable, likely discouraging much of its customer base from attempting to seek refunds in the first place. (See Dkt. No. 127 at 275.) ("Yeah, that's the – that's our official policy, is digital content's not refundable.")

[...]

Amazon has received many complaints from adults who were surprised to find themselves charged for in-app purchases made by children. By December 2011, Aaron Rubenson referred to the amount of customer complaints as "near house on fire." (Dkt. No. 115 at 19.) Rubenson also referred to "accidental purchasing by kids" as one of two issues the company needed to solve. (Id.) Rubenson additionally stated that "we're clearly causing problems for a large percentage of our customers."

Also "withheld" is the FTC's justification of its damages estimate.

Julie Miller, a lead FTC data analyst, calculated the total in-app purchase revenue and refund amounts for seven different categories: (1) orders of $20 or more in High-Risk Non-Casino apps from the earliest date available to March 25, 2012,1 (2) orders of $19.99 and below in High-Risk Non-Casino apps from the earliest date available to February 5, 2013, (3) orders of $19.99 and below in High-Risk NonCasino apps from February 6–April 30, 2013 excluding those on the “Otter” device, (4) orders of $19.99 and below in High-Risk Non-Casino apps from May 1–July 30, 2013 excluding those on the Otter device, (5) orders of $19.98 and below in High-Risk Non-Casino apps from July 31, 2013–June 3, 2014 excluding those on the Otter device, (6) orders of $19.99 and below in High-Risk Non-Casino apps from February 6–October 9, 2013 on the Otter device, and (7) orders of $0.99 and below in High-Risk Non-Casino apps from October 10, 2013 to the latest date available on the Otter device. (Id.) These categories were selected in order to omit authorized charges. This calculation gave Ms. Miller a total of charges made without authorization by password. Ms. Miller calculated $86,575,321.38 in revenue and also found that $10,060,646.48 was provided in refunds. (Dkt. No. 110 at 3.) Ms. Miller then calculated an “unauthorized charge rate,” the rate at which users failed to properly enter a password in initiating an in-app purchase as a percentage of the overall total.

Amazon's rebuttal of the FTC's math is redacted...

Amazon argues that Ms. Miller’s estimate is so “fundamentally flawed” as to not be able to support a finding of substantial injury. (Dkt. No. 179 at 18.) In so arguing, Amazon primarily takes issue with Ms. Miller’s calculation of an “Unauthorized charge rate.” (Id.) In dividing the number of password entry “failures” and dividing that by the total number of password prompts presented, the FTC argues that it identified a “reasonable proxy for the rate at which children would incur an in-app charge without consent . . when password entry was not required.” (Dkt. No. 184 at 18.) Amazon asserts that this rate calculation “assumes that every single password failure was an attempt by a child that would otherwise have been a completed in-app purchase.” (Dkt. No. 179 at 18.) This point is well taken: many password “failures” could have occurred because the user got distracted, changed his or her mind, or simply could not remember their password. However, it is reasonable to assume that of the group of users faced with a password prompt who ultimately failed to provide a password, many were children who, absent a password prompt, would have gone on to complete an in-app purchase.

...as is the court's partial agreement with Amazon's assessment of the assessment. [redacted portion in bold]

While, as discussed above, the general methods used by the FTC to reasonably approximate the damages to consumers by unauthorized in-app charges serve as a fair starting place, the Court finds that the unauthorized charge rate of 42% is too high. The Court has received Amazon’s “Adjustments to the FTC’s Estimates of Injury and Monetary Relief” (Dkt. No. 221 at 2) and invites further briefing on the issue of the scope of appropriate monetary relief.

Also redacted is the FTC's declaration of how long it felt Amazon should remain under the government's supervision.

The injunction sought would subject Amazon to government oversight for twenty years.

While FTC intervention has resulted in better refund policies and better notification about in-app purchases, the fact is that app makers are just as culpable as Amazon -- even if it's Amazon that will be paying the fines. There was no line of app developers at Amazon's door demanding better protections for app users. And Amazon is hardly alone in its targeting of low-hanging soccer parent fruit. When it comes to monetization of microtransactions, the lack of purchase controls is a feature, not a bug.

Then there's the question of whether we really want the government to be in the business of designing app store front-ends. While the concerns central to this case are valid, the best solution isn't necessarily the FTC setting itself up as an additional middleman for in-app purchases -- especially not for the next 20 years.

And, as for this opinion, it just goes to show courts are still far too willing to grant ridiculous redaction requests from plaintiffs and defendants -- a practice that further separates the public from the government that's supposed to be serving it.

Permalink | Comments | Email This Story

The FBI recently spent more than $1 million for assistance in decrypting a device's contents. It may have overpaid. Alternatives exist, whether it's a $5 wrench or indefinite imprisonment for not helping the government with its prosecution efforts.

A Philadelphia man suspected of possessing child pornography has been in jail for seven months and counting after being found in contempt of a court order demanding that he decrypt two password-protected hard drives.

The suspect, a former Philadelphia Police Department sergeant, has not been charged with any child porn crimes. Instead, he remains indefinitely imprisoned in Philadelphia's Federal Detention Center for refusing to unlock two drives encrypted with Apple's FileVault software in a case that once again highlights the extent to which the authorities are going to crack encrypted devices. The man is to remain jailed "until such time that he fully complies" with the decryption order.

The Fifth Amendment should prevent the government from punishing a person for not testifying against themselves, which is what's being argued by the defendant's representation in its appeal to the Third Circuit. (Although it's actually indirect representation. The government's case is actually against Doe's devices ["United States of America v. Apple MacPro Computer, et al"] and his lawyer is hoping for a stay of the contempt order during the appeal process.)

Mr. Doe… has a strong likelihood of success on the second issue: whether compelling the target of a criminal investigation to recall and divulge an encryption passcode transgresses the Fifth Amendment privilege against self-incrimination. Supreme Court precedent already instructs that a suspect may not be compelled to disclose the sequence of numbers that will open a combination lock — clearly auguring the same rule for any compelled disclosure of the sequence of characters constituting an encryption passcode.

Doe's rep also argues that the All Writs order obtained by the government has no jurisdiction over Doe or his devices.

Mr. Doe’s first claim is that the district court lacked subject matter jurisdiction. The claim stems from the government’s apparently unprecedented use of an unusual procedural vehicle to attempt to compel a suspect to give evidence in advance of potential criminal charges. Specifically, the government took resort not to a grand jury, but to a magistrate judge pursuant to the All Writs Act, 28 U.S.C. § 1651. (Ex. F at 1).

It is black letter law that the All Writs Act never supplies “any federal subject-matter jurisdiction in its own right[.]” Sygenta Crop Protection, Inc. v. Henson, 537 U.S. 28, 31 (2002) (citation omitted). It is equally well-settled that the Act has no application where other provisions of law specifically address the subject matter concerned. Pennsylvania Bureau of Correction v. United States Marshals Service, 474 U.S. 34, 40-42 (1985). The compelled production of evidence in advance of criminal charges is specifically addressed by Rules 6 and 17 of the Federal Rules of Criminal Procedure, which authorize the issuance and enforcement of grand jury subpoenas; and by 28 U.S.C. § 1826(a), which specifies the authorized penalties for a witness who refuses without good cause to give the evidence demanded by the grand jury.

As it stands now, Doe is still being held in contempt of court for refusing to decrypt his devices for investigators. The district court that held him in contempt has refused direct appeal of that order, resulting in the labyrinthine legal strategy of using the government's case against Doe's devices as a vehicle for challenging the lower court's contempt order.

Doe has not been charged, yet he's in prison. Backing up the government's assertions for holding him in contempt are two dubious pieces of hearsay. One is from his estranged sister, who claims to have seen child porn on Doe's computer, but can't actually say whether it was located on the devices the government is seeking to have decrypted. The other is from some sort of law enforcement encryption whisperer, who can apparently see things in the scrambled bits.

The government’s second witness was Detective Christopher Tankelewicz, a forensic examiner with the Delaware County District Attorney’s Office. He testified only that it was his “best guess” child pornography would be found on the hard drives. (Ex. J at 346). According to Tankelewicz’s understanding of the Freenet online network (in which he admits having no training), there were signs on an Apple Mac Pro computer seized with the hard drives of a user accessing or trying to access message boards with names suggestive of child pornography. (Ex. J at 306, 311-312, 339-340). In rather ambiguous testimony, Tankelewicz did not appear to say this meant any image traded over these boards was on the hard drives. (See Ex. J at 303-317, 336-340, 345-350). Instead, he identified a single image he believed there to be a “possibility” was on the drives. (Ex. J at 308-309). As he described it, the image was of “a four or five-year-old girl with her dress lifted up, but the image itself was small so you really couldn’t see what was going on with the image.” (Ex. J at 308).

No one wants to see a sex offender walk away from charges, but at this point, Doe hasn't even been officially charged with anything more than contempt. The problem with that charge is it has no end date. He can either stay in jail or comply with the order, even when the order conjures jurisdiction out of nowhere and violates his Fifth Amendment rights. If the government doesn't have enough evidence to pursue a case against Doe, it should cut him loose until it does.

Permalink | Comments | Email This Story

Lower courts appear to be taking the Supreme Court's Riley decision seriously -- give or take the occasional "there's no Constitution at the border" decision. If the Supreme Court says there's a warrant requirement for cell phone searches, there's a warrant requirement for cell phone searches.

The Central District of Illinois has just handed down a decision that makes it clear, in no uncertain terms, that any examination of a cell phone's contents, no matter how brief, is a search covered by Riley.

The Pekin Police Department participated in a couple of FBI-assisted controlled buys of weapons and drugs involving defendant Demontae Bell. Shortly thereafter, Bell was arrested.

Upon Bell’s arrest, a black mobile flip phone was located on his person. After Bell was arrested, he was transported to the Peoria Police Department and placed in an interview room. Shortly thereafter, Officer Sinks arrived at the police station (he was not the arresting officer). At the suppression hearing Sinks testified that before interviewing Bell with agent Nixon, he opened the door to the interview room, grabbed Bell’s cell phone from a bag or container outside the door, opened the phone (purportedly to turn it off) and showed the home screen depicting the rifle to Bell with an inquisitive look.

Officer Sinks then powered off the phone. He handed it over to FBI Special Agent Nixon and told him about the photo he had seen. Sinks then removed the phone's battery and recorded the serial number. A little more than a week later, the FBI obtained a warrant to search the phone. Five months later, another search warrant was obtained specifically targeting date/time information related to the photo Officer Sinks saw on Bell's phone.

Seems like a cursory examination of a flip phone would be covered, but Judge James Shadid points out the Supreme Court only allowed warrantless examination of cell phones if there were exigent circumstances or to ensure the phone did not pose a threat to officers (i.e., contain a concealed weapon). The government argued that opening a flip phone is not a "search" and that the photo of a gun the officer saw was in "plain view." The court disagrees, pointing out that "plain view" means "plain view" without law enforcement interaction of any sort.

The government’s response to Bell’s Motion asserts that Officer Sinks’ opening of the flip phone did not constitute a search. While it is true that a “cursory inspection—one that involves merely looking at what is already exposed to view, without disturbing it—is not a ‘search’ for Fourth Amendment purposes,” Officer Sinks’ opening of Bell’s cell phone exceeded a “cursory inspection” because he exposed to view concealed portions of the object—i.e., the screen. See Arizona v. Hicks, 480 U.S. 321, 328-29 (1987). The Supreme Court specifically addressed this issue in Hicks, noting that the “distinction between ‘looking’ at a suspicious object in plain view and ‘moving’ it even a few inches is much more than trivial for purposes of the Fourth Amendment.” Id. at 325. Officer Sinks’ opening of the flip phone, like the officer moving the stereo equipment in Hicks, “exposed to view concealed portions of the [object]” and thus “produced a new invasion of [defendant’s] privacy.”

Even though the court finds Bell to have a diminished expectation of privacy in the home screen of his phone (as opposed to its contents), that's still not enough to ignore the stipulations of the Riley decision. Lock screens or homescreens may only show limited information in relation to the contents of a phone, but they can still display a wealth of information law enforcement can only obtain with a warrant.

The lens through which all information on a cell phone is observed is the screen. On both flip phones and more modern, advanced devices, “notifications” are regularly displayed on the home screen or lock screen indicating text messages, missed calls, and other alerts. The position that the government advances here—that officers can always open a phone and look at the screen to turn the phone off without conducting a “search” at all—is inconsistent with Riley’s requirement that “unlike the search incident to arrest exception, the exigent circumstances exception requires a court to examine whether an emergency justified a warrantless search in each particular case.”

Just as Riley analyzed and rejected California’s attempt to create across the board exceptions, such as a rule allowing police to search call logs, without a warrant, the Court sees no reason to allow law enforcement to circumvent the warrant requirement in every case under the guise that they discovered evidence when they opened the phone or turned on the screen to turn the phone off.

The government attempted to use two exceptions provided by the Riley decision: officer safety and threat of remote destruction of evidence. Both of these arguments are dismissed just as quickly and soundly as the government's "plain view" argument. The court notes that Officer Sink's actions gave no indication he was worried about a concealed weapon or data being wiped from the phone.

In any case, if remote wiping was a concern, officers could have removed the battery without opening the phone, as was clearly demonstrated by Officer Sinks himself.

Officer Feehan testified that the policy was put in place partly because snooping software could be used to listen in on conversations when the phone is turned off but still connected to the battery, and other methods could “compromise data” on the phone. While the procedure may be outdated as applied to modern cell phones that lack removable batteries, that problem was not present here, and the video later showed Officer Sinks removing the battery. Where officers have two equally effective options to turn off a phone, they should choose the less intrusive option. That was not done in this case, and as a result, incriminating evidence was found.

The result is suppression of the evidence specific to the Constitutional violation: the picture of an AK-47 Officer Sinks saw when he opened the phone. Because warrants were obtained for a more thorough search, supported by probable cause unrelated to the photo Sinks saw, the suppressed evidence is pretty much reinstated in whole as the incriminating photo was located on Bell's phone. While it doesn't do much for Bell, it does at least send a message to law enforcement that the Riley decision is to be respected and that cutting corners or skirting around the edges of the ruling won't be tolerated.

Permalink | Comments | Email This Story

Mississippi has 12 grounds for divorce, including impotency, adultery, habitual drunkenness and incurable mental illness. But a bill that would have added domestic violence to the list died in the senate last week.

While so much of the attention had been focused on the case in San Bernardino, where the DOJ was looking to get into Syed Farook's iPhone, we've pointed out that perhaps the more interesting case was the parallel one in NY (which actually started last October), where the magistrate judge James Orenstein rejected the DOJ's use of the All Writs Act to try to force Apple to help unlock the iPhone of Jun Feng, a guy who had already pled guilty on drug charges, but who insisted he did not recall his passcode.

There were some oddities in the case. Feng had pled guilty and there was some issue over whether or not there was still a need to get into the iPhone. The DOJ insisted yes, because Feng's iPhone might provide necessary evidence to find others involved in the drug ring. The other oddity: Feng's iPhone was running iOS7. While the device itself was a newer model iPhone than the one in the Farook case, it still has an older operating system, where it was known that Apple (and others) could easily get in. So it made no sense that the FBI couldn't get into this phone. In fact, Apple's latest filing in the case, just over a week ago was basically along those lines, noting that the DOJ claimed Apple's assistance was "necessary," but that seemed unlikely.

And... late on Friday, the DOJ did the exact same "run away!" move it did in the Farook case, telling the judge that it had suddenly been given the passcode, so there was no need to move forward with the case at all.

The government respectfully submits this letter to update the Court and the parties. Yesterday evening, an individual provided the passcode to the iPhone at issue in this case. Late last night, the government used that passcode by hand and gained access to the iPhone. Accordingly, the government no longer needs Apple’s assistance to unlock the iPhone, and withdraws its application.

According to a (paywalled) WSJ article, Feng, who has been waiting for his sentencing, and thinking that his case was otherwise over, only just found out that there was this big fuss around his own case... and told the DOJ he miraculously remembered the passcode. Hallelujah. A miracle... and the DOJ was magically saved from a precedent it didn't want.

The Wall Street Journal reported last week that Mr. Feng only recently learned his phone had become an issue in a high-stakes legal fight between prosecutors and Apple. Mr. Feng, who has pleaded guilty and is due to be sentenced in the coming weeks, is the one who provided the passcode to investigators, according to people familiar with the matter.

Of course, it's worth noting, however that while this particular case may be effectively over, it's not that great for the DOJ, in that no one got to officially review magistrate judge James Orenstein's fairly epic smackdown of the DOJ earlier in the case. That, of course, has no value as a precedent, but that doesn't mean it won't be quoted or pointed to in other, similar cases.

On the flip side, of course, there's the argument that every time the case starts looking bad for the DOJ, they miraculously get into the phone in question. At the very least, this ought to raise questions about why the DOJ keeps insisting that it needs Apple's help... But the fact is these cases are going to keep coming.

Permalink | Comments | Email This Story

Way back before Ed Snowden became a household name, Senator Ron Wyden kept pushing James Clapper, the Director of National Intelligence, to reveal more details on how the NSA was interpreting certain provisions in the PATRIOT Act to spy on Americans. You probably recall the infamous exchange in a 2013 Senate hearing in which Wyden asked Clapper "does the NSA collect any type of data at all on millions or hundreds of millions of Americans?" and Clapper said "No sir... not wittingly." Snowden himself later noted that this particular exchange was part of what inspired him to leak documents to reporters just a couple months later.

However, that question had some history. Two years earlier, in 2011, we wrote about James Clapper's ridiculous response to a letter from Wyden about this topic. Wyden had asked Clapper to answer some questions about NSA authorities to collect information on Americans and Clapper had refused to answer on the basis of he didn't really want to.

A year later, in the summer of 2012, Wyden got more explicit, saying that he would block the FISA Amendments Act until Clapper gave an estimate of how many Americans had their information sucked up by the NSA. This time, Clapper responded in December of 2012 by saying that it would be impossible to actually say how many Americans had their information scooped up by the NSA. We now know why -- because six months later, Ed Snowden revealed the answer to be "basically everyone." But in December, Clapper sent a letter saying to Wyden:

We cannot provide additional answers to your questions in an unclassified format. Rather than provide you with imprecise, unclassified information, I reiterate our offer to meet with you -- and any other Members of Congress -- in a classified setting to discuss these authorities and answer any questions you might have.

Wyden (along with a few other Senators) pointed out that their question shouldn't reveal anything classified:

First, we asked if any entities have made any estimates -- even imprecise estimates -- about how many US communications have been collected under section 702 of the FISA statute (which is the central provision of the FISA Amendments Act). You did not answer this question. Please provide an answer. We would expect this answer to be unclassified, but if you disagree please provide your reasons for keeping this answer secret.

Second, we asked if it was possible to estimate the order of magnitude of this number. (For example, is the number of US communications collected under section 702 closer to 100. or 100.000. or 100 million?) You did not answer this question directly, however the Director of the NSA has made public statements that appear to estimate this order of magnitude. Specifically, the NSA Director has said that "the story that [the NSA] has millions or hundreds of millions of dossiers on people is absolutely false." Please explain whether this statement should be understood to mean that the number of US communications collected under section 702 is less than "millions or hundreds of millions." Since the NSA Director made this statement publicly, we would expect this answer to be unclassified as well.

Third, we asked if any wholly domestic American communications had been collected under section 702 authorities. Your response was classified. We do not understand how simply stating whether any wholly domestic communications have been collected under section 702 authorities would have any impact at all on US national security interests. if you believe that it would, please explain why. And if you agree that it would not, please provide an unclassified answer to this question.

Fourth, we noted that the FISA Amendments Act does not prohibit searching through communications collected under section 702 to find the communications of particular Americans, and asked if the US government has ever attempted to search for the communications of a specific American in this way without a warrant or emergency authorization. Your response was classified. We do not understand how providing a 'yes' or 'no' answer to this question would impact US national security interests in any way, and we ask that you provide an unclassified response.

Eventually, after getting a lot of pressure from other Senators, Wyden agreed to lift his hold on the bill. At first he offered an Amendment saying he would lift the hold if only the NSA would release a number about how many Americans had their information collected by the NSA. However, with folks like Dianne Feinstein and Saxby Chambliss screaming about how terrorists would blow up everything if the spying didn't continue, the bill eventually passed.

And while some tried to bravely follow up on the questions raised by Wyden, once the bill passed there was no legislative leverage any more -- and nothing much happened. It was just a couple months later that Wyden asked his now famous question and Snowden released his documents.

But a bunch of Representatives on the other side of the Capitol, all members of the House Judiciary Committee, have realized that James Clapper has still never answered the question, and thus they've now sent him a letter, asking him to finally answer at least some sort of question concerning how many Americans have their data sucked up by the NSA:

In order that we may properly evaluate these programs, we write to ask that you provide us with a public estimate of the number of communications or transactions involving United States persons subject to Section 702 surveillance on an annual basis.

We note that we are not the first to ask you for this basic information. Since at least 2011, Senators Ron Wyden and Mark Udall have "sought repeatedly to gain an understanding of how many Americans have had their phone calls or emails collected and reviewed under this statute, but [they] have not been able to obtain even a rough estimate of this number."

They also note that the PCLOB -- the Privacy and Civil Liberties Oversight Board -- that looked into the big NSA surveillance programs suggested that the NSA should reveal this number -- and the NSA and Clapper have ignored this recommendation. As the Reps note, they recognize that Clapper is "reluctant" to provide such information, but...

First, we understand that an exact count of how many United States persons have been swept up into Section 702 surveillance efforts may not be feasible. The leadership of the intelligence community has long held this View, and the Inspector General for the National Security Agency--who is an administrative appointee, and not an independent inspector general--has deferred to your office on this issue. We understand that limited resources and technical barriers may prevent you from making an exact count.

We are not asking you for an exact count. Today, our request is simply for a rough estimate.

You have already demonstrated that such an estimate is feasible. An October 3, 2011 opinion of the Foreign Intelligence Surveillance Court reports that the NSA, in an effort to address the court's concerns about the collection of domestic communications under certain applications of Section 702, "conducted a manual review of a random sample consisting of 50,440 Internet transactions taken from the more than 13.25 million Internet transactions acquired through upstream collection during a six month period." In that case, the court found:

NSA knows with certainty that the upstream collection . . . results in the acquisition of wholly domestic communications.

By expanding its Section 702 acquisitions to include the acquisition of Internet transactions through its upstream collection, NSA has, as a practical matter, circumvented the spirit of [the statute] with regard to that collection.

That case looked at a particular problem with "upstream" collection. A similar but broader analysis may be necessary here. We are willing to work with your office to determine the exact methodology for such a survey. We acknowledge that this estimate will be an imperfect substitute for a more precise accounting--but surely the American public is entitled to some idea of how many of our communications are swept up by these programs.

The letter also addresses another argument that the NSA made previously in response to Wyden's questions: claiming that (get ready for this one) the process to figure out how many Americans' privacy had been violated would... violate their privacy. It's a dumb argument, but perhaps not quite as dumb as it sounds. In short, the NSA wants to argue that it's not doing anything wrong in collecting this information, so long as the searches on the data are within the bounds of the law and the Constitution. Yet, because of that, they want to argue that doing the search to count the records would potentially violate the restrictions on when they can search the data. See? They can't tell you if your privacy has been violated, because to do so would violate your privacy!

In some ways, this is kind of a middle finger to the civil liberties crowd. It's the NSA's smirking response of "see? we can't tell you how much data we have because you put these privacy restrictions on how we can use that data -- and we take your privacy seriously."

But this letter addresses that concern as well, saying that basically no one thinks a "one-time" search solely for the purpose of counting violates anyone's privacy:

Second, we understand that producing an estimate might require reviewing actual communications acquired under Section 702, which could itself raise privacy concerns. On this point, we refer you to the judgment of the many civil liberties organizations that support conducting "a one-time, limited sampling of these communications," if necessary. They believe it would be "a net gain for privacy if conducted under appropriate safeguards and conditions." We agree, and we are willing to work with your office to implement those safeguards if necessary. This, too, is a problem we can solve.

And, finally, they close with a stick, reminding Clapper that this entire program is scheduled to sunset at the end of December, 2017, and if he wants the FISA 702 program (which covers both PRISM and upstream collection) to continue, he might want to actually respond.

The letter is then signed by 14 members of the House Judiciary Committee. It's not everyone, but it's a pretty good list of folks, including some of the more powerful members, including ranking member John Conyers and the author of the PATRIOT Act and the USA Freedom Act, Jim Sensenbrenner. Other signatories include Reps. Zoe Lofgren, Darrell Issa, Blake Farenthold, Jason Chaffetz, Jim Jordan, Ted Deutch, Suzan Delbene, Ted Poe, Hank Johnson, Jerry Nadler and David Cicilline. This is not just a pointless letter dashed off by one or two Reps. It's a big chunk of the Judiciary Committee (less than half, but still a significant amount).

I'm sure that Clapper will do his best to avoid actually answering, but at the very least it sets up what appears to be the next big fight on the horizon: over the renewal of Section 702.

Permalink | Comments | Email This Story

Freedom of Information Act (FOIA) requests are a popular topic here on Techdirt. We've discussed how important FOIA rules are... and how the government seems to go out of its way to try to ignore both the letter and spirit of the law. Because that's just how secretive governments act. However, it's certainly true that some FOIA requests are a little more ridiculous than others. Take, for example, Refinery29 reporter Vanessa Golembewski's amusing decision to file a FOIA request for Game of Thrones Screeners after finding out that the producers have been sending advance screeners to President Obama. Showrunners David Benioff and Dan Weiss admitted in an interview that they sent the screeners:

“I think, for both of us, finding out the President wanted advanced copies of the episodes was an ‘ah-ha’ moment,” Weiss said. “That was a very strange moment.”

And did they say yes?

“Yes,” Weiss replied. “He’s the leader of the free world.”

Benioff added: “When the commander-in-chief says, ‘I want to see advanced episodes,’ what are you gonna do?”

So Golembewski decided that if the President had them, she could (and should!) FOIA them:

I decided this was a perfect opportunity to test the limits of the Freedom Of Information Act. If the president — and by extension, our government — is in possession of a file, surely that file is subject to my request to see it as a U.S. citizen.

Golembewski is pretty upfront in recognizing the chances of this actually working are slim to none, but still decided to go through with the process. Of course, it's going to get rejected. In fact, we've seen similar requests in the past. Back in 2013, we wrote about a (more legit) attempt to FOIA the backing track to Beyonce's rendition of the Star Spangled Banner at the inauguration. The composition was in the public domain, and the performance, recorded by the Marine Corps. Band, should also be public domain, as it's a work of the federal government, which is not subject to copyright.

And, indeed, the government did provide the music in question, but also warned that some of the other songs that were sent may have other copyright issues. More importantly, the government flat out rejected the request for any Beyonce related music, noting that the copyright was held by her, and not the government: "Please note that Ms. Beyonce Knowles-Carter's vocals/music do not belong to the Marine Corps. Therefore, you will have to send your request directly to Ms. Knowles-Carter's attorney..." Though, they did helpfully provide that attorney's name and contact info. I imagine that Golembewski may receive a similar note, since the President does not also get the copyright in those screeners.

Permalink | Comments | Email This Story

This is a video of Maisie Williams (Arya Stark) pranking Game Of Throne fans (who came for a Game Of Thrones giveaway) at a hobby store in Santa Monica, California by pretending she's a clerk named Loraine. In order to score some free Game Of Thrones swag she makes them act out scenes from the show. The highlights are 1) the first guy who walks in that we never see again for the rest of the video, presumably because he ran out to furiously write a love letter on his dashboard and 2) the older lady in the purple jacket pretending to be a dragon at the end. What a beautiful creature. She may actually be somebody's grandma, but she'll always be a terrifying, fire-breathing dragon to me. Keep going for the video. Thanks to Ryan L, who tried to tell me he ran into Jon Snow in the frozen food aisle of the grocery store once.

Last summer, we wrote a bit about the Regional Comprehensive Economic Partnership (RCEP), a trade agreement that is being worked on by a bunch of Asian countries, and which is often described as an "anti-TPP" or, at the very least, a competitor to the TPP. It's being driven by China and India -- two countries who were not in the TPP process. Given how concerned we were with the TPP, we had hoped, at the very least, that RCEP would be better on things like intellectual property. Unfortunately, some early leaks suggested it was even worse. And while the TPP is still grinding through the ratification process in various countries, RCEP has continued to move forward, and the bad ideas have stuck around.

Knowledge Ecology International just released a leaked copy of the agreement's draft intellectual property chapter, and it's basically chock full of bad ideas. As KEI's Jamie Love notes:

The RCEP will be a massive trade agreement and the content of the IP Chapter is important. It will bind India and China, two countries left out of the TPP. Japan and Korea are trying to push many of the worst ideas from ACTA, TPP and other trade agreements into the RCEP IP Chapter. Some of the issues that negotiators did not understand in the TPP, such as the damages provisions, are also lurking in this text, creating risks that negotiators will do worse than they think, because the secrecy of the negotiations insulates the negotiators from timely feedback on technically complex issues. Japan and Korea are pushing for test data monopolies, without the same safeguards available to patent monopolies. There are proposals for patent extensions, restrictive rules on exceptions to copyright, and dozens of other anti-consumer measures, illustrating the power of right-holder groups to use secret trade negotiations to limit democratic decisions that impact access to knowledge, the freedom to innovate and the right to health, in negative ways.

The TPP is not good on intellectual property (at all). But seeing RCEP apparently be just as bad, if not worse, is not exactly encouraging. As I've said in the past, I think free trade is an important ideal, but free trade agreements are increasingly about something entirely different, and it's about backdoor (and backroom) mechanisms for putting in place regulatory frameworks that favor certain legacy players.

Permalink | Comments | Email This Story

One of central claims made by supporters of corporate sovereignty chapters in trade deals is that companies "need" this ability to sue the government in special tribunals. The argument is that if the extra-judicial investor-state dispute settlement (ISDS) framework is not available to a company, it will be defenseless when confronted with a bullying government. A new case in Australia shows why that's not true. A column in The Sydney Morning Herald provides the background, which concerns a US company called Nucoal:

In 2013, the NSW [New South Wales] Independent Commission against Corruption found that there had been corrupt conduct relating to the granting of mining licences to Nucoal and other mining companies and the NSW government cancelled the licences.

Naturally, Nucoal unleashed its lawyers:

[Nucoal] demanded compensation of more than $900 million in Australia's High Court, claiming the decision to cancel its licence without compensation was unconstitutional and had reduced the value of the company. The High Court found in April 2015 that under Australian law Nucoal was not entitled to compensation.

Now Nucoal had a problem. Normally, a company in this situation would invoke the corporate sovereignty chapter in a relevant trade deal, and move the case to secret ISDS tribunals, which were likely to be more favorable to its cause than the independent national courts. But with unusual foresight, Australia refused to accept ISDS in the 2004 AUSFTA trade agreement between the US and Australia -- which makes its decision to acquiesce to ISDS in TPP doubly foolish. Despite what fans of corporate sovereignty claim, Nucoal still has another option at this point:

Nucoal is pressuring the US government to put a case to the Australian government that the denial of compensation has violated the general investment terms of the [AUSFTA] agreement. This could result in a formal complaint from the US government demanding trade sanctions against the Australian government.

Last week The Australian reported that the CEO of the US Chamber of Commerce in Australia has announced that the US government will raise the issue in a closed-door review of the AUSFTA to be held in May.

That is, unable to avail itself of the investor-state dispute mechanism, Nucoal now wants to take advantage of the state-state dispute settlement process (pdf) whereby the US government formally complains to the other government concerned. Now, whether the US government should really be taking up a case involving corruption is another question. The key point is that it is not absolutely necessary to include corporate sovereignty provisions in a trade deal to protect companies, because there is always the state-to-state mechanism that can be invoked if necessary.

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Permalink | Comments | Email This Story

More about Psychology, Science, Grammar, Books, and Entertainment

From net neutrality to municipal broadband, to new broadband privacy rules and a quest to open up the cable set top box to competition, we've noted repeatedly that the FCC under Tom Wheeler isn't the same FCC we've learned to grumble about over the years. For a twenty-year stretch, regardless of party control, the agency was utterly, dismally apathetic to the lack of competition in the broadband space. But under Wheeler, the FCC has not only made broadband competition a priority, but has engaged in other bizarre, uncharacteristic behaviors -- like using actual real-world data to influence policy decisions.

Obviously, this doesn't please incumbent telecom operators like AT&T, Verizon and Comcast, who grew pretty comfortable with an FCC that asked "how high" when commanded to jump. The reality is that this is just what it looks like when a regulator does its job and tries to fix a very broken market. But incapable of admitting the broadband market's horribly broken, the telecom industry instead seems intent on pointing fingers elsewhere. In a strange story over at Politico, broadband providers blame Google for absolutely everything the FCC has been up to.

The quest to open the set top box, the quest for more unlicensed spectrum, and the quest for better consumer privacy controls? All the fault of Alphabet and Google:

The cable industry-led Future of TV Coalition earlier this year suggested Google had "a sneak preview" of the FCC’s February plan to open up the set-top box market to new competitors. The move would require pay-TV companies to make their content streams available to third parties that want to build and sell their own boxes — a move that cable firms say is designed to benefit Google, which has already demonstrated a prototype cable box to regulators.

AT&T, meanwhile, has charged that the agency is placing its "thumb on the scale" in favor of Google via Wheeler's March proposal to impose strict privacy rules on broadband companies. The plan, according to AT&T and others, would put telecom firms at a disadvantage compared with Internet companies like Google, which wouldn't fall under the FCC rules. Internet firms' privacy practices are policed by the Federal Trade Commission, which is seen as less prescriptive.

On another front, the National Association of Broadcasters argued that Google led a behind-the-scenes push at the FCC to set aside more unlicensed airwaves — something that could boost Wi-Fi networks that support the company's products and services. NAB says this FCC set-aside allows Google to avoid having to pay for spectrum during the FCC's current incentive auction.

The telecom industry taking pot shots at Google is certainly nothing new; in fact the net neutrality debate basically began in 2005 when then AT&T CEO Ed Whitacre proudly proclaimed that Google wouldn't be able to "ride his pipes for free." Traditionally though, the telecom industry has used third-party consultants, think tanks, and other policy tendrils to hurl strange attacks at Google. These new, more direct attacks are a sign of increased desperation.

This desperation originates with two things, one of them being Google Fiber. Though admittedly still limited in reach, Google Fiber has managed to light a fire under the apathetic posteriors of telecom giants that previously had little to no impetus to upgrade networks. It has managed to generate a national conversation about the sorry state of broadband competition, and even managed to illuminate the telecom sector's love of state protectionist laws that prevent community broadband and even public/private partnerships. In short, the broadband industry's mostly just pissed that they're now facing some competition (which is why they've resorted to lawsuits to slow Google Fiber's expansion).

The other thing on telecom executives' minds is the fact that with the broadband market saturated, they're turning to advertising and content to try and attain quarterly growth. That's why Verizon's been gobbling up companies like AOL and blowing kisses at Millennials in a quest to magically become the new Facebook or Google. But these ISPs face new neutrality and privacy regulations that Google doesn't have to worry about, solely because there's no competition in the broadband space (read: you have a choice in search engines, but often not in ISPs). This lack of competition isn't Google's fault. It's the fault of the carriers themselves and generations of lobbying.

The telecom industry has invited the wrath of regulators for years with a laundry list of bad behavior. The FCC's privacy rules weren't driven by Google, they were driven by Verizon's decision to use stealth cookies users couldn't opt out of to covertly track customers around the Internet. Net neutrality wasn't created by Google, it was created thanks to AT&T threatening to charge Google a "just because we can" toll. And while Google has lobbied to open up the cable set top box to competition, this idea is actually more than a decade old, driven primarily by the fact that the industry enjoys $20 billion in captive revenue thanks to absolutely no serious cable set top hardware competition whatsoever.

Yes, Google and Alphabet have become lobbying behemoths since Google first started ramping up its lobbying apparatus around 2007. And yes, like any large company, Google spends a good amount of its time lobbying to saddle the other guy with additional regulations -- something that will only increase as the company inevitably shifts from innovation to turf protection. And we've already started to witness this turn; most notably in the way Google turned its back on net neutrality in the States and abroad the last few years.

A saint Google isn't, but to suggest that the FCC is suddenly doing its job entirely because of Google lobbying borders on the comical, especially coming from an industry that has had its lobbying talons deep in the federal government for more than a generation. It's much the same way that ISPs and their loyal politicians have taken to attacking Netflix for daring to criticize usage caps and standing up for net neutrality. It's snide hubris from a sector that can't come to terms with the fact that a generation of telecom regulatory capture is finally starting to crumble. Instead of adapting to shifting markets, the telecom sector would rather blame "big tech" for a firestorm of regulatory activity it brought down upon itself.

Permalink | Comments | Email This Story

As we've discussed at length, there are multiple cases going on right now in which the US Justice Department is looking to compel Apple to help access encrypted information on iPhones. There was lots of attention paid to the one in San Bernardino, around Syed Farook's work iPhone, but that case is now over. The one getting almost but not quite as much attention is the one happening across the country in NY, where magistrate judge James Orenstein ruled against the DOJ a little over a month ago, with a very detailed explanation for why the All Writs Act clearly did not apply. The DOJ, not surprisingly, appealed that ruling (technically made a "renewed application" rather than an appeal) to an Article III judge and the case was assigned to judge Margo Brodie.

Apple has now filed its argument against the DOJ, making a variety of points, but hitting hard on the idea that the DOJ is flat out lying in now claiming that Apple's assistance in unlocking this phone is "necessary." As we've noted, the end result of the San Bernardino case, where the FBI eventually "figured out" how to get into the phone, raises questions about whether it truly exhausted all possibilities in this case -- which involves a newer phone, but an older operating system.

... the record is devoid of evidence that Apple’s assistance is necessary—and remains so even after a similar claim of necessity was proven untrue in a recent proceeding in California. Indeed, in its original application to Judge Orenstein, the government acknowledged that it sought Apple’s help to spare the government from having to expend “significant resources.”...

[....]

The government has made no showing that it has exhausted alternative means for extracting data from the iPhone at issue here, either by making a serious attempt to obtain the passcode from the individual defendant who set it in the first place—nor to obtain passcode hints or other helpful information from the defendant—or by consulting other government agencies and third parties known to the government. Indeed, the government has gone so far as to claim that it has no obligation to do so... notwithstanding media reports that suggest that companies already offer commercial solutions capable of accessing data from phones running iOS 7, which is nearly three years old.

And, of course, Apple suggests (as it has all along) that the DOJ is totally misreading and/or misrepresenting the All Writs Act:

The government would have this Court believe that the All Writs Act, first enacted in 1789, is a boundless grant of authority that permits courts to enter any order the government seeks—including orders conscripting private third parties into providing whatever assistance law enforcement deems appropriate—as long as Congress has not expressly prohibited its issuance. DE 30 at 18. But that characterization of the All Writs Act turns our system of limited government on its head. It simply is not the case that federal courts can issue any order the executive branch dreams up unless and until Congress expressly prohibits it. That construction of the All Writs Act has it exactly backwards. If the government’s view is correct, Congress would never need to pass permissive legislation in the law enforcement context because everything would be on the table until explicitly prohibited. That may be what the government prefers, but it is not the legal system in which it operates.

The company also questions whether or not it's really necessary for the government to get into this phone, given that the defendant in the case, Jun Feng, has already pled guilty and the phone hasn't been used in years. Also, the government didn't even seek a warrant to get into the phone for over a year after seizing it.

Apple also raises some procedural concerns. As noted above, the government just asked for a new judge to review, rather than doing an official appeal, and Apple points out that it's doing this to try to avoid certain standards:

In its papers, the government takes great pains to characterize its brief as a renewed application rather than an appeal from Judge Orenstein’s order, presumably to bolster its contention that Judge Orenstein’s order should be reviewed de novo.... In doing so, the government attempts to obscure the fact that this matter was extensively briefed, a hearing was held, supplemental briefing was provided, and Judge Orenstein issued a 50-page order. Moreover, the government’s insistence that it is entitled to a do-over is belied by Federal Rule of Criminal Procedure 59 and Section 636 of the Federal Magistrates Act.

One of the key points made by the DOJ in its filing in this case was that Apple had been fine with previous such All Writs Act orders on phones running iOS 7, where it does have more access to information. But Apple notes that the details of this case are different in important ways: this is the first case where the judge specifically brought Apple into court, rather than ruling without Apple being involved at all (i.e. "ex parte").

To be sure, courts have previously issued ex parte orders directing Apple to “assist in extracting data from an Apple device through bypassing the passcode in order to execute a search warrant.” But the government’s cited orders were issued ex parte, without Apple’s participation, without the benefit of adversarial briefing on the scope of the All Writs Act, and with no supporting analysis. Apple also was not a party in United States v. Blake, No. 13-CR-80054 (S.D. Fl. July 14, 2014), in which the court denied the defendant’s motion to suppress evidence gathered from an iPhone that Apple helped unlock. Accordingly, such cases are not even persuasive authority on the scope of the All Writs Act, let alone precedential; certainly such ex parte orders issued with little analysis should carry less weight than Judge Orenstein’s lengthy and reasoned opinion.

Most of the other arguments cover things discussed earlier, around why the All Writs Act doesn't apply and why CALEA covers this situation and does not require Apple to assist.

So, while the San Bernardino case may be over, the NY case is still raging. I imagine the DOJ's next filing will be... interesting as well.

Permalink | Comments | Email This Story

Last week, we wrote about a "discussion draft" of Senators Richard Burr and Dianne Feinstein's new anti-encryption bill that would effectively require any company doing anything with encryption to make sure that encryption was flat out broken, putting everyone at risk. Feinstein and Burr's offices refused to comment on the criticism of the draft, insisting that they were still working on the bill. Well, late Wednesday Burr officially released a copy of the bill and it's basically the same insane bill we saw last week. As far as I can tell, the only real change is further defining what is meant by a "court order." It used to just say any court order, but now says only court orders for specific issues, but it's a pretty broad list: crimes involving serious bodily harm, foreign intelligence, espionage, terrorism, sexual exploitation of a minor, a "serious violent felony," or a serious drug crime. So, I guess we should feel relieved that it won't be used for cases where someone's caught trespassing or something? It's still a ridiculous bill (and it still doesn't explain what the penalties are).

Meanwhile, Senator Ron Wyden has renewed his opposition to the bill by going a step further and promising to filibuster if the bill is brought to the floor:

“The encryption debate is about having more security or having less security. This legislation would effectively outlaw Americans from protecting themselves. It would ban the strongest types of encryption and undermine the foundation of cybersecurity for millions of Americans. This flawed bill would leave Americans more vulnerable to stalkers, identity thieves, foreign hackers and criminals. And yet it will not make us safer from terrorists or other threats. Bad actors will continue to have access to encryption, from hundreds of sources overseas. Furthermore, this bill will empower repressive regimes to enact similar laws and crack down on persecuted minorities around the world,” Wyden said.

“Americans who value their security and liberty must join together to oppose this dangerous proposal. I intend to oppose this bill in committee and if it reaches the Senate floor, I will filibuster it.”

Stay tuned, because this fight is just beginning...

Permalink | Comments | Email This Story

These are a few shots from Eating E.T., a "hands-on exploration of our intimate relations to other species, real and fictional." The all-vegan alien was made and barbecued to provoke discussion about human's eating practices, what's ethical, what isn't, and what just downright tastes delicious. Fried okra, that's what. I've broken up with girlfriends for not liking it. Olives too. These are important things to me. "What about communication?" Butterfly kisses only.

What would it feel like to eat an alien? How can we dearly love and grieve some non-human species while accepting the industrialised slaughter of others? How can we cater to the needs of eaters who seek a surrogate for the sacrificial and ritual aspects of convivial, meat-based, barbecues? What are our ethical responsibilities towards fictional organisms?

First of all, it would probably feel pretty weird to eat an alien. There's no telling what kind of space cancer those things are packed with. Secondly, I doubt anybody will ever actually get the chance to eat an alien, because if the aliens are smart and technologically advanced enough to be able to travel to earth, I've got the feeling if anybody is gonna get eaten it's gonna be us. Or you rather, just one look through their bug eyes and they'll be able to tell I'd taste like shit. Keep going for a couple more shots of of the alien roast. Thanks to Melissa D, who knows what Ewok tastes like.

Blackberry's CEO, John Chen, didn't care for the fact that Apple was "locking" law enforcement out of its devices by providing customers with default encryption. As he saw it, Apple was placing profits ahead of Mom, Apple pie and American-made motorcars.

For years, government officials have pleaded to the technology industry for help yet have been met with disdain. In fact, one of the world's most powerful tech companies recently refused a lawful access request in an investigation of a known drug dealer because doing so would "substantially tarnish the brand" of the company. We are indeed in a dark place when companies put their reputations above the greater good.

Chen refused to "extend privacy to criminals." How he had any way of knowing who was or wasn't a criminal at the point of sale was not detailed in his rant.

Then news surfaced that Dutch law enforcement could bypass Blackberry encryption with seeming impunity. At that point, Blackberry became defensive about its new stature as the least secure smartphone option. It claimed in a blog post that its stock phones were not open books for the world's law enforcement agencies. Despite promising earlier that the company would not aid criminals in keeping their secrets from law enforcement, Blackberry heatedly claimed its devices were secure as ever -- even in the hands of criminals.

[T]here are no backdoors in any BlackBerry devices, and BlackBerry does not store and therefore cannot share BlackBerry device passwords with law enforcement or anyone else.

Ah, but there is a backdoor. A big one. And it's on the opposite side of the "house." Motherboard is reporting that the Royal Canadian Mounted Police are able to access unencrypted communications thanks to the Blackberry's built-in "feature."

Imagine for a moment that everybody's front door has the same key. Now imagine that the police have a copy of that key, and can saunter into your living room to poke around your belongings while you're out, and without your knowledge.

By way of metaphor, this is exactly how the Royal Canadian Mounted Police, Canada's federal police force, intercepted and decrypted "over one million" BlackBerry messages during an investigation into a mafia slaying, called “Project Clemenza," that ran between 2010 and 2012.

Citizen Lab privacy expert Christopher Parsons backs up Motherboard's analogy. [emphasis in the original]

In addition to routing and compressing data traffic, RIM's service offerings also include a measure of security in excess of the practices adopted by their competitors. BBM, as an example, is encrypted. However, it is encrypted using a global key. RIM has written that,

"The BlackBerry device scrambles PIN messages using the PIN encryption key. By default, each BlackBerry device uses a global PIN encryption key, which allows the BlackBerry device to decrypt every PIN message that the BlackBerry device receives."

This means that RIM can decrypt consumers' messages that are encrypted with the global key. Consumer devices include all RIM offerings that are not integrated with a BlackBerry Enterprise Server (BES). The BES lets administrators change the encryption key, which prevents RIM from using the global decryption key to get at the plaintext of BES-secured communication.

Blackberry may be technically correct when it asserts it has no access to user passwords. But that hardly matters when it holds the key that can decrypt any BBM communications that pass through its service (with the exception of administrator-level business accounts). This single key's access to unencrypted communications is likely what allowed (and possibly still allows) the RCMP to obtain plaintext messages.

According to the documents obtained by Motherboard, the RCMP appears to be using some sort of Stingray-but-for-BBM technology to intercept and decrypt messages.

[The RCMP maintains a server in Ottawa that "simulates a mobile device that receives a message intended for [the rightful recipient]." In an affidavit, RCMP sergeant Patrick Boismenu states that the server "performs the decryption of the message using the appropriate decryption key." The RCMP calls this the "BlackBerry interception and processing system."

By inserting itself into the middle of communications, the RCMP can intercept the messages. Access to the Golden Key ensures they can be read. The conclusion reached by both the defense team and the judge presiding over the case? The RCMP has Blackberry's global encryption key.

The defence in the case surmised that the RCMP must have used the "correct global encryption key," since any attempt to apply a key other than BlackBerry's own global encryption key would have resulted in a garbled mess. According to the judge, "all parties"—including the Crown—agree that "the RCMP would have had the correct global key when it decrypted messages during its investigation."

Unfortunately, there aren't many more details. Many of the documents related to this case remain under seal and the RCMP certainly isn't going to discuss its interception/decryption secrets if it doesn't have to. It could very well be that it demanded (and obtained) the key from Blackberry, much in the way the FBI demanded Lavabit's SSL key. If so, Blackberry was far more cooperative than Lavabit, which chose to shut down the service rather than allow the government to have total access. (And it has been hinted by the DOJ that this sort of request may be headed Apple's way if it continues to fight its All Writs orders.)

Somewhat ironically, the RCMP acknowledged in court that outing a cellphone provider as Junior G-Men would probably tarnish Blackberry's reputation -- basically the same thing Blackberry CEO John Chen claimed was the height of Apple impudence

RCMP inspector Mark Flynn testified in a heavily redacted transcript that BlackBerry "facilitated the interception process," however, Flynn also stated that facilitation could mean mere information sharing or a physical action to aid interception.

Flynn further testified that revealing the key would jeopardize the RCMP's working relationship with BlackBerry, and harm BlackBerry itself, since "it is not a good marketing thing to say we work with the police."

The question now is whether the RCMP still has this level of access. To cut off the RCMP, Blackberry would have needed to alter the global decryption key -- something that would have required "a massive update... on [a] per-handset basis," according to Citizen Lab's Christopher Parsons. And if Canada's law enforcement has it (or had it), odds are law enforcement agencies in other countries had similar access. Investigators may not be keen to expose techniques in court or in released documents, but they're usually pretty good about sharing this info with like-minded law enforcement agencies.

Permalink | Comments | Email This Story