Shared posts

07 Sep 01:14

United Airlines Made Its App Stop Working On My Phone, And What This Says About How Broken The Mobile Tech Space Is

by Cathy Gellis
Brindle

United is the best airline!

This post isn't really about United Airlines, but let's start there because it's still due plenty of criticism.

One day my phone updated the United App. I forget if I had trusted it to auto-update, or if I'd manually accepted the update (which I usually do only after reviewing what's been changed in the new version), but in any case, suddenly I found that it wasn't working. I waited a few days to see if it was a transient problem, but it still wouldn't work. So I decided to uninstall and reinstall, and that's where I ran into a wall: it wouldn't download, because Google Play said the new version wasn't compatible with my phone.

Wait, what? It used to run just fine. So I tweeted at United, which first responded in a surprisingly condescending and unhelpful way.

Sometime later I tweeted again, and this time the rep at least took the inquiry seriously. Apparently United had made the affirmative choice to stop supporting my Android version. And apparently it made this decision without actually telling anyone (like, any of their customers still running that version, who might not have updated if they knew they would have to BUY A NEW PHONE if they wanted to keep running it).

Ranting about this on Twitter then led to an interesting argument about what is actually wrong with this situation.

But let's not let United off the hook too soon. First, even if United were justified in ceasing to support an Android 4.x capable app, it should have clearly communicated this to the customers with 4.x phones. Perhaps we could have refused the update, but even if not, at least we would have known what happened and not wasted time troubleshooting. Plus we would have had some idea of how much United valued our business...

Second, one of the points raised in United's defense is that it is expensive to have to support older versions of software. True, but if United wants to pursue the business strategy of driving its customers to its app as a way of managing that relationship, then it will need to figure out how to budget for maintaining that relationship with all of its customers, or at least those whose business it wants to keep. If providing support for older phones is too expensive, then it should reconsider the business decision of driving everyone to the app in the first place. It shouldn't make customers subsidize this business decision by forcing them to invest in new equipment.

And then there was the third and most troubling point raised in United's defense, which is that Android 4.x is a ticking time bomb of hackable horror, and that any device still running it should be cast out of our lives as soon as possible. According to this argument, for United to continue to allow people to use their app on a 4.x Android device would be akin to malpractice, and possibly not even be allowed per their payment provider agreements.

At this point we'll stop talking to United, because the problem is no longer about them. Let's assume that the security researchers making this argument are right about the vulnerability of 4.x and its lack of support.

The reality is, THE PHONES STILL WORK. They dial calls. They surf the web. They show movies. Display ebooks. Give directions. Hold information. Sure, at some point the hardware will fail. But for those wrapped in good cases that have managed to avoid plunging into the bath, there's no reason they couldn't continue to chug on for years. Maybe even decades. In fact, the first thing to go may be the battery – although, thanks to them often not being removable, this failure would doom the rest of the device to becoming e-waste. But why should it be doomed to becoming e-waste a moment before it actually becomes an unusable thing? Today these phones are still usable, and people use them, because it is simply not viable for most people to spend several hundred dollars every few years to get a new one.

And yet, in this mobile ecosystem, they'll need to. Not only to keep running the software they depend on, but to be able to use the devices safely. The mere ability to function no longer is enough to delineate a working device from a non-working one. The difference between a working device and a piece of trash is what the OS manufacturer deems it. Because when it says it's done maintaining the OS, then the only proper place for a phone that runs it is a landfill.

It is neither economically nor environmentally sustainable for mobile phones to have such artificially short lifespans. "Your phone was released in 2013!" someone told me, as if I'd somehow excavated it from some ancient ruin and turned it on. It's a perfectly modern device (in fact, this particular phone in my possession came into use far more recently than 2013), still holds a reasonable charge, and is perfectly usable for all the things I use it for (well, except the United app...). So what do you mean that I can't use it? Or that any of the other millions if not billions of people in the world running Android 4.x phones can't use them?

There are lots of fingers to point in this unacceptable state of affairs. At app makers who refuse to support older OSes. At app makers who make us use apps at all, instead of mobile web applications, since one of the whole points of the Web in the first place was to make sure that information sharing would not be device- or OS-dependent. At carriers who bake the OS into their phones in such a way that we become dependent on them to allow us OS updates. At the OS manufacturers who release these systems into the wild with no intention of supporting them beyond just a few years. And to various legal regimes (I'm looking at you, copyright law…) that prevent third parties from stepping in to provide the support the OEM providers refuse to anymore. Obviously there are some tricky issues with having a maintenance aftermarket given concerns with authentication, etc., but we aren't even trying to solve them. We aren't doing anything at all, except damning the public to either throw good money after bad for new devices that will suffer the same premature fate, or to continue to walk around with insecure garbage in their pockets. And neither is ok.



Permalink | Comments | Email This Story
06 Sep 15:39

Five Eyes Surveillance Agencies Say Encryption Is Good, Except When It Keeps Them From Looking At Stuff

by Tim Cushing

The Five Eyes nations -- UK, US, Australia, Canada, and New Zealand -- still think there's a way to create encryption backdoors (that they studiously avoid calling backdoors) that will let the good people in and the bad people out.

The backlash against government calls for backdoors has made these demands a bit more subdued in most Five Eyes countries. The UK government really doesn't seem to care and uses every terrorist attack as another reason to prevent law-abiding citizens from using secure encryption for their communications. Others members have taken a more measured approach, talking around the subject while legislative inroads continue unabated.

In the US, the periodic "going dark" discussions have taken on a (no pun intended) darkly comical tone as FBI and DOJ officials continue to claim harder nerding with solve the "problem" it has misrepresented for years.

The countries may be taking different approaches to undermining encryption, but they're all still looking to do this in the future if they can just find a way to sell it to the public without the actual nerds speaking up and ruining all their plans. The Register notes the Five Eyes surveillance partnership has delivered another ultimatum (that it won't call an ultimatum) about encrypted communications following a meeting in Australia. But it is taking care to couch its wants and desires in pretty words about the safety and security of the general public.

In an official communiqué on the confab, they claim that their inability to lawfully access encrypted content risks undermining democratic justice systems – and issue a veiled warning to industry.

The group is careful to avoid previous criticisms about their desire for backdoors and so-called magic thinking – saying that they have "no interest or intention to weaken encryption mechanisms" – and emphasise the importance of privacy laws.

But the thrust of a separate framework for their plans, the Statement of Principles on Access to Evidence and Encryption, will do little to persuade anyone that the agencies have changed their opinions.

"Privacy laws must prevent arbitrary or unlawful interference, but privacy is not absolute," the document stated.

And there it is. The only thing Five Eyes considers "absolute" is its supposed "right" to access contents of devices and communications. First, the confab talks about "mutual" cooperation, as though the tech industry is being unnecessarily resistant to undermining protections it provides to users. Five Eyes may not have the strength of conviction to actually demand encryption backdoors, but the wording here indicates what it wants is pretty much just a backdoor.

Providers of information and communications technology and services - carriers, device manufacturers or over-the-top service providers -– are subject to the law, which can include requirements to assist authorities to lawfully access data, including the content of communications. Safe and secure communities benefit citizens and the companies that operate within them.

This means key escrow or having encryption removed during transit so service providers can access contents of communications. Nothing about either plan makes users safer or less accessible to malicious parties not associated with the Five Eyes partnership.

The next section's headline makes it clear who's going to be answering to who:

Rule of law and due process are paramount

In other words, if you've got a warrant, I guess you're gonna come in I'll let you in. This appeal to authority says providers must subject themselves to pestering governments, even if it means harming their entire userbase just so the government can go after a few users. The nod to due process really means nothing, what with indefinite gag orders accompanying demands for communications and data, and an ongoing refusal by government agencies to discuss surveillance means and methods in open court. As long as parallel construction is still a thing, due process will never be given the respect it deserves.

So, Five Eyes may be trying to make it sound like the countries agree encryption is a valuable protection for its collective citizens, but what it really wants is the protection to be weakened to the point law enforcement -- and anyone else not governed by the rule of law -- can access it at will. No one's saying "backdoor," but they're all thinking it very loudly.



Permalink | Comments | Email This Story
06 Sep 15:29

The NSA Continues to Blame Technology for Breaking the Law

by David Ruiz

UPDATE September 14, 2018: This blog has been updated at the bottom to include information about two Senators’ reactions to the NSA’s call detail record deletion.

In late June, the NSA announced a magic trick—hundreds of millions of collected call records would disappear. Its lovely assistant? Straight from the agency’s statement: “Technical irregularities.”

These “technical irregularities” are part of a broad and troubling pattern within the NSA—it has repeatedly blamed its failure to comply with federal laws on technical problems purportedly beyond its control. EFF has a long history of criticizing Congress for giving the NSA broad authority for its surveillance programs, but allowing the NSA to flout what limits Congress has put on the programs because of vague “technical” issues is wholly unacceptable. If the NSA can’t get its technology in order, Congress should question whether the NSA should be conducting mass surveillance at all.

For example, the NSA is currently required to report numbers called “unique identifiers” in a transparency report compiled annually by the agency’s Office of the Inspector General (OIG). These numbers could help the public understand just how many Americans are burdened by NSA surveillance. But the NSA didn’t report the numbers this year, or the two years prior, because, according to the report, “the government does not have the technical ability.”

And in May 2018, the agency discovered that its massive telephone metadata surveillance program was surveilling too massively. During call detail record collection authorized under Section 215 of the Patriot Act, as amended by the USA Freedom Act of 2015, the NSA said it also collected records that it had no legal authority to obtain. Countless records were, in effect, illegally collected and stored for years. The NSA blamed this on “technical irregularities.”

The same “technical irregularities” that led to improper data collection also made it impossible to separate improperly collected call records from properly collected ones, the NSA claimed. Apparently unable to disentangle this techno-Gordian knot, the agency decided to just throw the whole thing out. All 685 million call detail records collected from telecommunications companies since 2015 would be deleted, the agency said. (Confusingly, even though the NSA said it found this problem “several months” prior, it waited until late May to act—and then took another month to tell the public what happened.)

Something is clearly amiss here. The NSA has repeatedly insisted to the American public and Congress that these call records are necessary for “national security,” and yet, the agency’s solution to discovering the over-collection was to delete everything it had grabbed for the past three years.

The NSA may blame its computer systems, but Senator Ron Wyden (D-OR), who sits on the Senate Select Committee on Intelligence, does not. Sen. Wyden instead blamed telecommunication providers for the over-collection, telling the New York Times:

“Telecom companies hold vast amounts of private data on Americans. This incident shows these companies acted with unacceptable carelessness, and failed to comply with the law when they shared customers’ sensitive data with the government.”

Because the NSA only offered a sparse, uninformative public statement, many questions are left unanswered. What technical problem did the agency actually discover? What was its root cause? How did the NSA originally identify the problem, and why did it take three years to find it? Considering Sen. Wyden’s comments, who is at fault for the over-collection? The companies? The NSA? Both?

Let’s not get lost here. Whether the NSA over-collected or the companies over-delivered is only tangential to the core problem—there are no legal consequences for violating the rules. 

Most importantly, how is it that the NSA—which has consistently defended its mass surveillance as necessary for “national security”—decided that national security was not at risk when deleting these records? Does the NSA’s about-face mean that, as we’ve said for years, the agency doesn’t actually need to collect these types of records in the first place?

In a sense, the deletion of these records is good news. The fewer records the NSA has on us, the better. (Although the telecom companies’ troubling retention of these records remains). The warrantless collection of Americans’ private data is something EFF has fought for years, advocating for meaningful reform both in court cases and in legislation. We need more answers, and we need to stop letting the NSA blame “technical irregularities” for its failures, something it has done for years.  

Between 2009 and 2017, the NSA cited technology failures for more than 15 violations of federal law regarding a separate NSA surveillance program that sweeps up Americans’ online communications including emails, web chats, and browsing history. According to released court opinions and documents, the NSA’s remedy to these technical failures is often unknown. The NSA could have fixed its errors, or it could have ignored them. We simply don’t know.

This lack of transparency only compounds the NSA’s irresponsibility in its failure to comply with the law. When the NSA has admitted a technical error, it has done next to nothing to explain the problem in any detail, why the problem is allegedly too hard to fix, or how the problem began in the first place.

For the NSA’s failure to report unique identifiers this year, the OIG transparency report offered a one-sentence explainer and then hand-waved the problem away, saying that, if anything, the statistics reported were “over-inclusive” because of potentially duplicated counts of single call records.

As for the agency’s mass deletion of call detail records, the public received no further explanation of the “technical irregularities” themselves. Instead, the NSA claimed that it had fixed the problem, and that all future call detail record collection would be compliant with federal law.

These statements mean little to us by now. Too often, the NSA has responded to its own mistakes and outside attempts at oversight with one of three options: neglect, denial, or misleading statements. We saw a similar reaction when, in 2015, Congress passed the USA Freedom Act, the first successful, legislative attempt to meaningfully restrict the NSA’s surveillance under Section 215—the very same program under which the NSA has now deleted hundreds of millions of call records. 

Former NSA general counsel Glenn Gerstell initially expressed concern about the potentially “cumbersome” collection requirements under the USA Freedom Act, but, he still said:

“NSA is confident, however, that it can operate the new scheme in compliance with the law.”

We now see that this confidence was misplaced. Shame it took three years for us to find out.

With the NSA’s call record surveillance program up for reauthorization in 2019, we must demand meaningful explanations for the NSA’s failures, refusing to accept the agency’s bland assurances. We worry that meaningful reforms, even if successfully approved by Congress, could go ignored once again.

We ask the NSA to finally explain what is happening inside its databases, what is it doing to fix these continued problems, and what is it doing to protect the Fourth Amendment right of privacy of all Americans. Finally, Congress, we urge you to find out—if the NSA’s collection is so easily deleted, why can’t we stop it entirely? 

Update: Last month, Senators Ron Wyden and Rand Paul sent a letter to NSA Inspector General Robert Storch asking his office to investigate many of the same concerns we wrote above. We thank the Senators for their work. You can read the letter here.

03 Sep 19:14

Chrome turns 10

Brindle

whoa.

Chrome turns 10 this weekend. Google first released its Chrome browser 10 years ago today. Marketed as a "fresh take on the browser", Chrome debuted with a web comic from Google to mark the company's first web browser. It was originally launched as a Windows-only beta app before making its way to Linux and macOS more than a year later in 2009. Chrome debuted at a time when developers and internet users were growing frustrated with Internet Explorer, and Firefox had been steadily building momentum. When it was first released as beta, Chrome was a revelation. It was faster than Firefox, and sported a cleaner, simpler UI. I used Chrome from the very first few beta releases, but in recent years the browser has started sucking up more and more resources, and it feels - emphasis on feels - slower than ever before. On Windows, I switched to Edge, which feels a lot faster for me than any other Windows browser, and on my iOS devices I obviously use Safari. With the new UI redesign coming to Chrome coming Tuesday - I see very little reason to go back.
31 Aug 21:04

Court Rules It's Fine If FCC Wants To Deem Just One Available ISP As 'Competition'

by Karl Bode
Brindle

Strange definition of competition...

So we've long discussed how the FCC (often under both parties) has a long and troubled history of ignoring the obvious competition problems in the United States broadband market. From the FCC's $300 million broadband map that avoids mentioning prices and hallucinates competition and speeds, to the agency's long-standing (and absurd) belief that just one connection in a census tract means the entire area is "served," the government has gone to great lengths to help deep-pocketed telecom campaign contributors mask the width and depth of a problem that's painfully obvious to U.S. consumers.

Under the Ajit Pai FCC, this rose-colored glasses approach to data has only, unsurprisingly, intensified. The Pai FCC has been engaged in all manner of efforts to lower the definition of broadband in order to make it appear that residential broadband is more uniformly deployed than in actually is. That effort has been equally present in the even less competitive broadband business and special access market, where just a few ISPs hold regional monopolies over the high-speed lines connecting everything from cellular towers to your local ATM.

When Ajit Pai came to power at the FCC, he immediately got to work scrapping previous FCC efforts to make this market more competitive. That included modifying the very definition of "competition." Under the revised Pai FCC language, countless markets were suddenly deemed "competitive" if businesses had access to just one broadband provider. In response, impacted competitors and consumer groups filed an amicus curiae brief (pdf) urging the US Court of Appeals for the Eighth Circuit to vacate the FCC's rule changes.

That effort hasn't gone particularly well. This week, the court upheld the FCC's decision to declare a market "competitive" if there's just one ISP available to service it. From the ruling (pdf):

"We recognize that the relevant data presents radically different pictures of the competitiveness of the market depending on the economic theory applied and the weight given to conflicting pieces of evidence. But the FCC may rationally choose which evidence to believe among conflicting evidence in its proceedings, especially when predicting what will happen in the markets under its jurisdiction. Thus, we deny the petitions for review as to the Competitive Market Test because the FCC's resolution of competing evidence was not arbitrary and capricious."

That's not to say what the FCC is doing is good, just that it's within the FCC's authority to pick and choose between available sets of facts when crafting policy.

The fact remains that the Ajit Pai FCC has been happily fiddling with available data to try and downplay the competitive problems in the sector, in stark contrast to Pai's routinely hollow rhetoric about how closing the digital divide and helping sad, rural farmers is his top priority. After all, if you can twist the data until it shows U.S. residential broadband and business broadband markets are super competitive, it's slightly easier to justify your decision to refuse to do anything to actually fix it. Either way, it's a favor incumbent BDS monopolies like Verizon, AT&T and CenturyLink surely appreciate.



Permalink | Comments | Email This Story
30 Aug 17:03

Yahoo, bucking industry, scans emails for advertising

The U.S. tech industry has largely declared it is off limits to scan emails for information to sell to advertisers. Yahoo still sees the practice as a potential gold mine. Yahoo's owner, the Oath unit of Verizon Communications Inc., has been pitching a service to advertisers that analyzes more than 200 million Yahoo Mail inboxes and the rich user data they contain, searching for clues about what products those users might buy, said people who have attended Oath's presentations as well as current and former employees of the company. The biggest news in this story is not that Verizon is a scummy company - but that 200 million people still use Yahoo's email service.
28 Aug 17:48

Sen. Wyden Confirms Cell-Site Simulators Disrupt Emergency Calls

by Cooper Quintin

Sen. Ron Wyden has sent a letter to the U.S. Department of Justice concerning disruptions to 911 emergency services caused by law enforcement’s use of cell-site simulators (CSS, also known as IMSI catchers or Stingrays). In the letter, Sen. Wyden states that:

Senior officials from the Harris Corporation—the manufacturer of the cell-site simulators used most frequently by U.S. law enforcement agencies—have confirmed to my office that Harris’ cell-site simulators completely disrupt the communications of targeted phones for as long as the surveillance is ongoing. According to Harris, targeted phones cannot make or receive calls, send or receive text messages, or send or receive any data over the Internet. Moreover, while the company claims its cell-site simulators include a feature that detects and permits the delivery of emergency calls to 9-1-1, its officials admitted to my office that this feature has not been independently tested as part of the Federal Communication Commission’s certification process, nor were they able to confirm this feature is capable of detecting and passing-through 9-1-1 emergency communications made by people who are deaf, hard of hearing, or speech disabled using Real-Time Text technology.

The full text of the letter can be read here [PDF].

Researchers of CSS technology have long suspected that using such technologies, even professionally designed and marketed CSS’s, would have a detrimental effect on emergency services, and now—for the first time—we have confirmation.

It is striking, but unfortunately not surprising, that law enforcement has been allowed to use these technologies and has continued to use them despite the significant and undisclosed risk to public safety posed by disabling 911 service, not to mention the myriad privacy concerns related to CSS use. What’s more, a cell-site simulator wouldn’t just disrupt service for the specific person or persons being tracked but would likely disrupt service for every mobile device in the area as it tricks every phone in the area into connecting to the fake base station in search of the target phone. This could be especially dangerous during a natural disaster when IMSI catchers are being used to locate missing persons in damaged buildings or other infrastructure, cutting off 911 service at a time like that could be a grave danger to others trapped in dangerous situations.

Harris Corporation claims that they have the ability to detect and deliver calls to 911, but they admit that this feature hasn’t been tested. Put bluntly, there is no way for the public or policy makers to know if this technology works as intended.  Thanks to the onerous non-disclosure agreements that customers of Harris Corp and other CSS vendors’ customers have regularly been required to enter into there is very little public information about how CSS work and what their capabilities are. Even if a security researcher did audit a CSS, the results would be unlikely to ever see the light of day.

Furthermore, even if Harris’ technology works the way they claim it does, they are far from the only manufacturer of CSS devices. There are several other companies that manufacture such technology and we know even less about the workings of their technologies or whether they have any protections against blocking 911 calls. Cell-site simulators are now easy to acquire or build, with homemade devices costing less than $1000 in parts. Criminals, spies, and anyone else with malicious intent could easily build a CSS specifically to disrupt phone service, or use it without caring whether it disrupts 911 service.

The only way to stop the public safety and public privacy threats that cell-site simulators pose is to increase the security of our mobile communications infrastructure at every layer. All companies involved in mobile communications from the network layer (AT&T, T-Mobile, Verizon, etc.) to the hardware layer (Qualcomm, Samsung, Intel), to the software layer (Apple, Google) need to work together to ensure that our cellular infrastructure is safe, secure, and private from attacks by spys, criminals, and rogue law enforcement.  For their part, policymakers such as Sen. Wyden can help by continuing to provide transparency on how IMSI catchers work and are used, and funds to upgrade our aging cellular infrastructure.

For more information about cell-site simulators please consult our Street-Level Surveillance guides on law enforcement surveillance technology.

25 Aug 23:06

Internet chat system IRC turns thirty

IRC (Internet Relay Chat) was born at the Department of Information Processing Science of the University of Oulu 30 years ago. Jarkko Oikarinen developed the internet chat system back in 1988 in addition to his summer job. Today, people are still using IRC. I used to spend a lot of time on IRC, and a good IRC client was an absolute must for any aspiring operating system back in the early 2000s. I haven't used IRC in years - maybe in a decade - but it's good to see this technology still going strong.
25 Aug 23:04

Research Paper Shows Militarized SWAT Teams Don't Make Cops -- Or The Public -- Any Safer

by Tim Cushing
Brindle

shocker.

A study has been released confirming what many have suspected: militarization of law enforcement doesn't make communities safer, has zero effect on officer safety, and is rarely deployed as advertised when agencies make pitches for the acquisition of military gear.

The most frequent recipient of military tools and training are SWAT teams. Professor Jonathan Mummolo's research -- published by the National Academy of Sciences -- gained unprecedented access to SWAT deployment numbers, thanks to a public records request and a Maryland state law requiring documentation of every SWAT raid performed. (That law was allowed to expire by legislators who apparently felt it provided too much transparency and accountability.)

With these numbers, Mummolo was able to compare SWAT deployments to other stats, as well as see just how often SWAT teams were deployed to handle dangerous situations like robberies, shootings, hostage-taking, etc. What he discovered was, sadly, unsurprising. Police officials talk about the necessity of SWAT teams and military gear using references to barricaded suspects, terrorist attacks, active shooters…. pretty much anything but what they actually use them for. From the paper [PDF]:

[R]oughly 90% of SWAT deployments in that state over 5 fiscal years were conducted to serve search warrants. Previous work has shown that the use of SWAT teams to serve warrants, a practice which escalated as a result of the war on drugs, is an extremely disruptive event in the lives of citizens and often involves percussive grenades, battering rams, substantial property damage, and in rare cases deadly altercations stemming from citizens’ mistaken belief that they are experiencing a home invasion. [...] less than 5% of deployments involved a “barricade” scenario, which typically involves an armed suspect refusing to surrender to police. Violence to people and animals is rare, and gun shots are fired 1.2% of the time—roughly 100 deployments during this period. While the data suggest that indiscriminate violence is less common than some anecdotal reports suggest, they also show that the vast majority of SWAT deployments occur in connection with non-emergency scenarios, predominately to serve search warrants.

Similarly unsurprising is data showing SWAT teams are deployed far more often in areas with a higher concentration of African American residents. Mummolo's research shows a 10% increase in African American population resulted in a 10.5% increase in SWAT deployments.

All the gear obtained by police agencies to make officers safer doesn't seem to have an effect on officer safety. The data shows negligible effects on officer injuries or deaths. Despite being touted as essential tools to combat a supposed increase in criminal firepower, SWAT teams and their military gear spend more time serving warrants than facing dangerous situations. Maryland SWAT stats -- compared against other data reported by law enforcement agencies -- results in this conclusion:

[T]here is no evidence that acquiring a SWAT team lowers crime or promotes officer safety.

Surveys conducted by Mummolo show SWAT teams -- and police militarization in general -- have a negative effect on public perception. SWAT teams make the places they're frequently deployed seem less safe, even if crime stats don't back that up. Dressing up in military gear increases distrust of the law enforcement agency -- something especially pronounced in African American respondents.

Mummolo's conclusion, based on stats supplied by law enforcement agencies, is devastating. And it's likely to be ignored by every law enforcement agency in Maryland.

Given the concentration of deployments in communities of color, where trust in law enforcement and government at large is already depressed, the routine use of militarized police tactics by local agencies threatens to increase the historic tensions between marginalized groups and the state with no detectable public safety benefit. While SWAT teams arguably remain a necessary tool for violent emergency situations, restricting their use to those rare events may improve perceptions of police with little or no safety loss.

SWAT teams arose out of a need for elite response units to send to especially dangerous situations. It's quickly devolved into nothing more than a sideshow for warrant service -- an excuse to treat citizens like enemy combatants while needlessly escalating situations until they can justify the absurdly overblown tactics and weaponry being deployed.



Permalink | Comments | Email This Story
20 Aug 23:17

DOJ Asking Court To Force Facebook To Break Encryption On Messenger Voice Calls

by Tim Cushing

The DOJ's war on encryption continues, this time in a secret court battle involving Facebook. The case is under seal so no documents are available, but Reuters has obtained details suggesting the government is trying to compel the production of encryption-breaking software.

The U.S. government is trying to force Facebook Inc to break the encryption in its popular Messenger app so law enforcement may listen to a suspect’s voice conversations in a criminal probe, three people briefed on the case said, resurrecting the issue of whether companies can be compelled to alter their products to enable surveillance.

The request seeks Facebook's assistance in tapping calls placed through its Messenger service. Facebook has refused, stating it simply cannot do this without stripping the protection it offers to all of its Messenger users. The government disagrees and has asked the court for contempt charges.

Underneath it all, this is a wiretap order -- one obtained in an MS-13 investigation. This might mean the government hasn't used an All Writs Acts request, but is rather seeking to have the court declare Messenger calls to be similar to VoIP calls. If so, it can try to compel the production of software under older laws and rulings governing assistance of law enforcement by telcos.

A federal appeals court in Washington D.C. ruled in 2006 that the law forcing telephone companies to enable police eavesdropping also applies to some large providers of Voice over Internet Protocol, including cable and other broadband carriers servicing homes. VoIP enables voice calls online rather than by traditional circuit transmission.

However, in cases of chat, gaming, or other internet services that are not tightly integrated with existing phone infrastructure, such as Google Hangouts, Signal and Facebook Messenger, federal regulators have not attempted to extend the eavesdropping law to cover them, said Al Gidari, a director of privacy at Stanford University Law School’s Center for Internet and Society.

Calls via Messenger are still in a gray area. Facebook claims calls are end-to-end encrypted so it cannot -- without completely altering the underlying software -- assist with an interception. Regular messages via Facebook's services can still be decrypted by the company but voice calls appear to be out of its reach.

Obviously, the government would very much like a favorable ruling from a federal judge. An order to alter this service to allow interception or collection could then be used against a number of other services offering end-to-end encryption.

It's unknown what legal options Facebook has pursued, but it does have a First Amendment argument to deploy, if nothing else. If code is speech -- an idea that does have legal precedent -- the burden falls on the government to explain why it so badly needs to violate a Constitutional right with its interception request.

This is a case worth watching. However, unlike the DOJ's very public battle with Apple in the San Bernardino case, there's nothing to see. I'm sure Facebook has filed motions to have court documents unsealed -- if only to draw more attention to this case -- but the Reuters article says there are currently no visible documents on the docket. (The docket may be sealed as well.) There is clearly public interest in this case, so the presumption of openness should apply. So far, that hasn't worked out too well for the public. And if the DOJ gets what it wants, that's not going to work out too well for the public either.



Permalink | Comments | Email This Story
19 Aug 15:49

Okaaaaay: Decorative Human Face Pot Pies

Brindle

Karen won't let me get some of these for family dinner :(

human-face-pot-pies.jpg These are the new-and-improved decorative People Pot Pies crafted in a witch's kitchen by Etsy seller It Came From Under My Bed, which is how 90% of my nightmares begin. The inedible pies cost around $31 apiece and can be customized with teeth, tongues and hair. I...think I'm good on those. Although it would be pretty great to pretend to pull one of these out of the oven and set it on the counter in front of your kids. Haha, that would be terrifying, wouldn't it? "What?" Having children. Keep going for a video, but be sure to check out her Etsy shop if you were wondering if she also sells fake severed penis necklaces (she does). At least I hope they're fake.
Thanks to Allyson S, but also kinda no thanks to Allyson S.
19 Aug 13:56

Video Games In Germany Can Now Maybe Kinda Sometimes Have Swastikas

by Timothy Geigner

As you likely know, Germany has some very restrictive laws surrounding how and when Nazi iconography can appear in the country. This has resulted in a heavily-policed artistic community, particularly when it comes to video games, which has produced some fairly funny happenings about games accidentally going to Germany chock full of Nazi stuff and other funny happenings in which the game makers make a show of doing as little as possible to get around the law. In the realm of other media, such as movies, the German government has put in place a review process to make sure that the use of Nazi symbols furthers the artistic or historical accuracy of the entertainment. Video games have not had such a review system. And, look, on some level this sort of attempt by Germany to restrict the use of these hateful symbols is understandable. The kind of global embarrassment that comes with committing the worst genocide in history is the sort of thing that leaves a mark. But we've also pointed out that these German laws aren't so much stamping out fascist thought as they are putting the government's collective head in the sand as some kind of grand virtue signal to the planet.

Which is why it's at least a tepid step forward that Germany has revised its position and will now allow Nazi iconography in some video games, some of the time, on a case by case basis.

The government has moved from a blanket ban on swastikas and Hitler moustaches to a case-by-case basis, which will be administered by the USK, Germany’s ratings board.

The official release with the news gives the specifics:

When games that depict symbols of unconstitutional organisations are submitted to the USK for an age rating, the USK committees can now assess them on a case-by-case basis to decide whether the ‘social adequacy clause’ (Sozialadäquanzklausel, as laid out in section 86, subsection (3) of the German Criminal Code) applies. In this context, ‘social adequacy’ means that symbols of unconstitutional organisations can be used in games in individual cases, as long as those symbols serve an artistic or scientific purpose, or depict current or historical events.

Again, the big shift here is actually one of cultural importance, which is the German government will now consider video games as an artistic form, which they undoubtedly are. Movies and television have had a similar review process in place for years, but games were left out. And, as the gaming art form continues to gain ground as the preferred entertainment medium, it was impossible for the German government to ignore this forever. So, while it seems odd to declare a victory in which more swastikas will be seen by the German public, this is much more to do with an acknowledgement of culture than cheering on the Third Reich.

Felix Falk, Managing Director of the German Games Industry Association, says:

This new decision is an important step for games in Germany. We have long campaigned for games to finally be permitted to play an equal role in social discourse, without exception. Computer and video games have been recognised as a cultural medium for many years now, and this latest decision consistently cements that recognition in terms of the use of unconstitutional symbols as well.

It remains to be seen whether or not older games like Wolfenstein will resubmit the original forms of its games for inclusion in all of this, but at least the German government will no longer act as though it can pretend that Nazis were never a thing.



Permalink | Comments | Email This Story
15 Aug 19:31

Irony Alert: Disney (Yes, DISNEY!) Whines About 'Overzealous Copyright Holders'

by Mike Masnick
Brindle

fucking disney

Here's one that might create a bit of a stir. The history of the 20th century and maximalist, ever expanding copyright is often associated with one particular company: Disney. I mean, the 1998 Copyright Term Extension Act (CTEA) is regularly called the "Mickey Mouse Protection Act" and Tom Bell once created this lovely Mickey Mouse Curve showing how copyright terms always seemed to expand just before the original movie starring Mickey, Steamboat Willie was about to enter the public domain:

This pattern might finally (miraculously) end this year -- but not because Disney has become enlightened. Rather, it's mainly because Disney's lobbying influence is not what it once was, and SOPA seemed to make both Congress and the legacy entertainment industry realize that they would almost certainly lose another such fight on an issue like this (not that there weren't attempts to slip provisions into trade agreements that had the potential to expand copyright terms).

However, it does seem notable -- as first spotted by Eriq Gardner at The Hollywood Reporter -- that Disney has now been put in the possibly awkward position of complaining about "overzealous copyright holders," and talking about the importance of user rights and fair use to protect free speech and the First Amendment. No, really.

Disney, of course, owns ABC. Back in May (though the complaint appears to incorrectly state March), ABC aired a two-hour program entitled The Last Days of Michael Jackson. The Michael Jackson Estate was not pleased and sued for copyright infringement. The complaint itself is quite a read. It completely mocks the program in question:

Although titled The Last Days of Michael Jackson, the program did not focus on Michael Jackson’s last days. Rather, it was simply a mediocre look back at Michael Jackson’s life and entertainment career. A Rolling Stone review described the program as “offer[ing] little in the way of new revelations or reporting and at times seems heavy on armchair psychoanalysis and unsupported conjecture.” The magazine was being too generous. The program contained nothing “in the way of new revelations or reporting.”

It also digs deep on Disney's well-known history for maximalism:

Disney’s media business depends on its intellectual property and, more specifically, the copyrights it holds in its well-known characters, motion pictures, music, and the like. Disney has never been shy about protecting its intellectual property. Indeed, its zeal to protect its own intellectual property from infringements, real or imagined, often knows no bounds.

a. Disney has threatened to sue independent childcare centers for having pictures of Mickey Mouse and Donald Duck on their walls, forcing them to remove all pictures of Mickey or Donald—and other anthropomorphized mice or ducks—rather than face ruinous litigation from one of the world’s largest corporations.

b. Disney once sued a couple on public assistance for $1 million when they appeared at children’s parties dressed as an orange tiger and a blue donkey. Apparently, these costumes cut too close to Tigger and Eeyore for Disney’s tastes.

c. Disney takes a very narrow view of copyright law’s “fair use” doctrine. For example, just a few years ago, it sent DMCA takedown notices to Twitter, Facebook, and other websites and webhosts, when consumers posted pictures of new Star Wars toys that the consumers had legally purchased. Apparently, Disney claimed that simple amateur photographs of Star Wars characters in toy form infringed Disney’s copyrights in the characters and were not a fair use.

It's hard to deny any of the above. And thus, the complaint, with a healthy dose of snark, notes Disney's fairly blatant hypocrisy:

Like Disney, the lifeblood of the Estate’s business is its intellectual property. Yet for some reason, Disney decided it could just use the Estate’s most valuable intellectual property for free. Apparently, Disney’s passion for the copyright laws disappears when it doesn’t involve its own intellectual property and it sees an opportunity to profit off of someone else’s intellectual property without permission or payment.

It claims "at least thirty different copyright works" were used without permission. These included clips from songs and music videos, concert footage and the Jackson Estate's own documentary footage. So now Disney has answered and finds itself, quite incredibly, arguing against overzealous copyright holders and about the importance of protecting the First Amendment from being harmed by excessive copyright claims. Literally.

This case is about the right of free speech under the First Amendment, the doctrine of fair use under the Copyright Act, and the ability of news organizations to use limited excerpts of copyrighted works—here, in most instances well less than 1% of the works—for the purpose of reporting on, commenting on, teaching about, and criticizing well-known public figures of interest in biographical documentaries without fear of liability from overzealous copyright holders.

I agree with everything in that paragraph. I'm just shocked that it's Disney stating this. Disney is not the most credible defender of the First Amendment and fair use. Nor is it the most credible defendant to be yelling about overzealous copyright holders. Throughout the answer to the complaint Disney insists that its uses of the Michael Jackson works "were included in the Documentary on a transformative and fair use basis."

Without having seen the documentary, it's impossible to say whether or not the uses truly qualify as fair use, though the argument that they are sounds reasonable. But the idea that Disney is the one fighting for fair use and against overzealous copyright holders remains stunning and bizarre. I'd like to believe this is Disney coming to its senses and making amends for the century of harm its done thanks to copyright, but it seems much more likely that this is just an opportunistic defense of fair use, and the company remains firmly in the camp of supporting ever expanding copyrights.

I wonder how Disney would feel if someone showed up to future hearings in the case wearing an unauthorized Mickey Mouse costume?



Permalink | Comments | Email This Story
13 Aug 20:43

Appeals Court: No Immunity For Border Patrol Agent's Murder Of 16-Year-Old Mexican Citizen

by Tim Cushing

Earlier this year, US Border Patrol agent Lonnie Swartz was acquitted of second degree murder for killing a 16-year-old Mexican resident by firing sixteen bullets across the border into a Nogales, Mexico street. Ten of those hit Jose Antonio Elena Rodriguez, killing him in Mexico, but with bullets fired from the United States.

The excuse for emptying a clip into another country (and another country's citizen) was that Rodriguez and others were "throwing rocks" at Border Patrol agents. Considering there's a fence separating the US and Mexico side of Nogales -- and a decently sized one at that -- and the BP officers were free to move out of range of the rocks, it would appear there was no physical threat to Swartz's safety. Nonetheless, he felt compelled to shoot across the border 16 times. He may have escaped jail time, but he's not going to escape a lawsuit. (h/t Kevin Gosztola of ShadowProof)

The Ninth Circuit Court of Appeals has upheld the lower court's stripping of Swartz's qualified immunity. The decision [PDF] points out several things about how far the Constitution expands into Mexico when it involves an American on American soil firing deadly projectiles into another country.

First off, the court notes J.A. (as he's referred to in the ruling) posed no threat to officers even if he was throwing rocks. (J.A.'s survivors claim he wasn't.) The Border Patrol had the high ground plus a fence to protect them from thrown rocks.

The ground on the American side is around 25 feet higher than the road, and a border fence rises another 20 or 25 feet above that… The fence is made of steel beams, each about 6½ inches in diameter, set about 3½ inches apart.

Here's a picture of the area from the Mexico side for reference. (Taken from the ruling.)

This would seem to be a pretty effective barricade against thrown rocks. However, it does nothing to stop bullets fired from above through the fence. The Fourth Amendment question is completely settled on matters like these:

These principles are clearly established. As we held in Harris, every reasonable law enforcement officer should know that “officers may not shoot to kill unless, at a minimum, the suspect presents an immediate threat to the officer or others, or is fleeing and his escape will result in a serious threat of injury to persons.”

The court holds the killing of J.A. was an impermissible "seizure" under the Fourth Amendment. Swartz argued no right was violated because J.A. was a Mexican resident and therefore had no Fourth Amendment protections. The court says this distinction doesn't matter. What really matters is how the shooting took place. Mexico's laws and rights apply on the Mexican side of the border, but US laws and rights are dragged into it when a government agent starts firing a gun from the US side of the border.

[U]nlike the American agents in Verdugo-Urquidez, who acted on Mexican soil, Swartz acted on American soil. Just as Mexican law controls what people do there, American law controls what people do here. Verdugo-Urquidez simply did not address the conduct of American agents on American soil.

Furthermore, despite Swartz's filed protestations, he could not have possibly known the nationality of the citizen he was firing at. Nogales is split at the border and residents of both sides cross the border frequently. Swartz could very easily have killed a US citizen. His assumption that J.A. was Mexican because he was on that side of the fence did not give him a better excuse to open fire. The only thing that assumption did was make him believe this violation of J.A.'s rights would somehow be more minimal because of his physical location. That assumption is just wrong.

J.A.’s citizenship and ties to the United States are similarly irrelevant here. When he shot J.A., Swartz could not have known whether the boy was an American citizen. Thus, Swartz is not entitled to qualified immunity on the bizarre ground that J.A. was not an American. For all Swartz knew, J.A. was an American citizen with family and activities on both sides of the border. Therefore, the question is not whether it was clearly established that aliens abroad have Fourth Amendment rights. Rather, it is whether it was clearly established that it was unconstitutional for an officer on American soil to use deadly force without justification against a person of unknown nationality on the other side of the border.

Swartz argued that extending this right to citizens on the other side of our border walls will somehow wreak havoc on the legal system and hamper the ability of border officers to do their jobs. The court says this concern is misplaced. If officers engage on this side of the border, the Constitution (and court precedent) is crystal clear.

The concerns in Verdugo-Urquidez were also specific to warrants and overseas operations. But this case is not about searches and seizures broadly speaking. Neither is it about warrants or overseas operations. It is about the unreasonable use of deadly force by a federal agent on American soil. Under those limited circumstances, there are no practical obstacles to extending the Fourth Amendment. Applying the Constitution in this case would simply say that American officers must not shoot innocent, non-threatening people for no reason. Enforcing that rule would not unduly restrict what the United States could do either here or abroad.

J.A.'s Fourth Amendment claim can continue to be brought against Agent Swartz. The court briefly notes that J.A.'s Fifth Amendment claim may have been dismissed when the Fourth A claim was upheld, but there's no reason it wouldn't have applied as well if it had been sustained. And it's this small note that really lays bare the court's feelings about this particular defendant and his actions.

The district court dismissed Rodriguez’s Fifth Amendment claim because the Fourth Amendment applied, and we do not analyze the Fifth Amendment claim here. But if the Fourth Amendment does not apply because J.A. was in Mexico, then the Fifth Amendment “shocks the conscience” test may still apply. Swartz’s conduct would fail that test. We cannot imagine anyone whose conscience would not be shocked by the cold-blooded murder of an innocent person walking down the street in Mexico or Canada by a U.S. Border Patrol agent on the American side of the border.

Swartz may have been acquitted of murder charges in court, but another court stills views his actions as murderous. When a court calls a government agent's actions "murder," there can be no doubt qualified immunity has been denied. Swartz will have to face the financial consequences of his actions, even if he has managed to dodge being jailed for killing the citizen of another country.



Permalink | Comments | Email This Story
11 Aug 15:38

Platforms, Speech And Truth: Policy, Policing And Impossible Choices

by Mike Masnick

Warning 1: I'm about to talk about an issue that has a lot of nuance in it and no clear "good" answers -- and it's also one that many people have already made up their minds on one way or the other, and both sides will probably not really like at least part of what I have to say. That's cool. You get to live your own life. But, at the very least, I hope people can acknowledge that sometimes issues are more complex than they appear and having a nuanced discussion can be helpful, and I hope people can appreciate that.

Warning 2: This is a long post, so I'm going to provide a TLDR at the top (right under this, in fact), but as noted above, a part of the reason it's long is because it's a complex issue and there's a lot of nuance. So I strongly advise that if your initial response to my TLDR version is "fuck you, you're so wrong because..." maybe try reading the whole post first, and then when you go down to the comments to write out "fuck you, you're so wrong..." you can explain yourself clearly and thoroughly and address the actual points in the post. Thanks!

TLDR: Internet sites have every right in the world to kick people off their platforms, and there's no legal or ethical problem with that. No one's free speech is being censored. That said, we should be at least a bit concerned about the idea that giant internet platforms get to be some sort of arbiter of what speech is okay and what speech is not, and how that can impact society more generally. But there are possible solutions to this, even if none are perfect and some may be difficult to implement, and we should explore those more thoroughly, rather than getting into screaming fights over who should or shouldn't be allowed to use various internet platforms.

So, this post was originally going to be about the choices that Facebook and other internet platforms make concerning who is allowed on their platforms, specifically in response to an interview that Mark Zuckerberg gave back in July, in which he noted that he didn't think Facebook should remove Holocaust deniers from its platform, saying:

I’m Jewish, and there’s a set of people who deny that the Holocaust happened.

I find that deeply offensive. But at the end of the day, I don’t believe that our platform should take that down because I think there are things that different people get wrong. I don’t think that they’re intentionally getting it wrong, but I think... it’s hard to impugn intent and to understand the intent. I just think, as abhorrent as some of those examples are, I think the reality is also that I get things wrong when I speak publicly. I’m sure you do. I’m sure a lot of leaders and public figures we respect do too, and I just don’t think that it is the right thing to say, “We’re going to take someone off the platform if they get things wrong, even multiple times.”

This created a huge furor of people talking about trolling, Holocaust denialism, Overton windows and a bunch of other things. But it's a complex, nuanced topic, and I was trying to write a complex nuanced post. And just as I was getting somewhere with it... this week, a bunch of platforms, including Apple, YouTube and Facebook, removed at least some of Alex Jones accounts or content. This created another furor in the other direction, with people talking about deplatforming, censorship, free speech, monopoly power, and policing truth. And then when Twitter chose not to follow the lead of those other platforms, we were right back to a big furor about keeping hateful wackjob conspiracy theory assholes on your platform, and whether or not you should want to do that.

Chances are no matter what I say is going to piss off pretty much everyone, but let's do the stupid thing and try to address a complex and extremely nuanced topic on the internet, with unflagging optimism that maybe (just maybe) people on the internet will (for a moment at least) hold back their kneejerk reactions of "good" or "bad" and try to think through the issues.

Let's start with a few basic principles: no matter what crazy legal analysis you may have heard before, internet sites have every right to remove users for nearly any reason (there may be a few limited exceptions, but none of them apply here). Whether you like it or not (and you should actually like it), corporations do get rights, and that includes their First Amendment rights to have their sites appear how they want, along with deciding who not to associate with. On top of that, again, despite what you may have heard online about Section 230 of the CDA, platforms not only have the right to moderate what's on their platform without legal liability, they are actually encouraged to do so by that law.

Indeed, if anyone knows this, it's Alex Jones, since Infowars' own terms of service makes it clear that Infowars can boot anyone it wants:

If you can't read that, there's a long list of rules and then it says:

If you violate these rules, your posts and/or user name will be deleted. Remember: you are a guest here. It is not censorship if you violate the rules and your post is deleted. All civilizations have rules and if you violate them you can expect to be ostracized from the tribe.

One of the rare cases where I can say that, hey, that Alex Jones guy is absolutely right about that (and we'll leave aside the hypocrisy about him now flipping out about other sites applying those same rules on him).

A separate point that also is important, and gets regularly ignored, is that "banning" someone from these platforms often has the opposite impact of what was intended. Depending on the situation, it might not quite be a "Streisand Effect" situation, but it does create a martyr situation, which supporters will automatically use to double down on their belief that they're in the right position, and people are trying to "suppress the truth" or whatever. Also, sometimes it's useful to have "bad" speech out in the open, where people can track it, understand it... and maybe even counter it. Indeed, often hiding that bad speech not only lets it fester, but dulls our ability to counter it, respond to it and understand who is spreading such info (and how widely).

So, really, the question comes down to whether or not these platforms should be removing these kinds of accounts. But, before we should even answer that question, there's a separate question, which is: What options are there for platforms to deal with content that they disfavor? Unfortunately, many people assume that it's a binary choice. You either keep the content up, or you take it down. But that hardly gets at the long list of possible alternatives. You can encourage good behavior and discourage bad behavior (say, with prompts if the system senses you're doing something bad, or with reminders, or by a community calling you out for bad behavior or lots of other options). Depending on the platform, you can minimize the accessibility or findability of certain content. You can minimize the reach of certain content. You can append additional information or put a "warning flag" on content. You can "shadow ban" content. You can promote "good" content to go with any content you deem to be bad. Or you can do nothing. Or you can set things up so that your users are able to help promote or minimize good or bad content. Or you can create tools that allow your users to set their own preferences and thresholds. Or you can allow third parties to build tools that do the same thing. The list goes on and on and on.

And, yet, so much of this debate seems to ignore much of this (other than shadowbanning, which some people pretend is somehow evil and unfair). And, indeed, what concerns me is that while various platforms have tried some combinations of all of these things, very few seem to have really committed to these ideas -- and just get bounced back and forth between extreme pressure on two sides: "ban all the assholes" v. "how dare you fucking censor my favorite idiot."

So with the question of Alex Jones or holocaust deniers, internet platforms (again) have every right to kick them off their platforms. They don't want to be associated with assholes? Good for them. But, at the same time, it's more than a bit uncomfortable to think that anyone should want these giant internet platforms deciding who can use their platforms -- especially when having access to those platforms often feels close to necessary to take part in modern day life*. It's especially concerning when it reaches the level that basically online mobs can "demand" that someone be removed. And this is especially worrisome when many of the decisions are being made based on the claim of "hate speech," a term that not only has an amorphous and ever-changing definition, but one that has a long history of being abused against at risk groups or those the government simply dislikes (i.e., for those who advocate for rules against "hate speech" think about what happens when the person you trust the least gets to write the definition).

* Quick aside to you if you're that guy rushing down to the comments to say something like "No one needs to use Facebook. I don't use Facebook." Shut up. Most people do use Facebook. And for many people it is important to their lives. In some cases, there are necessary services that require Facebook. And you should support that rather than getting all preachy about your own life choices, good or bad.

On top of that, I think that most people literally cannot comprehend both the scale and complexity of the decision making here when platforms are tasked with making these decisions. Figuring out which pieces of content are "okay" and which are "bad" can work when you're looking at a couple dozen piece of content. But how about a million pieces of content every single day? Or more? Back in May, when we ran a live audience "game" in which we asked everyone at a Content Moderation Summit to judge just eight examples of content to moderate, what was striking was that out of this group of professionals in this space, there was no agreement on how to handle any piece of content. Everyone had arguments for why each piece of content should stay up, be taken down, or have flag appended to it. So, not only do you have millions of pieces of content to judge, you have a very subjective standard, and a bunch of individuals who have to make those judgment calls -- often with little training and very little time to review or to get context.

Antonio Garcia Martinez, who worked at Facebook for a while, and has been a fairly outspoken critic of his former employer (writing an entire book about it), has reasonably warned that we should be quite careful what we wish for when asking Facebook to cut off speech, noting that the rest of the world has struggled in every attempt to define the limits of hate speech, and it's an involved and troubling process -- and yet, many people are fine with handing that over to a group of people at a company they all seem to hate. Which... seems odd. Even more on point is an article in Fortune by CDT's Emma Llanso (who designed and co-ran much of that "game" we ran back at the content moderation summit), warning about the lack of transparency when platforms determine this kind of thing, rather than, say, the courts. As we've argued for years, the lack of transparency and the lack of due process is also a significant concern (though, when Mark Zuckerberg suggested an outside due process system, people completely freaked out, thinking he was arguing for a special Facebook court system).

In the end, I think banning people should be the "very last option" on the table. And you could say that since these platforms left Jones on for so long while they had their internal debates about him, that's what happened. But I don't think that's accurate. Because there were alternative solutions that they could have tried. As Issie Lapowsky at Wired pointed out in noting that this is an unwinnable battle, the "do nothing, do nothing, do nothing... ban!" approach is unsatisfying to everyone:

When Facebook and YouTube decided to take more responsibility for what does and doesn't belong on their platforms, they were never going to satisfy all sides. But their tortured deliberations over what to do with Jones left them with only two unenviable options: Leave him alone and tacitly defend his indefensible actions, or ban him from the world's most powerful platforms and turn him into the odious martyr he now is.

Instead, we should be looking at stronger alternative ideas. Yair Rosenberg's suggestion in the Atlantic is for counterprogramming, which certainly is an appealing idea:

Truly tackling the problem of hateful misinformation online requires rejecting the false choice between leaving it alone or censoring it outright. The real solution is one that has not been entertained by either Zuckerberg or his critics: counter-programming hateful or misleading speech with better speech.

How would this work in practice?

Take the Facebook page of the “Committee for Open Debate on the Holocaust,” a long-standing Holocaust-denial front. For years, the page has operated without any objection from Facebook, just as Zuckerberg acknowledged in his interview. Now, imagine if instead of taking it down, Facebook appended a prominent disclaimer atop the page: “This page promotes the denial of the Holocaust, the systematic 20th-century attempt to exterminate the Jewish people which left 6 million of them dead, alongside millions of political dissidents, LGBT people, and others the Nazis considered undesirable. To learn more about this history and not be misled by propaganda, visit these links to our partners at the United State Holocaust Museum and Israel’s Yad Vashem.”

Obviously, this intervention would not deter a hardened Holocaust denier, but it would prevent the vast majority of normal readers who might stumble across the page and its innocuous name from being taken in. A page meant to promote anti-Semitism and misinformation would be turned into an educational tool against both.

Meanwhile, Tim Lee, over at Ars Technica, suggested another possible approach, recognizing that Facebook (in particular) serves multiple functions. It hosts content, but it also promotes certain content via its algorithm. The hosting could be more neutral, while the algorithm is already not neutral (it's designed to promote the "best" content, which is inherently a subjective decision). So, let bad content stay on the platform, but decrease its "signal" power:

It's helpful here to think of Facebook as being two separate products: a hosting product and a recommendation product (the Newsfeed). Facebook's basic approach is to apply different strategies for these different products.

For hosting content, Facebook takes an inclusive approach, only taking down content that violates a set of clearly defined policies on issues like harassment and privacy.

With the Newsfeed, by contrast, Facebook takes a more hands-on approach, downranking content it regards as low quality.

This makes sense because the Newsfeed is fundamentally an editorial product. Facebook has an algorithm that decides which content people see first, using a wide variety of criteria. There's no reason why journalistic quality, as judged by Facebook, shouldn't be one of those criteria.

Under Facebook's approach, publications with a long record of producing high-quality content can get bumped up toward the top of the news feed. Publications with a history of producing fake news can get bumped to the back of the line, where most Newsfeed users will never see it.

Others, such as long-time free speech defender David French, have suggested that platforms should ditch concepts like "hate speech" that are not in US law and simply stick to the legal definitions" of what's allowed:

The good news is that tech companies don’t have to rely on vague, malleable and hotly contested definitions of hate speech to deal with conspiracy theorists like Mr. Jones. The far better option would be to prohibit libel or slander on their platforms.

To be sure, this would tie their hands more: Unlike “hate speech,” libel and slander have legal meanings. There is a long history of using libel and slander laws to protect especially private figures from false claims. It’s properly more difficult to use those laws to punish allegations directed at public figures, but even then there are limits on intentionally false factual claims.

It’s a high bar. But it’s a bar that respects the marketplace of ideas, avoids the politically charged battle over ever-shifting norms in language and culture and provides protection for aggrieved parties. Nor do tech companies have to wait for sometimes yearslong legal processes to work themselves out. They can use their greater degree of freedom to conduct their own investigations. Those investigations would rightly be based on concrete legal standards, not wholly subjective measures of offensiveness.

That's certainly one way to go about it, but I actually think that would create all sorts of other problems as well. In short, determining what is and what is not defamation can often be a long, drawn out process involving lots and lots of lawyers advocating for each side. The idea that platforms could successfully "investigate" that on their own seems like a stretch. It would be fine for platforms to have a policy saying that if a court has adjudicated something to be defamatory, then they'll take it down (and, indeed, most platforms do have exactly that policy), but having them make their own determinations of what counts as defamation seems like a risky task, and that would end up in a similar end state as where we are today with a lot of people angry at the "judgments from on high" with little transparency or right of appeal.

As for me, I still go back to the solution I've been discussing for years: we need to move to a world of protocols instead of platforms, in which transparency rules and (importantly) control is passed down away from the centralized service to the end users. Facebook should open itself up so that end users can decide what content they can see for themselves, rather than making all the decisions in Menlo Park. Ideally, Facebook (and others) should open up so that third party tools can provide their own experiences -- and then each person could choose the service or filtering setup that they want. People who want to suck in the firehose, including all the garbage, could do so. Others could choose other filters or other experiences. Move the power down to the ends of the network, which is what the internet was supposed to be good at in the first place. If the giant platforms won't do that, then people should build more open competitors that will (hell, those should be built anyway).

But, if they were to do that, it lets them get rid of this impossible to solve question of who gets to use their platforms, and moves the control and responsibility out to the end points. I expect that many users would quickly discover that the full firehose is unusable, and would seek alternatives that fit with how they wanted to use the platform. And, yes, that might mean some awful people create filter bubbles of nonsense and hatred, but average people could avoid those cesspools while at the same time those tasked with monitoring those kinds of idiots and their behavior could still do so.

I should note that this is a different solution than the one that Twitter's Jack Dorsey appeared to ham-fistedly suggest this week on his own platform, in which he suggested that journalists need to do the work of debunking idiots on Twitter. He's not wrong, but what an awful way to put it. Lots of people read it to mean "we set up the problem that makes this giant mess, and we'll leave it to journalists to come along and sort things out for free."

Instead, what I'm suggesting is that platforms have to get serious about moving real power out to the ends of their network so that anyone can set up systems for themselves -- or look to other third parties (or, even the original platforms themselves for a "default" or for a set of filter choices) for help. In the old days on Usenet there were killfiles. Email got swamped with spam, but there were a variety of anti-spam filters that you could plug-in to filter most of it out. There are ways to manage these complex situations that don't involve Jack Dorsey choosing who stays on the island and who gets removed this week.

Of course, this would require a fundamental shift in how these platforms operate -- and especially in how much control they have. But, given how they keep getting slammed on all sides for the decisions they both do and don't make, perhaps we're finally at a point where they'll consider this alternative. And, hey, if anyone at these big platforms wants some help thinking through these issues, feel free to contact us. These are the kinds of projects we enjoy working on, as crazy and impossible as they may feel.



Permalink | Comments | Email This Story
08 Aug 18:07

Intelligence Oversight? Dianne Feinstein Employed A Chinese Spy For Several Years

by Tim Cushing

Well, this is awkward.

Former intelligence officials told me that Chinese intelligence once recruited a staff member at a California office of U.S. Senator Dianne Feinstein, and the source reported back to China about local politics. (A spokesperson for Feinstein said the office doesn’t comment on personnel matters or investigations, but noted that no Feinstein staffer in California has ever had a security clearance.)

This detail, located in the middle of Zach Dorfman's report on foreign spying in the Silicon Valley, doesn't tell the whole story. The grand dame of intelligence oversight, the queen of surveillance, somehow managed to let a foreign spy tag along with her for several years -- one employed by her for nearly two decades. Phil Matier and Andy Ross of the San Francisco Chronicle managed to get more details about this spying from a local source.

A local source who knew about the incident confirmed to us that the FBI showed up at Feinstein’s office in Washington, D.C., about five years ago to alert the then-chairwoman of the Senate Intelligence Committee that her driver was being investigated for possible Chinese spying.

“Dianne was mortified,” said our source, who spoke to us only on condition he not be named.

The unnamed staffer was Feinstein's driver and gofer when she was in the Bay Area and served as a liaison with the Chinese-American community. Apparently, he was recruited by someone in China during a visit to Asia.

That someone was connected with the People’s Republic of China’s Ministry of State Security.

The FBI interviewed the spy and determined he hadn't passed on anything of value. I guess that's a relief, but it also may indicate just palling around with Feinstein doesn't result in much actionable intelligence. Of course, it may be the spy didn't even know he was a spy. The SF Chronicle source says the suspected spy just considered his State Security a friend who liked to chat about US politics.

What should be concerning is how quietly this was handled. When intelligence oversight members can't keep from being spied on by staffers, there's a problem. It may be impossible to prevent every attempt, but having a long-time employee turn out to be a foreign intelligence source is more than embarrassing, it's potentially dangerous. This was simply swept under the rug by Feinstein and never discussed publicly.

Trust isn't a one-way street. Our surveillance oversight should be accountable to the public just as surely as the intelligence community should be accountable to its oversight. This should have been acknowledged and discussed publicly, not left to anonymous sources and/or FOIA warriors with the tenacity and funding to force the government to hand over documents dealing with its hidden screw-ups.



Permalink | Comments | Email This Story
31 Jul 14:58

DOJ Tells Sheriff To Give It Back The $70,000 In Forfeiture Funds He Spent To Buy Himself A New Sports Car

by Tim Cushing

You have to screw up pretty badly to step on the DOJ's toes hard enough for it to notice when it comes to asset forfeiture. After the briefest of reforms under Eric Holder, new AG Jeff Sessions reactivated the federal forfeiture escape hatch, allowing law enforcement agencies to skirt local reform efforts by having their seizures "adopted" by the feds.

According to proponents of forfeiture, it's a valuable tool that cripples drug cartels. That far more seizures take place than convictions or even arrests is glossed over by fans of forfeiture who honestly (or more likely, dishonestly) believe taking money from motorists during pretextual stops somehow has an effect on the international drug trade.

Gwinnett County (GA) Sheriff Butch Conway managed to cross that line, despite being invited to the White House to gush about the wonderful people at ICE. Conway blew nearly $70,000 in equitable sharing funds (the aforementioned partnership with the feds aided by federal forfeiture adoptions) on a tricked-out Dodge Hellcat. The DOJ recently sent a letter telling Butch it wants its money back.

The U.S. Department of Justice is demanding reimbursement for the nearly $70,000 that Gwinnett County Sheriff Butch Conway spent on the high-powered sports car he drives to and from work.

In a recent letter to Conway, the DOJ characterized the sheriff’s purchase of a Dodge Charger Hellcat — a 707-horsepower muscle car that some have called the fastest sedan ever built — as “extravagant.”

The federal government previously approved the purchase, which used asset forfeiture funds, but are now questioning if the Hellcat is being used for its stated purpose.

The sheriff dubiously claimed the high-powered sports car had "educational" value when applying for the funds. According to Sheriff Conway, the vehicle -- with a 707-hp engine and dark black tinted windows -- would be used at a local law enforcement event to [checks application] "inform teens about the dangers of distracted driving and street racing."

The event specifically named in the funds request only happens once a year. So, rather than let the vehicle idle in a law enforcement garage, Conway decided it could also be his daily driver. However, the DOJ isn't as concerned about this (mis)use of the $70,000 car. No, it's more worried about the other things Conway said the vehicle could help with, despite being something the DOJ considers an "extravagance" unable to be purchased with federal funds.

Guidelines prohibit “the use of equitably shared funds for extravagant expenditures,” the DOJ’s letter, dated July 10, said. “The vehicle in question is a high-performance vehicle not typically purchased as part of a traditional fleet of law enforcement vehicles.”

The feds also took issue with part of the request that stated Conway would also use the car for undercover and covert operations.

It seems like undercover and covert operations might be better served by a vehicle that didn't stick out like a customized one-of-a-kind sports car. The only way to grant the sheriff's claims credence is to assume he believes the "Fast and Furious" movies are a series of documentaries.

The DOJ will likely get its money back. For one thing, it's the DOJ. It's not as if the sheriff can go over its head. For another, the DOJ has informed Butch he gets no more federal funds until this "extravagant purchase" is repaid. Someone who just spent $70,000 in federal funds to upgrade his personal vehicle probably isn't ready to give up the nipple of what's easy. Sheriff Butch is just going to have to swallow his pride (and sense of entitlement) and give back the money he stole from citizens with the DOJ's assistance.



Permalink | Comments | Email This Story
09 Jul 03:28

Police Union Upset Not All Books Paint Cops As Heroes, Calls For Removal Of Titles From School's Reading List

by Tim Cushing

Nothing says summer vacation like a police union thinking it should get to decide what kids should or shouldn't be reading during their break. The Comic Book Legal Defense Fund (CBLDF) brings us the ridiculous news that the protective coating serving the thinnest skins in the public sector has feelings about teens thinking about stuff.

Community members, cops, and parents in one South Carolina school district are all pushing back against two summer reading books they believe propagate anti-police feelings. The books, The Hate U Give by Angie Thomas and All American Boys by Jason Reynolds and Brendan Kiely, were on a list of four titles for students taking an English 1 College Prep course. Both books mentioned have received numerous awards and accolades, including the Coretta Scott King Honor.

I wouldn't read too much into the "community members/parents" part of CBLDF's coverage. I'm sure there are some raising complaints, and they're probably the kind that find any criticism of law enforcement unwarranted. But local coverage of the controversy doesn't contain any comments from community members or parents. All it has are the assertions of the local police union boss.

President of the Fraternal Order of Police Tri-County Lodge #3, John Blackmon, says, "Whether it be through social media, whether it be through text message, whether it be phone calls, we've received an influx of tremendous outrage at the selections by this reading list."

He says in just the past two days, he has received hundreds of messages from police and community members.

We'll go ahead and accept these claims of mass complaints at face value just to keep the post moving.

The problem with the books is that neither of these two recommendations (students can pick from a list of eight books) portray police officers as they'd like to be seen, rather than as they actually are. "All American Boys" features a black teenager being assaulted by white police officer who mistakenly accuses him of shoplifting. "The Hate U Give's" protagonist sees her unarmed best friend shot and killed by a police officer. That's what bothers the union: plausible plot lines.

Blackmon says, "There are other socio-economic topics that are available and they want to focus half of their effort on negativity towards the police? That seems odd to me."

It's not half. It's one-quarter. (Reading comprehension appears to be only one of the union's problems.) But even if it were half, the union apparently believes no one should be letting teens know not all cops are heroes. And, as the CBLDF points out, one of the books complained about ("The Hate U Give") features a police officer as its "strong moral center" and a "positive role model for the main character."

Apparently, the police union would prefer teens learn how unpleasant cops can be through firsthand experience.

Blackmon says, "Freshmen, they're at the age where their interactions with law enforcement have been very minimal. They're not driving yet, they haven't been stopped for speeding, they don't have these type of interactions. This is putting in their minds, it's almost an indoctrination of distrust of police and we've got to put a stop to that."

"Forewarned is forearmed," people once said. But I guess today's teens should grow up in a bubble where every authority figure -- especially the shiny blue knights of law enforcement -- are portrayed as trustworthy, honorable, and deserving of respect.

The union's complaint only draws more attention to the books it doesn't like and allows more people to get a glimpse of the "gods among men" mentality that prevails in these organizations. Hopefully, the school won't pull the books from the recommendation list. Teens need to learn the world is far more complicated and ugly than they've been led to believe. This isn't indoctrination. It's not even remotely close to that. It's just two books with plausible plot lines on a list of eight books teens may possibly read over the summer. That they happen to feature officers acting the way officers actually act is an indictment of cops and their mentality, not some low-level brainwashing attempt by the school district. That the union views these selections as a threat speaks volumes about its childish "cops never do wrong" mindset.



Permalink | Comments | Email This Story
05 Jul 14:45

Cops Are Telling Paramedics To Inject Arrestees With Ketamine. Worse, EMS Crews Are Actually Doing It.

by Tim Cushing

Something strange and disturbing is going on in Minneapolis, Minnesota. Cops have been instructing paramedics to use certain drugs to subdue arrestees, which is about as advisable as allowing paramedics to instruct officers on use of force. Cops don't know what's best for arrestees in terms of medical care. The fact that paramedics have been following their instructions is the most disturbing fact of all. As the Star Tribune reports, cops telling EMS personnel what to do has put people's lives in jeopardy.

Minneapolis police officers have repeatedly requested over the past three years that Hennepin County medical responders sedate people using the powerful tranquilizer ketamine, at times over the protests of those being drugged, and in some cases when no apparent crime was committed, a city report shows.

On multiple occasions, in the presence of police, Hennepin Healthcare EMS workers injected suspects of crimes and others who already appeared to be restrained, according to the report, and the ketamine caused heart or breathing failure, requiring them to be medically revived. Several people given ketamine had to be intubated.

The paramedics are fully complicit in this horror show. They're overriding their own knowledge and medical training with catastrophic results. This atrocious behavior was exposed by a report from the Office for Police Conduct Review. The report showed ketamine injections increased from three in 2012 to 62 in 2017. It wasn't until this report was delivered to police that anyone decided to do anything about it. The Minneapolis Police Commander has now forbidden officers from instructing EMS crews to sedate a subject.

Ketamine is a dangerous drug. The police know this. They classify it as a "date rape" drug, capable of putting people into deep sedation and altering their memories. Healthcare providers know this, too, which is why they're often hesitant to use it as a sedative if the subject has preexisting breathing problems. Ketamine can kill under these circumstances. When used as a first response in the sedation of detainees, medical histories aren't available and the outcome can be death.

Allowing police to "prescribe" sedatives is a horrible idea. The report shows Minneapolis cops nuked arrestees with a powerful sedative just because. In many of the cases examined, there appeared to be no reason to escalate to a dangerous sedative.

To evaluate how the sedative was being used, the Office of Police Conduct Review investigators looked for mentions of the word in police reports, and then reviewed body camera footage from those cases.

“Multiple videos showed individuals requiring intubation after being injected with ketamine, and [police] reports indicate that multiple individuals stopped breathing and/or their hearts stopped beating after being injected with ketamine,” the report said.

The police encounters that led to EMS using ketamine ranged from cases of obstruction of justice to jaywalking, according to the report. One man was dosed with ketamine while strapped to a stretcher and wearing a spit hood.

Unbelievably, the story gets worse. Those dosed with ketamine at the suggestion of police officers suffered rude awakenings at Minneapolis hospitals. Hennepin Healthcare went ahead and enrolled detainees in its ketamine study without their consent. Supposedly consent isn't actually required by law, which makes a sort of cosmic sense when you're studying the effects of a date rape drug. "Enrollees" could opt out afterward, but that offers little comfort when you've been sedated so heavily you need a machine to breathe for you.

This study exacerbated Hennepin Healthcare's ketamine problem. Ramping up dosings at the request of cops had already increased the number of life-threatening reactions to the drug. This incentive allowed this to carried over to day-to-day work, resulting in EMS personnel using ketamine whenever possible, even without verbal shoves from under-educated cops.

Body camera footage from one case showed a woman, after being Maced by police, asking for an asthma pump, the draft report said.

Instead, a paramedic gave her an injection of ketamine.

“If she was having an asthma attack, giving ketamine actually helps patients and we’re doing a study for agitation anyway so I had to give her ketamine,” the unnamed paramedic told a police officer, according to the report.

After receiving ketamine, the woman’s breathing stopped, and medical staff resuscitated her, according to the report.

Of course, there's an explanation for all of this. It comes courtesy of Hennepin Healthcare's top official. And it sounds like something written by police officers, rather than an expert in the medical field.

Dr. William Heegaard, chief medical officer for Hennepin Healthcare, said ketamine can be a lifesaving tool when paramedics encounter people showing signs of “excited delirium,” a condition when severe agitation can lead to death.

When you're fighting a losing battle against negative press, the worst thing you can do is name a condition that originated with the pseudoscience of 19th century insane asylums and was revived by the manufacturer of Tasers to help law enforcement agencies bullshit their way through court cases involving citizens tased to death by cops.

In the past, Taser has hosted seminars and sent out pamphlets on excited delirium to police and medical examiners’ groups across the country; sued medical examiners who listed their stun guns as a cause of death; and even gave law enforcement agencies a ready-made statement for when someone dies after police shock them with a stun gun: “We regret the unfortunate loss of life. There are many cases where excited delirium caused by various mental disorders or medical conditions, that may or may not include drug use, can lead to a fatal conclusion.”

Heegaard's hospital and staff engage in highly-questionable behavior and he's trying to pin it on a condition most of the medical community doesn't recognize as an actual syndrome. This whole debacle shows just how far cops have strayed from the "serve and protect" ideal. This is all about making things as easy as possible for officers accompanying detainees to medical care facilities. They want them knocked out, even if it raises the risk of killing them.

It also shows how easy it is for abusive behavior to spread when it's originating from law enforcement officers. Paramedics know better. They know they're the first line of defense against further injury or trauma. And they're willing to throw that all away just because a cop tells them to dope up compliant detainees.

On top of everything, there's the skewed incentives of Hennepin Healthcare, which has found a way to gather subjects for studies by sedating them so heavily they can't possibly object to anything. There should be a whole lot of people in both fields filing for unemployment. But that isn't how thing work when cops are involved. New policies will be put in place and everyone who fucked citizens with unneeded ketamine injections will just go back to work with a mental note in place reminding them to be a bit more careful when abusing the public's trust.



Permalink | Comments | Email This Story
25 Jun 19:51

Leaked ICE Manual Shows Gov't Allowing Informants To Engage In Illegal Behavior, Impersonate Lawyers, Journalists, And Doctors

by Tim Cushing

The 9/11 attacks gave us the DHS. And from that atrocity came ICE. We used to get by with Customs and a Border Patrol, but no, we needed something additional that tied the homeland's "security" to a new, deeply brutal form of "customs enforcement." Normally, the word "customs" would suggest the rounding up of illegal imported goods or the collection of duty payments from incoming arrivals.

Instead, we were handed an agency that concerns itself mainly with ejecting people from the country in the most aggressive way possible, cheered on by White House officials and a large group of Americans who view our closest southern nation with deep suspicion and a touch of xenophobia. ICE's current activities aren't the fault of the Trump Administration, but this administration has done more than most to take everything that's bad about ICE (which is a lot) and crank it up to 11.

Warrantless raids, misrepresentation of advocacy efforts, deporting critical journalists… these are all part of ICE's playbook. But there's far more to it than this. The official "playbook" for ICE undercover operations basically allow the agency to operate as a criminal operation and engage in illegal activity for the greater good of booting immigrants out of the US.

The guidebook for ICE's undercover operations has been published by Unicorn Riot, which makes no statements about how it obtained this document. Its Twitter account refers to it as a "leak," which suggests this wasn't the result of a FOIA request. Regardless of its origins, it's a harrowing read. Many of the highlights of the 227-page manual [PDF] can be viewed in UR's tweet thread. Other details have been posted at its website, which takes a bullet-pointed trip through the entirety of the document.

What is crystal clear is that ICE undercover operations involve informants who are allowed to engage in criminal activity, including fun stuff like trafficking immigrants, purchasing stolen property, drug dealing, paying bribes, entrapment, and anything else that might be deemed "necessary" to ensure the viability of an investigation.

Informants are strongly encouraged not to engage in violent acts or entrapment, but given enough leeway to perform these acts if deemed necessary. The only thing that changes is the number of government officials receiving reports about these departures from policy guidelines.

If these sanctioned illegal acts happen to turn a profit, everyone wins. ICE itself can partake of funds obtained through illegal activity. Some of this is routed back to informants to purchase whatever's needed to continue the investigation. In many cases, this means funneling funds into purchasing supplies needed for further criminal activity. The funds may also be used to fund ICE itself. It's perfectly acceptable for ICE to use funds derived from the criminal activity of its informants to cover ICE agent overtime.

ICE is also authorized to create shell companies as cover for investigations. In ICE terminology, this is "backstopping" -- providing a credible back story for ICE operations should they happen to be investigated by their investigation targets. This ordained creation of shell companies allows ICE operatives to obtain fake SSNs, brokers licenses, medical degrees, pilots certifications, and immigration documents.

The shell companies themselves are made possible/plausible with the assistance of several federal agencies:

Federally-issued undercover identification/backstopping for undercover proprietary businesses and shell companies can be obtained through the Undercover Operations Unit.

Types of available corporate identification/backstopping include, but are not limited to, the following:

A. Employer Identification Numbers (EINs) (Note: All EINs must be obtained through the Undercover Operations Unit in order to avoid tax issues with the Internal Revenue Service);
B. Dun and Bradstreet reports;
C. Department of Transportation/Motor Carrier numbers;
D. Department of Defense Trade Compliance Registration numbers;
E. Office of Foreign Asset Control License;
F. FAA airplane registration number/certificates;
G. U.S. Coast Guard marine identification; and
H. business credit cards.

Then there's the list of personas undercover informants can adopt, which include priests/clergy, lawyers, doctors, therapists, and "news media." Naturally, some of these roles involve the harvesting of privileged communications -- even though the privilege is assumed by the person the informant is conversing with and certainly not extended by those working for ICE. But, as the handbook, points out, this puts informants in the position of overhearing actually privileged communications due to the nature of the charade, which may find them conversing with real lawyers, members of the clergy, doctors, and therapists.

This is referred to as "Sensitive Circumstances" by the DHS, an official designation that means nothing more than a case-by-case review rather than the blanket approval it extends to other undercover activities.

The guidebook, issued in 2008, may have seen some updates in recent months, but it's unlikely anything was added to rein in ICE's condoned criminal activity. Unicorn Riot notes it has confirmation this manual was still in use as of 2016, so it's not a relic of one particular administration. It apparently predates Obama's election and quite possibly extends into Trump's.

This shows how far our government is willing to go to enforce its laws. It will condone the breaking of laws in the name of enforcing them. The handbook may as well be named "End Justifies The Means" -- a 272-page compendium of acceptable means that would be unacceptable if anyone other than the government were engaged in them.



Permalink | Comments | Email This Story
09 Jun 13:48

FBI Hoovered Up Two Years Of A Journalist's Phone And Email Records To Hunt Down A Leaker

by Tim Cushing

The New York Times reports the FBI has crossed a line it's generally hesitant to cross. An investigation into classified info leaks by a Senate Intelligence Committee aide involved the seizure of two year's worth of a New York Times reporter's phone and email records.

The former aide, James A. Wolfe, 57, was charged with lying repeatedly to investigators about his contacts with three reporters. According to the authorities, Mr. Wolfe made false statements to the F.B.I. about providing two of them with sensitive information related to the committee’s work. He denied to investigators that he ever gave classified material to journalists, the indictment said.

[...]

Mr. Wolfe’s case led to the first known instance of the Justice Department going after a reporter’s data under President Trump. The seizure was disclosed in a letter to the Times reporter, Ali Watkins, who had been in a three-year relationship with Mr. Wolfe. The seizure suggested that prosecutors under the Trump administration will continue the aggressive tactics employed under President Barack Obama.

The war on unofficial transparency continues -- this time ensnaring a reporter. The indictment [PDF] shows Wolfe was in regular contact with four unnamed reporters and the classified info leaked apparently related to the investigation of Carter Page. (The indictment refers only to MALE-1.).

Despite all the dots connected by the Justice Dept. after hoovering up email and phone records of four reporters, none of the charges brought against Wolfe involved mishandling classified info. All three charges listed are for lying to the FBI, not exposing secret info. While the info obtained may have been necessary to prove Wolfe lied to investigators, it does seem like a serious breach first amendment boundaries for nothing but vanilla "lied to the feds" charges. Those charges are mostly there for the government to punish people when it thinks it can't nail down more serious charges.

And it is a breach of expected norms, if not a reliable indicator of how many civil liberties the government is willing to doormat to hunt down leakers and whistleblowers.

Under Justice Department regulations, investigators must clear additional hurdles before they can seek business records that could reveal a reporter’s confidential sources, such as phone and email records. In particular, the rules require the government to have “made all reasonable attempts to obtain the information from alternative, non-media sources” before investigators may target a reporter’s information.

In addition, the rules generally require the Justice Department to notify reporters first to allow them to negotiate over the scope of their demand for information and potentially challenge it in court. The rules permit the attorney general to make an exception to that practice if he “determines that, for compelling reasons, such negotiations would pose a clear and substantial threat to the integrity of the investigation, risk grave harm to national security, or present an imminent risk of death or serious bodily harm.”

It's not clear all these steps were followed. But there are a whole lot of exceptions available to the FBI to bypass these steps meant to protect the First Amendment. No one seems to have been notified beforehand, and it was far more than call/email metadata that was obtained. The indictment cites the content of encrypted messages -- suggesting yet another area where the FBI's "going dark" rhetoric is overblown.

After the story was published, WOLFE congratulated REPORTER #3, using Signal, stating "Good job!" and "I'm glad you got the scoop." REPORTER #3 wrote back, using Signal,"Thank you. [MALE-l] isn't pleased, but wouldn't deny that the subpoena was served."

Going after reporters' records may become standard operating procedure. The Obama Administration prosecuted more leakers and whistleblowers than all previous presidents combined. This administration appears ready to dwarf Obama's numbers.

Attorney General Jeff Sessions said last year that the Justice Department was pursuing about three times as many leak investigations as were open at the end of the Obama administration.

If the DOJ isn't going to give the First Amendment a wide berth, it's not going to be much friendlier to the rest of them -- like the Fourth. Aggressive pursuit of leakers -- and the attendant collection of reporters' communications/data -- will continue. The DOJ may have guidelines meant to limit investigators from obtaining journalists' records, but they're not much practical use when they can be waived to preserve the "integrity of the investigation."



Permalink | Comments | Email This Story
06 Jun 15:29

New Gear: The NSA Collection

by Leigh Beadon

Recently, the folks at Government Attic filed a FOIA request that garnered a very cool response: a collection of posters made by the NSA in the 1950s and 60s to remind its employees about security. It wasn't long before we got some requests to put them on t-shirts in the Techdirt Gear store and so... that's exactly what we've done!

You can now get 24 of the NSA's posters (with more coming soon) on premium t-shirts, hoodies and mugs from Teespring. Check out our store for the full NSA collection, or click the images below to go directly to the ones you like most.



Permalink | Comments | Email This Story
05 Jun 22:46

Apple just took a shot at Facebook's web-tracking empire

For years, Facebook's sneakiest data-collector has been the "Like" button. Any site that wants Facebook traffic needs one, which means they're just about everywhere. And in order to work right, the button needs to log you in - which is to say, it needs to know who you are. How else would Facebook know who liked the post? Even if you don't click, Facebook registers that you loaded the button, which means they get a map of every Like-enabled site you've been to, just the kind of data that advertisers will pay to target against. Today at WWDC, Apple took a direct shot at that system and Facebook itself. Onstage, Apple's VP of software Craig Federighi described Safari's new anti-tracking features in unusually confrontational terms. "We've all seen these like buttons and share buttons," Federighi told the crowd. "Well it turns out, these can be used to track you, whether you click on them or not. So this year, we're shutting that down." This is one of the very rare cases where competing corporate interests actually work out in the favour of consumers. One way or another, this will be added to all browsers.
05 Jun 18:48

E-Mails Show FCC Made Up DDOS Attack To Downplay The 'John Oliver Effect'

by Karl Bode

You might remember that when HBO comedian John Oliver originally tackled net neutrality on his show in 2014, the FCC website crashed under the load of concerned consumers eager to support the creation of net neutrality rules. When Oliver revisited the topic last May to discuss Trump FCC boss Ajit Pai's myopic plan to kill those same rules, the FCC website crashed under the load a second time. That's not a particular shock; the FCC's website has long been seen as an outdated relic from the wayback times of Netscape, hit counters, and awful MIDI music.

But then something weird happened. In the midst of all the media attention Oliver was receiving for his segment, the FCC issued a statement (pdf) by former FCC Chief Information Officer David Bray, claiming that comprehensive FCC "analysis" indicated that it was a malicious DDoS attack, not angry net neutrality supporters, that brought the agency's website to its knees:

"Beginning on Sunday night at midnight, our analysis reveals that the FCC was subject to multiple distributed denial-of-service attacks (DDos). These were deliberate attempts by external actors to bombard the FCC’s comment system with a high amount of traffic to our commercial cloud host. These actors were not attempting to file comments themselves; rather they made it difficult for legitimate commenters to access and file with the FCC."

But the FCC's claims were seen as suspect by numerous security experts, who say the crash showed none of the usual telltale signs of an actual DDOS. And reports subsequently emerged indicating that the "analysis" the FCC supposedly conducted never actually occurred. When media outlets began noticing that something fishy was going on, the Trump FCC issued a punchy statement accusing the media of being "completely irresponsible." No evidence was ever provided to journalists or lawmakers that pressured the agency for hard data proving the claims.

Fast forward to this week, and new internal FCC e-mails obtained via FOIA request show that yes, the FCC did routinely try to mislead the public and the press with repeated claims of DDOS attacks that never actually happened:

"The FCC has been unwilling or unable to produce any evidence an attack occurred—not to the reporters who’ve requested and even sued over it, and not to U.S. lawmakers who’ve demanded to see it. Instead, the agency conducted a quiet campaign to bolster its cyberattack story with the aid of friendly and easily duped reporters, chiefly by spreading word of an earlier cyberattack that its own security staff say never happened."

The story is worth a read, and highlights how former FCC CIO David Bray and FCC media relations head Mark Wigfield repeatedly fed false information about the nonexistent attack to reporters, then used those (incorrect) stories to further prop up their flimsy claims about the DDOS:

"Bray is not the only FCC official last year to push dubious accounts to reporters. Mark Wigfield, the FCC’s deputy director of media relations, told Politico: “there were similar DDoS attacks back in 2014 right after the Jon Oliver [sic] episode.” According to emails between Bray and FedScoop, the FCC’s Office of Media Relations likewise fed cooked-up details about an unverified cyberattack to the Wall Street Journal.

The Journal apparently swallowed the FCC’s revised history of the incident, reporting that the agency “also revealed that the 2014 show had been followed by DDoS attacks too,” as if it were a fact that had been concealed for several years. After it was published, the Journal’s article, authored by tech reporter John McKinnon, was forwarded by Bray to reporters at other outlets and portrayed as a factual telling of events. Bray also emailed the story to several private citizens who had contacted the FCC with questions and concerns about the comment system’s issues."

The story isn't going to get much mainstream traction thanks to numerous other instances of cultural idiocy we're all currently soaking in, but it's fairly amazing all the same. In short, the FCC appears to have completely concocted a fake DDOS attack in a ham-fisted effort to try and downplay the massive public opposition to its extremely-unpopular policies.

Of course that's pretty standard behavior for an agency that also blocked a law enforcement inquiry into fraud during the public comment period, likely also an effort to downplay massive public opposition to the repeal. It's also pretty standard behavior from a Trump administration that enjoys using bullshit to distract from the fact that countless policies (like repealing net neutrality) run in stark, violent contrast to the admin's "populist" election message.

This isn't likely to be the end of this story, and more details are likely to surface in the looming lawsuits against the FCC attempting to restore net neutrality.



Permalink | Comments | Email This Story
04 Jun 01:29

How to Android without Google

This guide shows how to install LineageOS without GApps with the help of signature spoofing and microG, so that you can have Push Notifications, Location Services and the like, without needing to have Google Play Services installed (without Google-anything for that matter). It was made possible by the hard work of creators, maintainers and community around LineageOS, microG, XPosedFramework, F-Droid, Yalp Store and many others. Exactly what it says on the tin.
01 Jun 20:37

TSA Has Been Compiling A Shitlist Of Travelers It Just Doesn't Like

by Tim Cushing

The TSA is the worst. Super-secret watchlists can keep people from flying -- people deemed too dangerous to travel but not dangerous enough to arrest. This isn't the TSA's fault. Not these lists. Those are maintained by agencies who could possibly cobble together enough intel to build a flimsy case against these "dangerous" would-be travelers.

The TSA, however, maintains its own database of travelers. It can't necessarily keep them from boarding airplanes, but it can give agents a heads up that the person in the queue probably needs to be detained and hassled. [via Boing Boing]

The Transportation Security Administration has created a new secret watch list to monitor people who may be targeted as potential threats at airport checkpoints simply because they have swatted away security screeners’ hands or otherwise appeared unruly.

A five-page directive obtained by The New York Times said actions that pose physical danger to security screeners — or other contact that the agency described as “offensive and without legal justification” — could land travelers on the watch list, which was created in February and is also known as a “95 list.”

It's an agency shitlist, and only the TSA knows who's on it. This list doesn't contain people who've actually assaulted agents, but people who've expressed their displeasure with intrusive gropings through words or non-violent deeds. The agency's official statements make it clear this is an arbitrary way to punish travelers who make agents unhappy, noting that it neither requires "injury" to a TSA employee nor the intent to do so. Instead, the list contains anyone who presents a "challenge" to the "safe and effective completion of screening."

That's about the end of the TSA's honesty on the matter, however.

So far, the names of fewer than 50 people have been put on the watch list, said Kelly Wheaton, a T.S.A. deputy chief counsel.

But two other government security officials who are familiar with the new watch list, describing it on the condition of anonymity because they were not authorized to discuss it, said that the number of names on the list could be higher, with travelers added daily.

Without evidence, the TSA claims a whole 34 of its screeners were "assaulted" last year. Keep in mind this number pales in comparison to the millions of travelers screened every year. The fact that this happened eight more times last year than it did the year before (26 in 2016) does not demonstrate the need for a special list of argumentative travelers. Also keep in mind the TSA's definition of "assault" -- much like law enforcement's -- covers actions or words that do cause "injury" and may have been committed with zero intent to cause harm.

On top of the seemingly punitive motivations for creating the "95 list", there's the fact that once you're on this list -- like other government lists targeting travelers -- you may never come off.

The directive obtained by The Times does not specify how members of the public can appeal being included on the list.

Just like all the other travel-related watchlists, then. Great. So, the TSA can freely antagonize travelers and slap them on a watchlist if they respond antagonistically. I guess we can mark this down as a win for terrorists because it sure doesn't feel like a win for Americans.



Permalink | Comments | Email This Story
31 May 19:06

Samsung won't be forced to update old phones

Samsung will not be forced to update the software on its mobile phones for years after their release, after it won a court case in the Netherlands. A consumer association had argued that Samsung should update its phones for at least four years after they go on sale. Regular software updates can address security problems but older models do not typically receive all the latest updates. However, the court rejected the association's claims. The fact that it might be difficult for poor Samsung to update phones weighed heavier than the safety and longevity of devices. Cool.
31 May 16:57

Congresswoman Says School Shootings Are Caused By Porn, Mental Illness, Single Parents... But Mostly Porn

by Timothy Geigner

In the wake of any mass or school shooting that occurs in America, which pretty much means most of the time that exists, everyone immediately runs to their preferred corners to blame their preferred target for the latest tragedy. I've pointed this out as often as I can, but the truth is that both gun violence and the incidence of mass shootings in America is a terribly complicated subject that deserves all the nuance and sober-thinking it could possibly be afforded. But, since this is America we're talking about, we tend to do the exact opposite and instead pick a single target and heap as much blame as we can on it. It's guns that's the problems. Or it's violent movies. Or video games. Those are the typical targets, and they have been for some time. Meanwhile, the shootings continue, nothing is done, and on it goes.

House Rep. Diane Black of Tennessee knows why this is. We've had the wrong target all along. The real cause of school shootings is porn.

During a meeting last week with local pastors, Black raised the issue of gun violence in schools and why it keeps happening.

“Pornography,” she said.

“It’s available on the shelf when you walk in the grocery store. Yeah, you have to reach up to get it, but there’s pornography there,” she continued. “All of this is available without parental guidance. I think that is a big part of the root cause.”

Where, oh where, is this magical world where porn is acquired at the local grocery store without any parental supervision? I'm asking because teenager-me would have really liked this world and, if a time machine is ever invented, I would like to travel back in time and tell him/me how to get there. The link above also asks a relevant question: what the hell kind of porn is Rep. Black watching? Because I've, ahem, heard third-party accounts of what pornography generally consists of and looks like, and violence generally is left at the fringes, while violence to do with mass shootings is something I've never even heard of. Especially in the kind of porn you can reasonably get in the local grocery store.

Sadly, Rep. Black failed to clarify what the hell she was talking about, so we're left to imagine where she is getting her school-shooting smut from. On top of evil, evil pornography, she also suggested that mental illness and broken families were the problem.

Beyond naughty movies, Black said school shootings are on the rise because of the “deterioration of the family,” mental illness and violent movies.

These feel like they're on more solid ground than blaming porn, but only in relative comparison to the former. It's still the same old problem of picking out a few scapegoats and pretending they explain America's mass shooting problem, rather than having an honest and nuanced view of all the contributing factors. Were we Americans to actually employ this logical mindset, we could then proceed with a real discussion of what we want to do about all the factors that play into school shootings.

But, naaaah. Blaming porn is way easier.



Permalink | Comments | Email This Story
31 May 04:01

Court Has No Problem With Multiple Invasive Probings In Search Of Drugs That Didn't Exist

by Tim Cushing

If a government employee suspects you might be carrying drugs, be prepared to engage in a nonconsensual, highly-intimate relationship with the feds and their helpers. A New Mexico resident suspected of carrying drugs was subjected to multiple anal probings and enemas before law enforcement finally decided he wasn't actually carrying any drugs on him (or in him). An 18-year-old Arizona woman was subjected to vaginal and anal probing when attempting to return from a short trip to Nogales, Mexico. Again, no drugs were found but the helpful medical "professional" decided to go from CBP accusation to painful probing, bypassing less intrusive options (x-rays, etc.) in his earnest desire to save America from illicit substances.

Another incident with lots of probing and violations but zero drugs has landed in the Fifth Circuit Appeals Court. Gloria Bustillos (an American citizen) was attempting to return to El Paso, Texas after a visit to Juarez, Mexico when CBP agents decided she must be trafficking drugs. The indignities began immediately. From the decision [PDF]:

First, two female agents conducted a pat down. The agents found no drugs. The agents then held Bustillos for a K-9 search. The K-9 failed to alert to the presence of drugs. Two agents then took Bustillos to a restroom, where they ordered her to pull down her pants and underwear and bend over slightly. The agents conducted a visual inspection of Bustillos’ vaginal and anal area. Again, the agents found no drugs.

Free to go? Not a chance.

Despite no evidence of drugs, the agents placed tape on Bustillos’ legs and abdomen, handcuffed her, and transported her to the University Medical Center (the “Hospital”) in El Paso.

At the Hospital, Doctors Michael Parsa and Daniel Solomin (the “Doctors”) ordered a series of x-rays to search for drugs. The x-rays revealed no drugs. The Doctors then performed a pelvic exam. Again, the pelvic exam evidenced no drugs. Solomin then conducted a rectal exam. Yet again, Solomin found no evidence of drugs. As part of these searches, the Doctors, and Nurses Lynette Telles and Frank Mendez (the “Nurses”), allegedly “brutally” probed Bustillos’ cavities in the presence of hospital personnel. Bustillos did not consent to any of the above searches.

Having been violated multiple times in an attempt to confirm the CBP's verifiably-wrong suspicions, Bustillos sued. And the court has nothing for her. The district court upheld immunity for the medical personnel who performed the series of invasive searches and the Fifth Circuit Appeals Court affirms this decision.

Bustillos argues that the Doctors and Nurses violated her Fourth Amendment right to be free from unreasonable searches and seizures by detaining her in order to conduct x-ray, pelvic, and rectal exams without reasonable suspicion of criminal activity. The district court held those allegations cannot overcome the Doctors’ and Nurses’ qualified immunity because the right at issue was not clearly-established. We agree and affirm on that ground.

This part sounds hopeful…

Nonetheless, we take this opportunity to clarify the constitutional duties of medical staff when they cooperate with law enforcement searches.

But it isn't. The appeals court holds that medical personnel are in no position to question the orders of government agents. CBP officers can make almost any statement and suggest courses of action and medical personnel should just shut up and do what they're told, even if less-invasive procedures suggest more-invasive procedures aren't any more likely to produce supposedly-hidden drugs. (Emphasis added.)

Accordingly, Bustillos’ allegations could potentially assert a constitutional violation. The complaint is, however, ambiguous on critical factual allegations. For instance, it is unclear who Bustillos alleges actually ordered the various searches. Further, it is unclear what the CBP officers told medical staff regarding their basis for requesting the various searches. These facts are important because the officers’ articulation of probable cause for a minimally invasive search, such as the x-ray, would not necessarily shield the Doctors and Nurses from liability for the more intrusive searches, such as the rectal probe, if the officers did not request that search or represent that sufficient suspicion justified it. However, if the officers requested all of the medical examinations, the Doctors and Nurses would have a strong argument that they had no duty to second-guess the Fourth Amendment basis for those searches.

But the appeals court stops there. It could have examined the sufficiency of the allegations. The court says the underlying facts (apparently not on the record) "are important" as they would what was done under the command of CBP officers and how many invasive searches were performed without direct instruction. Certainly medical personnel aren't well-positioned to questions law enforcement assertions -- and it may be ultimately correct that they should not be held liable for invasive tests ordered by the government. But the appeals court just discards the discussion without sending it back to the lower court to further assess the underlying facts. The appeals court simply says the right to be free of invasive medical searches performed possibly at the government's behest was "not clearly established." The "clarification" the court promised earlier in the decision materializes as a muddy paragraph that clarifies nothing because the court is unwilling to clarify it further than "maybe medical personnel shouldn't question law enforcement."

This failure of justice is made even more apparent when the court moves on to discuss Bustillos' challenge of the lower court's denial of discovery.

Bustillos claims that the district court abused its discretion by failing to grant her requests to conduct discovery prior to ruling on the motions to dismiss. We disagree.

Both motions for protective orders noted that the Doctors had asserted qualified immunity. “One of the most salient benefits of qualified immunity is protection from pretrial discovery . . . .” Backe v. LeBlanc, 691 F.3d 645, 648 (5th Cir. 2012). Thus, “[b]efore allowing discovery in a matter where qualified immunity is alleged, the district court must first find ‘that the plaintiff’s pleadings assert facts which, if true, would overcome’ a qualified immunity defense.” Williams-Boldware v. Denton Cty., 741 F.3d 635, 643 (5th Cir. 2014) (quoting Backe, 691 F.3d at 648).

Because Bustillos’ claims could not overcome the clearly-established prong of the qualified immunity defense, the district court did not err by declining to grant Bustillos’ discovery requests.

So, the court says plaintiffs in her situation are fucked. They can't sufficiently allege violated rights without more factual development, but the qualified immunity defense prevents discovery from even occurring. Plaintiffs apparently have to enter the court with all the facts on hand at the time of filing. Most government agencies are unwilling to hand over pertinent documents to victims of their malfeasance at any point, forcing plaintiffs to engage in an FOIA lawsuit (and secure a victory) before even attempting to file a civil rights lawsuit. The clock starts ticking on civil rights lawsuits the moment a violation occurs, making it all but impossible to win a public records suit (and secure helpful facts) prior to bringing allegations of rights violations to the court. Qualified immunity is an insanely high bar to meet, and it's only made worse when courts at the appellate level refuse to clarify constitutional duties of medical professionals beyond "if law enforcement is involved in any way, medical professionals can do whatever they want without worrying about being held liable for their actions."



Permalink | Comments | Email This Story
25 May 00:24

Essential up for sale, cancels next phone

Essential Products Inc., a startup co-founded by Android creator Andy Rubin that launched last year to great fanfare, is considering selling itself and has canceled development of a new smartphone, according to people familiar with the matter. Well, that was a short run.