Shared posts

14 Apr 17:58

Virginia Mall Shooter Apparently Announced Crime in Advance on 4chan

by David Kravets
Brindle

Jesus Christ...

Virginia Mall Shooter Apparently Announced Crime in Advance on 4chan The man arrested today in connection to the shooting of two women at a suburban Virginia mall announced his crime minutes in advance on the 4chan message board.
13 Apr 12:43

YES: 15-Year Study Suggests Going Braless Is Better

braless-is-better.jpg Now I know what you're thinking, and yes, it would be awesome to swim through those like Scrooge McDuck. According to a 15-year study conducted by French professor Jean-Denis Rouillon (MUST HAVE BEEN A FUN 15 YEARS), wearing a bra doesn't prevent sagging breasts and may actually increase boob droop. *filling wastebasket with newspaper* What do you say -- let's burn those things, ladies!
Our first results confirm the hypothesis that the bra is a false need," Rouillon told France Info. "Medically, physiologically, anatomically, the breast does not benefit from being deprived of gravity. Instead, it languishes with a bra." The 15-year study involved 330 volunteers between the ages 18 and 35. Researchers measured their breasts using a slide ruler and a caliper and recorded any changes throughout the study period. Women who did not wear bras had a 7 millimeter lift as measured from their nipples each year. Their breasts were also firmer, and their stretch marks faded. There was also no evidence that the bras helped get rid of back pain. The researchers believed that wearing bras prevented the growth of breast tissue, which lead to deterioration of the muscles that support the breasts. If you don't wear a bra, the muscles are worked-out more, the findings suggest.
I mean, I understand there are TIMES when wearing a bra is a good idea, like when you're working out and don't want your titties throwing punches at the people on the treadmills around you. And sometimes for fashion purposes or whatever. Mostly I'm just bitter about those pesky bra clasps. You know how many times I've awkwardly fumbled with those things until the girl wasn't in the mood anymore? EVERY SINGLE ONE. As far as I know lady nips only exist in Photoshopped pictures on the internet. Thanks to Dave S and candice, who heard the same thing about wieners which is why you should never wear tighty whities.
13 Apr 12:42

FAA: No, You Can't Take Down a Plane With an Android App

by Ashley Feinberg
Click here to read FAA: No, You Can't Take Down a Plane With an Android App Remember how the internet got itself all riled up a few days ago when it found out that it would only take one rogue Android user to hack and take over an entire plane? Yeah, about that—it's not true. More »
    


12 Apr 14:03

Maryland The Latest State To Trample The First Amendment With Quixotic Attempt To Outlaw 'Cyberbullying'

by Mike Masnick
Cyberbullying seems to be a popular moral panic point for many politicians, who are just sure that (a) it's a huge huge problem impacting lots of kids and (b) the "cyber" element somehow makes it much, much worse than everyday bullying among kids. We've seen various states like Arizona and Louisiana pass absolutely ridiculous First Amendment-destroying laws trying to stamp out the scourge of people being jerks online. All of this despite the evidence that cyberbullying is a pretty minor thing, and the laws do little to stop what actual bullying happens online.

So, given all that, Maryland appears to be the next to spit on the First Amendment with its own "anti-cyberbullying legislation," which, like the others, seems to want to outlaw being a jerk online, if that behavior is directed at a child. While the bill the Assembly passed took out some of the worst language, it still has massive problems:
While electronic annoyance of an adult becomes criminal only if it continues after a request to stop, no such triggering provision is included for behavior that may annoy a minor. (And as I read it, there is no requirement that the defendant know that the person being subjected to intentional emotional distress is a minor — engaging in a vigorous “flame war” with a Maryland resident might turn out to be criminal if the username “ParentInLinthicum” turns out to conceal a teenage user.) Exceptions are made for speech that is intended to express political views or convey information, a curious pair of exemptions in that it has long been assumed that our First Amendment protects many types of seriously annoying speech other than those two.
In the long run, these kinds of laws only serve to create massive chilling effects on speech, and will, undoubtedly, be used to cause much more trouble for other children. As Walter Olson notes:
We are supposed to support this law — and some lawmakers I admire did support it — to show that we care about children. Once on the books, however, this law will assuredly ruin the lives and futures of other kids who will be the subject of investigations and prosecutions, and not all those kids are monsters whose ruin we should accept with equanimity
Yes, bullying sucks, but passing a law that ignores the First Amendment is never going to stop kids from saying mean things to one another -- though it might just put them in hellish situations in which they're prosecuted for doing things that kids do.

Permalink | Comments | Email This Story


10 Apr 14:03

Burner brings disposable phone numbers to Android handsets

by Kevin Krause
Brindle

Awesome.

Burner, the privacy-oriented app that debuted on iPhone last summer, is now officially available for Android. The purpose of Burner is to create “disposable” phone numbers that can be used for calls and SMS, then conveniently erased from existence. Ad Hoc Labs, the firm behind Burner, cites such uses as :posting contact information on social [...]
10 Apr 13:07

How Washington DC Went From Locking Up Laws To Releasing Them In The Public Domain Within Days

by Mike Masnick
Brindle

ouch.

In past years we've had stories about both Oregon and California claiming copyright over their own laws, which is ridiculous. If copyright is supposed to be about the incentives for creative expression, then it should have nothing to do with lawmaking at all. It's not as if the state needs a copyright incentive to write laws -- though some states have tried to argue that it needs the incentive to entice big corporate entities to print the laws. That, too, is ridiculous, as plenty of public domain info gets printed all the time -- and it really has no bearing on the simple fact that laws are public domain material, considering that the public is expected to know and obey them. While the Copyright Act makes it clear that any work done directly by federal government employees is automatically in the public domain, it's just slightly squishier when it comes to works from state governments, though there, too, it is generally believed that they fall in the public domain, as they should.

In the last week, a lot of attention was paid to the fact that Washington DC had been claiming a copyright on its laws, saying that you could not download a digital copy, and the state couldn't even release an entire copy of its own laws under a FOIA request, because of the copyright and the contract it held with outside publishing firms (initially West and, more recently, Lexis). As with the stories in Oregon and California, the person who helped drive attention to just how crazy this is was Carl Malamud, hero to everyone who believes in the importance of open access to public information. This time, he paid $803 for a copy of the code, scanned it all, and sent copies on USB drives in the shape of famous American Presidents to a bunch of folks.

Normally, at this point in the story, we hear about the local government hemming and hawing or even issuing vague threats. But not in the case of DC. Over the course of a few days, it appears that Washington DC's tech savvy General Counsel V. David Zvenyach quickly moved to deal with the problem. Part of the issue was that the only digital copy of the code that they had was the one given to them by West, and it contained a variety of extraneous information that was West's IP, including West logos on each section of the law (representing many thousands of copies). Zvenyach had Joshua Tauberer come by and spend a day removing every bit of West IP from the document and quickly releasing a downloadable copy of the DC Code with a CC0 public domain license.

That's pretty awesome. To go from having the code locked up for no good reason to a public domain downloadable release in days is pretty cool. Kudos to Malamud, Zvenyach and Tauberer for their part in this, as well as Tom MacWright, who first sought the copy of the code and brought this issue to the attention of Malamud and others.

Of course, it's not a perfect solution. As MacWright notes in his post about this release:
There are a few things that this isn’t: it isn’t the official copy of the code, and lawyers would be ill-advised to cite it alone. It isn’t up-to-date – the council is fast-moving and this is just a snapshot. In time we’ll fix these problems too.
Yes, even though it's being released directly by the DC Council on their website, it's designated as an "unofficial copy" and it's only up-to-date through last year. However, hopefully others will get it up to date, and eventually the DC Council will be able to list an "official" copy as well. Oh, and for those living in or around DC, MacWright is also planning a hackathon around this new code, to see what awesome and useful tools people can build on top of it.

Permalink | Comments | Email This Story


10 Apr 13:02

Google’s cracking down: removes 60,000 crapplications from the Google Play Store

by Chris Chavez
Quality control has long been a strong criticism with apps and games found in the Google Play Store, one that comes with the whole “open” turf. Now, it looks like Google has finally started cracking down on developers abusing the Play Store’s lax policies to spam and promote their crapware wherever they can. As reported [...]
09 Apr 14:02

Unlocking the Motorola Bootloader

by noreply@blogger.com (Dan Rosenberg)
I recently spent some time dissecting the bootloader used on Motorola's latest Android devices, the Atrix HD, Razr HD, and Razr M. The consumer editions of these devices ship with a locked bootloader, which prevents booting kernel and system images not signed by Motorola or a carrier. In this blog post, I will present my findings, which include details of how to exploit a vulnerability in the Motorola TrustZone kernel to permanently unlock the bootloaders on these phones.

These three devices are the first Motorola Android phones to utilize the Qualcomm MSM8960 chipset, a break from a long tradition of OMAP-based Motorola devices. Additionally, these three devices were released in both "consumer" and "developer" editions. The developer editions of these models support bootloader unlocking, allowing the user to voluntarily void the manufacturer warranty to allow installation of custom kernels and system images not signed by authorized parties. However, the consumer editions ship with a locked bootloader, preventing these types of modifications.

Supported Bootloader Unlocking

From the perspective of the user, unlocking the bootloader on a developer edition device is fairly straightforward. The user must boot into "bootloader mode" using a hardware key combination (usually Vol Up + Vol Down + Power) at boot. Next, the standard "fastboot" utility can be used to issue the following command:
fastboot oem get_unlock_data
In response to this command, an ASCII blob will be returned to the user. The user must then submit this blob to the Motorola bootloader unlock website (https://motorola-global-portal.custhelp.com/app/standalone/bootloader/unlock-your-device-a). If the user's device is supported by the bootloader unlocking program (i.e. if it's a developer edition device), the website will provide a 20-character "unlock token".

To complete the process, the user issues a final fastboot command:
fastboot oem unlock [token]
At this point, the bootloader unlocks, and the user may use fastboot to flash custom kernel and system images that have not been signed by Motorola or the carrier.

QFuses and Trusted Boot

Much of Qualcomm's security architecture is implemented using QFuses, which are software-programmable fuses that allow one-time configuration of device settings and cryptographic materials such as hashes or keys. Because of their physical nature, once a QFuse has been blown, it is impossible to "unblow" it to revert its original value.

If the FORCE_TRUSTED_BOOT QFuse is blown, as is the case on all production Motorola devices, each stage of the boot chain is cryptographically verified to ensure only authorized bootloader stages may be run. In particular, the PBL ("Primary Bootloader"), which resides in mask ROM, verifies the integrity of the SBL1 ("Secondary Bootloader") via a SHA1 hash. Each stage of the boot chain verifies the next stage using RSA signatures, until finally Motorola's APPSBL ("Application Secondary Bootloader"), "MBM", is loaded and run.

Checking the Bootloader Status

The entirety of the Android OS signature verification and bootloader unlocking process is implemented in MBM. To study the implementation, I examined the "emmc_appsboot.mbn" binary included in a leaked SBF update package for the Motorola Atrix HD. It's also possible to pull this partition directly from a device via the /dev/block/mmcblk0p5 block device.

To start, because the binary blob is an undocumented format, I assisted IDA Pro in identifying entry points for disassembly. Next, I searched for cross-references to strings referring to unlocking the bootloader. After getting my bearings, I identified the function responsible for handling the "fastboot oem unlock" command. The reverse engineered pseudocode looks something like this:
int handle_fboot_oem_unlock(char *cmd)
{
    char *token;

    if ( is_unlocking_allowed() != 0xff )
    {
        print_console("INFO", "fastboot oem unlock disabled!");
        return 3;
    }

    if ( is_device_locked() != 0xff )
    {
        print_console("INFO", "Device already unlocked!");
        return 3;
    }
    token = cmd + 12;    /* offset of token in "oem unlock [token]" */

    if ( strnlen(token, 21) - 1 > 19)
    {
        print_console("INFO", "fastboot oem unlock [ unlock code ]");
        return 0;
    }

    if ( !validate_token_and_unlock(token) )
    {
        print_console("INFO", "OEM unlock failure!");
        return 3;
    }

    return 0;
}

Of particular note are the is_unlocking_allowed() and is_device_locked() functions. Further reversing revealed that these functions query values stored in particular QFuses by accessing the QFPROM region, which represents the contents of the QFuses, memory-mapped at physical address 0x700000. In particular, these two functions invoke another function I called get_mot_qfuse_value(), which queries the value stored in a specific QFuse register.

Having reversed this behavior, the implementation of is_unlocking_allowed() is simple: it returns the "success" value (0xff) if get_mot_qfuse_value(0x85) returns zero, indicating the value in the QFuse Motorola identifies with 0x85 is zero (this register happens to be mapped to physical address 0x700439). In other words, by blowing this particular QFuse, unlocking may be permanently disabled on these devices. Fortunately, this has not been performed on any of the consumer editions of these devices.

The logic behind is_device_locked() is a bit more complex. It invokes a function I called get_lock_status(), which queries a series of QFuse values to determine the status of the device. Among others, it checks the QFuse values for identifiers 0x85 ("is unlocking disabled?") and 0x7b ("is the Production QFuse blown?"). If the Production bit isn't set, get_lock_status() returns a value indicating an unlocked bootloader, but this QFuse has been blown on all released models. Otherwise, if unlocking hasn't been permanently disabled, the result is based on two additional conditions.

If the QFuse with identifier 0x84, which is mapped to physical address 0x700438, hasn't been blown, the status is returned as "locked". It turns out this is the QFuse we're looking for, since blowing it will result in unlocking the bootloader! If this QFuse has been blown, there is one final condition that must be satisfied before get_lock_status() will return an "unlocked" status: there must not be a signed token in the SP partition of the phone. Further investigation revealed that this token is only added when the user re-locks their bootloader using "fastboot oem lock", so it does not pose any obstacle when trying to unlock the bootloader.

Token Validation

If the bootloader has not already been unlocked, MBM will attempt to validate the token provided by the user. More reversing revealed that the following logic is used:
  1. The CID partition is read from the device.

  2. A digital signature on the CID partition is verified using a certificate stored in the CID partition.

  3. The authenticity of the certificate is verified by validating a trust chain rooted in cryptographic values stored in blown QFuses.

  4. The user-provided token is hashed together with a key blown into the QFuses using a variant of SHA-1.

  5. This hash is compared against a hash in the CID partition, and if it matches, success is returned.

As a result, there is no way for a user to generate his or her own valid unlock token without either breaking RSA to violate the integrity of the CID partition, or by performing a pre-image attack against SHA-1, both of which are computationally infeasible in a reasonable amount of time.

Edit: The original post claimed the algorithm used was MD4. I mistakenly identified the algorithm because MD4 and SHA-1 evidently share some of the same constant values used during initialization. Thanks to Tom Ritter, Melissa Elliott, and Matthew Green for discussing this and inspiring me to take another look.

Introducing TrustZone

Having run into this dead-end, I examined what actually takes place when a successful unlock token is provided. We already know that MBM must somehow blow the QFuse with Motorola identifier 0x84 in order to mark the bootloader as "unlocked".

It accomplishes this by calling a function that invokes an ARM assembly instruction that may be unfamiliar to some: SMC (Secure Monitor Call). This instruction is used to make a call to the ARM TrustZone kernel running on the device.

TrustZone is an approach to security integrated into many modern ARM processors. TrustZone operates in what's known in ARM parlance as the "Secure world", a trusted execution mode whose security is enforced by the processor itself. Among other tasks, TrustZone may designate "Secure memory", which cannot be read from the "Non-secure world", regardless of privilege level. Even if code is running in SVC (kernel) mode, attempts to access a Secure memory region from a Non-secure execution context will cause the CPU to abort.

The Secure world stack is often implemented as a small trusted kernel. On these particular Motorola devices, the TrustZone kernel resides on the TZ partition of the device and is loaded at early boot, prior to MBM. The Non-secure world may issue requests to the Secure world using the privileged SMC instruction.

In this case, it became clear that MBM issues a specific SMC call to request that the TrustZone kernel blow the appropriate QFuse to unlock the bootloader on the device.

Communicating with TrustZone

For a first naive attempt at unlocking the bootloader, I decided to deconstruct the syntax of the SMC call made by MBM and make an identical call from kernel mode in the Android OS.

Fortunately, Qualcomm-based Linux kernel trees have source code that reveals the syntax of these SMC calls. Looking at arch/arm/mach-msm/scm.c reveals that calls to Qualcomm-based TrustZone kernels are expected to pass arguments using the following data structure:
struct scm_command {
    u32 len;
    u32 buf_offset;
    u32 resp_hdr_offset;
    u32 id;
    u32 buf[0];
};
Understanding this data structure clarified the SMC calling convention I saw in MBM. In particular, when issuing the call to unlock the bootloader, MBM sets an id of 0x3f801 and provides a buf array of four words, containing the values 0x2, 0x4, 0x1, and 0x0, in that order. Based on looking at additional MBM code, it appears that the 0x4 represents a word offset within the QFuse bank beginning at 0x700428, and 0x1 represents a bitmask indicating which bits within that word should be blown. This makes sense, since this call would result in blowing the QFuse at physical address 0x700438, which we already determined would unlock the bootloader.

With this knowledge in hand, I threw together a kernel module that would issue an identical SMC call to hopefully unlock the bootloader. I loaded this module into the Android OS's Linux kernel and...it returned an error code of -1001.

Inside TrustZone

To see what was going on here, I knew I would need to reverse engineer portions of the TrustZone kernel running on the device. After loading the tz.mbn binary blob contained in an SBF update package into IDA Pro, rather than reversing the entire kernel I made a quick search for the immediate value 0xfffffc17 (-1001) to see if I could skip straight to the code I was interested in. Sure enough, there was only one function containing this value.

Taking a look at this function revealed the following pseudocode:
int handle_smc(int code, int arg1, int arg2, int arg3)
{

    int ret;

    switch (code) {
    ...
    case 2:
        if (global_flag) {
            ret = -1001;
        }
        else {
            /* Perform unlock */
           ...
           ret = 0;
        }
        break;
    case 3:
        global_flag = 1;
        ret = 0;
        break;
    ...
    }
    return ret;
}
Based on this code, it appears that the first word in the SMC buffer represents a command code (in our case it's 0x2). The reason TrustZone is returning an error on our SMC call from the Android kernel is a particular one-way global flag residing in TrustZone secure memory has apparently been set by MBM before booting the Android OS, preventing all subsequent calls to blow QFuses. Going back to the MBM code, I confirmed this by identifying an SMC call with a command code of 0x3 invoked immediately before booting Linux. Another dead end.

Exploiting TrustZone

At this point, the end was in sight, but I knew I would need a vulnerability in the TrustZone kernel in order to set this flag to zero, allowing my SMC call to blow the QFuse required to unlock the bootloader. Fortunately, I didn't have to look long, since one of the other SMC commands in the same section of the TrustZone kernel contains a fairly obvious arbitrary memory write vulnerability:

    switch (code) {
        ...
        case 9:
            if ( arg1 == 0x10 ) {

                for (i = 0; i < 4; i++)
                    *(unsigned long *)(arg2 + 4*i) = global_array[i];
                ret = 0;

            } else
                ret = -2020;
            break;
        ...
    }

This SMC call, invoked with command code 0x9, is evidently intended to allow the Non-secure Linux kernel to obtain values stored in a particular region of Secure memory. The value provided as the second argument in the SMC buffer is used as the physical address at which this memory is copied. This code does not check that the provided physical address corresponds to a Non-secure memory region, so it can be used to overwrite memory in a Secure region, including our global flag.

At this point, I had everything I needed. As a test, I issued the vulnerable SMC call while providing a physical address in Non-secure memory that I could read back. Fortunately, it appears that all but the first of the four words that are written by the vulnerable code are zeroes, allowing me to clear our global flag preventing a bootloader unlock. Finally, I put it all together by aiming the arbitrary TrustZone memory write to zero the flag and issuing the SMC call with command code 0x9, and then finally issuing the SMC call with command code 0x2 to unlock the bootloader. Rebooting my test device into bootloader mode and checking the bootloader status with "fastboot getvar all" showed I had been successful, and the bootloader was now unlocked!

As previously mentioned, this exploit will work on all Qualcomm-based Motorola Android phones, which includes the Razr HD, Atrix HD, and Razr M.
07 Apr 15:52

Comic for April 7, 2013

Brindle

s/firewall/selinux/g

04 Apr 23:55

Google Takes on Rare Fight Against National Security Letters

by Kim Zetter
Google Takes on Rare Fight Against National Security Letters Google has filed a rare petition to challenge an ultra-secret national security letter issued by the government to obtain private data about one or more of its users.
04 Apr 23:50

Police Officers Association Director On Facebook: Being Sexually Assaulted By A State Trooper Is Hilarious!

by Tim Cushing

If you've ever wondered why public agencies have such ridiculously stringent social media policies (for instance, DHS employees can't even view the agency's Facebook page while at work), it's likely because of unfortunate instances like the following.

A Texas state trooper charged with sexually assaulting two women during a traffic stop was providing them with "customer service," says Dale Roberts, the executive director of the Columbia Police Officers Association (CPOA) and a professor at the University of Missouri. (The CPOA is a part of the Fraternal Order of Police, one of the country's largest police unions.)

"It's called Customer Service!" Roberts wrote in a March 27 Facebook post about the indictment of Texas State Trooper Kelly Helleson, who was charged with two counts of sexual assault after conducting an illegal roadside strip search of two women. "We just did it so they wouldn't have to make the trip all the way down to the station," he added.
Beautiful.

Granted, Dale Roberts isn't actually a government employee, but he is a member of a group that is pretty much inseparable from law enforcement. Roberts, through his personal Facebook account, has managed to portray the groups he represents as populated with the sort of people who laugh off serious police misconduct. As you can see in the screenshot archived by Keep Columbia Free, Roberts seemed to think that it was worth joking repeatedly about this indictment.

Obviously, Angel Dobbs and her niece Ashley probably don't see the humor in the situation because they were the "situation." Here's a quick rundown of the events that led to Trooper Helleson's indictment.

The two women were pulled over last year by Helleson and fellow trooper David Farrell (who was charged with theft when a bottle of prescription pills went missing from Dobbs' vehicle after the illegal search) in Irving, Texas, after throwing a cigarette butt out the window of their car. Farrell came up to the car and claimed he smelled marijuana. When a search of the vehicle didn't turn up any pot, he instructed Helleson to conduct a cavity search on the women, who Farrell said were "acting weird." That's when Helleson, in plain view of passing cars on Highway 161 (and the dashboard camera in her cruiser), stuck her hand down the back and front of both women's pants, searching their genitals. To make matters worse, Helleson conducted both searches without changing her latex gloves. In short order, the Dobbs filed suit and video of the stop was posted on Youtube. [Following video possibly NSFW.]

As if his original post wasn't offensive enough, Robert's followed it up with another pithy sexual assault joke, stating "Evidently, the [sic] searched them downtown without going downtown." It should also be noted that Roberts has a hard time keeping his keyboard from overriding his better judgement. He was also criticized for a making a racist joke on the CPOA's Facebook page (where he is an administrator) last month.

Government agencies and closely-aligned entities contain just as many badly behaving and ill-mannered people as any cross section of the populace. Harsh social media policies are a direct result of actions like these. It would be nice to see people like Roberts weeded out of influential organizations by this sort of offensive stupidity, but the most common reaction seems to be across-the-board social media restrictions. Muzzling people with policy is simpler than cleaning up any internet messes they might make.

Whether Roberts likes it or not, he is the face of the CPOA, whether posting on the association's Facebook page or his personal one. He may just be "joking," but his subject matter isn't appropriate considering his position with the police union. Roberts is welcome to say whatever he wants, but the CPOA would be greatly served by ousting a repeat offender that portrays the organization in a negative light. Silence on this matter implies approval of Roberts' comments and strongly suggests that many in the organization believe that abusing citizens is not only OK, but inherently funny.



Permalink | Comments | Email This Story


04 Apr 23:45

DOJ Trying To Hide Secret Interpretations Of The Law Because You'd All DIE!!!!

by Mike Masnick
It's kind of sad that anyone could possibly think that it's okay for the government to have secret interpretations of the law in a free and open society. "The law" is more than just the legislation itself, but the collection of caselaw and interpretations, combined with the legislation, that make up the overall "law." If some of those interpretations are kept secret, then how can the public obey the law? The answer is that they can't -- which is why secret interpretations shouldn't be allowed. The Justice Department, however, prefers to keep some things secret, and it's asking the court to dismiss a lawsuit filed by the EFF seeking to find out how the Foreign Intelligence Surveillance Court is interpreting parts of the FISA Amendments Act, after it was revealed (late on a Friday) that the court found at least one situation in which the feds collected info in violation of the 4th Amendment.

The EFF figured the public should know the details. The DOJ on the other hand... would rather the public stay in the dark. The DOJ actually suggests that merely revealing the fact that they got slapped down by the FISC provides enough "balance."
Last summer, in an effort to strike the right balance between government transparency and the protection of critical intelligence activities, the government declassified four statements concerning its activities pursuant to Section 702 of the Foreign Intelligence Surveillance Act (“FISA”) Amendments Act of 2008. Not content with that disclosure, Electronic Frontier Foundation (“EFF” or “Plaintiff”) submitted a Freedom of Information Act (“FOIA”) request seeking additional information related to two of the declassified statements, specifically, that on at least one occasion the Foreign Intelligence Surveillance Court (“FISC”) “held that some collection carried out pursuant to the Section 702 minimization procedures used by the government was unreasonable under the Fourth Amendment” and that “on at least one occasion the FISA Court has reached th[e ] conclusion” that “the government’s implementation of Section 702 of FISA has sometimes circumvented the spirit of the law.”
And thus, we should be satisfied with that and want no more. Also, you don't want to know what kind of hell would break loose if the DOJ had to reveal how the law was actually interpreted. I mean, we'd all die or something very close to it, judging by the DOJ's language.
The government has determined that disclosure of the information withheld from Plaintiff could result in exceptionally grave and serious damage to the national security. Plaintiff obviously cannot contend otherwise. The Court accordingly should defer to the government’s determination in this case, uphold the Department’s withholdings, and grant this motion.
Basically, we've determined that you're all better off not knowing this information, and you should trust us because it's not like we have any incentives to lie (though, of course, we do). Also: boo!

Thankfully, more people are realizing just how ridiculous this is. The Washington Post has put out an editorial slamming the DOJ for its position:
Yet, as the amicus brief points out, the OLC’s opinions aren’t some intermediary step toward establishing the final legal interpretations for the executive branch. In general, they are the final legal interpretations for the executive branch. The FBI could choose to exercise the authority that the OLC said it had — or not — but Congress, the judiciary and the public at large all deserve to know what the executive branch thinks it can do, once it issues a conclusive opinion.
In other words, it's not right that the government can determine its own secret interpretations of the law, and it's time for the courts to put a stop to this.

Permalink | Comments | Email This Story


04 Apr 23:45

New Evidence: Homeland Security Spied On Peaceful Protestors; Worried About Protests Getting News Coverage

by Mike Masnick
We just recently had a post on the head of one of Homeland Security's "Fusion Centers" (the same Fusion Centers found by a Congressional investigation to be a near total waste of time and money, finding no terrorists, but violating the public's civil liberties) who claimed that the DHS centers did not spy on Americans, and then immediately admitted that they spied on "anti-government" Americans.

The definition of "anti-government" was mostly left as an exercise to the reader. However, in a bout of good timing, the Partnership for Civil Justice has released some new DHS documents it received via a Freedom of Information Act (FOIA) request, showing that DHS regularly spied on peaceful demonstrators and activists. Because exercising your First Amendment rights must make you one of them there "anti-government" Americans, which means the DHS is free to spy on you.
Functioning as a secret political police force against people participating in lawful, peaceful free speech activity, the heavily redacted documents show that the DHS “Threat Management Division” directed Regional Intelligence Analysts to provide a “Daily Intelligence Briefing” that includes a category of reporting on “Peaceful Activist Demonstrations” along with “Domestic Terrorist Activity.” (p. 68)

The PCJF has obtained thousands of pages of documents pursuant to its Freedom of Information Act demands and made them available for public viewing. The newly obtained documents show coordination and intelligence monitoring by the DHS, the FBI, the NYPD and other law enforcement agencies of “Occupy-type” protests.

The documents show the routine use of Fusion Centers for intelligence gathering on peaceful demonstrations as well as the use of DHS’ “Mega Centers” for collection of surveillance information on demonstrations.
And it's not just the big cities. The new documents show that DHS is involved in spying on peaceful protesters and activists around the country. It also shows that DHS helped local law enforcement "crack down" on the various Occupy gatherings. But the key thing is that DHS seems to have no qualms at all about spying on anyone who disagrees with the prevailing positions of today's federal government. And it's clearly not because they're trying to protect others from any threat of actual harm. They seem to be focused on spying to further the goal of preventing the administration from looking bad:
The documents show a Department of Homeland Security that appears obsessed with the question of whether any and all protests that are being surveilled receive media attention and coverage. Reporting within the DHS on media coverage of First Amendment protected activities, even in the smallest places, appears to be a routine part of DHS intelligence reports. None of the documents explain why media coverage of peaceful demonstrations is of interest to law enforcement or concerns “homeland security” in any way.
That's because it doesn't concern "homeland security" at all. It concerns the job security of those employed by Homeland Security.

Permalink | Comments | Email This Story