• Tag Archives privacy
  • Five Eyes Unlimited: What A Global Anti-Encryption Regime Could Look Like

    This week, the political heads of the intelligence services of Canada, New Zealand, Australia, the United Kingdom, and the United States (the “Five Eyes” alliance) met in Ottawa.  The Australian delegation entered the meeting saying publicly that they intended to “thwart the encryption of terrorist messaging.” The final communiqué states more diplomatically that “Ministers and Attorneys General […] noted that encryption can severely undermine public safety efforts by impeding lawful access to the content of communications during investigations into serious crimes, including terrorism. To address these issues, we committed to develop our engagement with communications and technology companies to explore shared solutions.”

    What might their plan be? Is this yet another attempt to ban encryption? A combined effort to compel ISPs and Internet companies to weaken their secure products? At least one leader of a Five Eyes nation has been talking recently about increasing international engagement with technology companies — with a list of laws in her back pocket that are already capable of subverting encryption, and the entire basis of user trust in the Internet.

    Exporting Britain’s Surveillance Regime

    Before she was elevated to the role of Prime Minister by the fallout from Brexit, Theresa May was the author of the UK’s Investigatory Powers bill, which spelled out the UK’s plans for mass surveillance in a post-Snowden world.

    At the unveiling of the bill in 2015, May’s officials performed the traditional dance: they stated that they would be looking at controls on encryption, and then stating definitively that their new proposals included “no backdoors”.

    Sure enough, the word “encryption” does not appear in the Investigatory Powers Act (IPA). That’s because it is written so broadly it doesn’t need to.

    We’ve covered the IPA before at EFF, but it’s worth re-emphasizing some of the powers it grants the British government.

    • Any “communications service provider” can be served with a secret warrant, signed by the Home Secretary. Communications service provider is interpreted extremely broadly to include ISPs, social media platforms, mail services and other messaging services.
    • That warrant can describe a set of people or organizations that the government wants to spy upon.
    • It can require tech companies to insert malware onto their users’ computers, re-engineer their own technology, or use their networks to interfere with any other system.
    • The warrant explicitly allows those companies to violate any other laws in complying with the warrant.
    • Beyond particular warrants, private tech companies operating in the United Kingdom also have to respond to “technical capability notices” which will require them to “To provide and maintain the capability to disclose, where practicable, the content of communications or secondary data in an intelligible form,” as well as permit targeted and mass surveillance and government hacking.
    • Tech companies also have to the provide the UK government with new product designs in advance, so that the government can have time to require new “technical capabilities” before they are available to customers.

    These capabilities alone already go far beyond the Nineties’ dreams of a blanket ban on crypto. Under the IPA, the UK claims the theoretical ability to order a company like Apple or Facebook to remove secure communication features from their products—while being simultaneously prohibited from telling the public about it.

    Companies could be prohibited from fixing existing vulnerabilities, or required to introduce new ones in forthcoming products. Even incidental users of communication tech could be commandeered to become spies in her Majesty’s Secret Service: those same powers also allow the UK to, say, instruct a chain of coffee shops to use its free WiFi service to deploy British malware on its customers. (And, yes, coffee shops are given by officials as a valid example of a “communications service provider.”)

    Wouldn’t companies push back against such demands? Possibly: but it’s a much harder fight to win if it’s not just the UK making the demand, but an international coalition of governments putting pressure on them to obey the same powers. This, it seems is what May’s government wants next.

    The Lowest Common Privacy Denominator

    Since the IPA passed, May has repeatedly declared her intent to create a an international agreement on “regulating cyberspace”. The difficulty of enforcing many of the theoretical powers of the IPA makes this particularly pressing.

    The IPA includes language that makes it clear that the UK expects foreign companies to comply with its secret warrants. Realistically, it’s far harder for UK law enforcement to get non-UK technology companies to act as their personal hacking teams. That’s one reason why May’s government has talked up the IPA as a “global gold standard” for surveillance, and one that they hope other countries will adopt.

    In venues like the Five Eyes meeting, we can expect Britain to advocate for others to adopt IPA-like powers. In that, they will be certainly be joined by Australia, whose Prime Minister Malcolm Turnbull recently complained in the Australian Parliament that so many tech companies “are based in the United States where a strong libertarian tradition resists Government access to private communications, as the FBI found when Apple would not help unlock the iPhone of the dead San Bernardino terrorist.” Turnbull, it seems, would be happy to adopt the compulsory compliance model of the United Kingdom (as would, he implied at the time of the Apple case, would President Trump).

    In the meantime, the British authorities can encourage an intermediary step: other governments may be more likely to offer support for a IPA regime if Britain offers to share the results of its new powers with them.

    Such information-sharing agreements are the raison d’être of the Five Eyes alliance, which began as a program to co-ordinate intelligence operations between the Anglo-American countries. That the debate over encryption is now taking place in a forum originally dedicated to intelligence matters is an indicator that the states still see extracting private communications as an intelligence matter.

    But hacking and the subversion of tech companies isn’t just for spies anymore. The British Act explicitly granted these abilities to conduct “equipment interference” to more than just GCHQ and Britain’s other intelligence agencies. Hacking and secret warrants can now be used by, among others, the civilian police force, inland revenue and border controls. The secrecy and dirty tricks that used to be reserved for fighting agents of foreign powers is now available for use against a wide range of potential suspects.

    With the Investigatory Powers Bill, the United Kingdom is now a country empowered with a blunt tools of surveillance that have no comparison in U.S. or any other countries’ law. But, along with its Five Eyes partners, it is also seen as a moderate, liberal democracy, able to be trusted with access and sharing of confidential data. Similarly, Australia is one of the few countries in the world (and the only one of the Five) to legally compel ISPs to log data on their users. Canada conducts the same meta-data surveillance projects as the United States; New Zealand contributes its mass surveillance data to the shared XKEYSCORE project.

    While such data-sharing may be business as usual for the Cold War spies, the risk of such unchecked co-operation have been barely considered by the judicial and legislative branches.

    In the world of law enforcement, the UK has for the last year conducted a sustained lobbying campaign in the United States Congress to grant its police forces fast-track access to American tech companies’ communications data. The UK would be permitted to seize the contents of Google, Facebook and other companies’ customers’ inboxes without a U.S. court warrant. In return, the U.S. would gain a reciprocal capability over data held in the U.K.

    The danger is that, by forging broad agreements between these five countries, all will end up taking advantage of the lowest privacy standards of each. The United Kingdom will become the source of data obtained through the Investigatory Powers Bill; the United States will launder data taken from UPSTREAM and other programs through the United Kingdom’s legal system, and so on.

    Secret “Five Eyes” is not the venue for deciding on the future of global surveillance. Intelligence agencies and their secret alliances are no model for oversight and control of the much broader surveillance now being conducted on billions of innocent users of the public Internet. The Investigatory Powers Bill is no “gold standard.” Britain’s radical new powers shouldn’t be exported via the Five Eyes, either through law, or through data-sharing agreements conducted without judicial or legislative oversight.

    Source: Five Eyes Unlimited: What A Global Anti-Encryption Regime Could Look Like | Electronic Frontier Foundation

  • We Won’t Stop Terror by Sacrificing Internet Privacy

    We Won’t Stop Terror by Sacrificing Internet Privacy

    Government’s main and possibly only purpose should be the protection of its citizens. We delegate this responsibility to our governments so that we can better use our time to enjoy leisure activities and civilized pursuits not associated with law enforcement and security protection. When a government no longer provides that security and stability for its citizens, they rarely exist much past that point.

    Benjamin Franklin once said, “Those who would give up essential liberty, to purchase a little temporary safety, deserve neither liberty nor safety.” Many interpretations of this quote exist in relation to the current state of radical Islamic terrorism plaguing many countries throughout the world. How much of our freedom do we relinquish to secure our cities and our way of life?

    Massive Online Monitoring

    Benjamin Wittes, a senior fellow at the Brookings Institution and the editor of Lawfare, was interviewed a few years ago by Robert Siegel of NPR, stating that Franklin’s quote was misunderstood in the context of a changing landscape of threats and the digital revolution. He states,

    It is a quotation that defends the authority of a legislature to govern in the interests of collective security. It means, in context, not quite the opposite of what it’s almost always quoted as saying but much closer to the opposite than to the thing that people think it means.”

    Considering the most recent terror attack in London, which left 7 people dead and 50+ people injured thus far, English Prime Minister Theresa May has called for a massive uptick in online monitoring of social media accounts, among other measures, to monitor communication channels in hopes of locating and preventing terror attacks.

    “We cannot allow this ideology the safe space it needs to breed – yet that is precisely what the internet, and the big companies that provide internet-based services provide,” Ms. May said. But what does that mean?

    Charles Arthur at The Guardian and Andrew Griffin at The Independent make a case for the exact opposite intent occurring from drastic measures that Ms. May is proposing.

    “If successful, Theresa May could push these vile networks into even darker corners of the web, where they will be even harder to observe,” wrote Jim Killock, the executive director of the Open Rights Group, “But we should not be distracted: the Internet and companies like Facebook are not a cause of this hatred and violence, but tools that can be abused. While governments and companies should take sensible measures to stop abuse, attempts to control the Internet are not the simple solution that Theresa May is claiming.”

    This is precisely the point.

    The Internet Is Just a Tool

    The internet is not some animate being that aids or promotes terrorism. Facebook and Twitter don’t wake up in the morning and, over tea, decide to aid radical Islamic terror. Would we blame an ax for the crime committed with it and ban all axes from society? The logging industry just might have something to say about that. Likewise, with any tool, it is sheer foolishness to think that the regulation of its use will lead to reduced crime if we do not deal with the true root and cause of the crimes themselves.

    But this is not surprising from governments today that have a basic disregard for human freedoms. Out of control regulation and legislation in almost every area of life is commonplace. In fact, a case could be made that any area of life not regulated in some way by government presents a threat to the foundations of their existence.

    What relevancy would a nation-state have in your life if they removed regulation and allowed you to make free choices as you saw fit, rather than from a limited number of choices they have already pre-approved?

    Impacts from Ms. May’s action could be numerous with unintended consequences becoming manifold overnight. Would it not make more sense to allow more freedoms on the internet so that radical ideologies could be exposed, challenged and potentially marginalized or their believers’ ideas changed? More control of public discourse is a step on the road towards tyranny, not more freedom.

    Franklin may not have envisioned the internet existing, but his Pennsylvania Gazette was instrumental in overthrowing an oppressive regime that was enforcing its ideology on the colonies. British and American tradition is one of a metered response and the openness of discourse. Ms. May’s actions exhibit neither.

    So What Do We Do?

    The question becomes then, how do we combat terror. Is there a solution? Many have been batted around by western governments. U.S. President Donald Trump wants to effectively reduce travel from hotspot terror countries. Ms. May wants to regulate the internet. Angela Merkel believes that an openness of travel and a presentation of the superiority of western ideals will win the day.

    The solution to the problem of Islamic extremism will potentially be much more complicated than those, but not one that we should have to sacrifice our freedoms for, both to those who would take it away by committing acts of terror and to those who purport to know best how to keep us safe.

    In 1776, regular colonial citizens recognized that there was an ideological difference between British and Colonial rule. They took up arms to defend themselves because their governments at the time would not or could not keep them safe any longer. The same is happening in Western Europe and will most likely begin to happen in the U.S. soon. How long will it be before ordinary citizens will take up arms to prevent terror when their governments see only the removal of privacy, rights and freedoms as the solutions to a crisis?

    Friedrich Hayek in his book, The Road to Serfdom, writes extensively on the necessity of individual rights and government’s interest in removing those rights. He writes,

    It is true that the virtues which are less esteemed and practiced now  –  independence, self-reliance, and the willingness to bear risks, the readiness to back one’s own conviction against a majority, and the willingness to voluntary cooperation with one’s neighbors  –  are essentially those on which the of an individualist society rests. Collectivism has nothing to put in their place, and in so far as it already has destroyed then it has left a void filled by nothing but the demand for obedience and the compulsion of the individual to what is collectively decided to be good.”

    Much can be said about how western powers have aided the rise of radical extremism through interventionist and botched interventionist policies in the Middle East and elsewhere. Should we also pay the price for their mistakes in the confiscation of our rights to privacy and liberty? The people of Europe will have to make that hard choice.

    In the coming weeks, months and years we will also need to make hard choices about how to combat terror. What is true for now is that our governments cannot protect us sufficiently from radical Islamic terror and the problem seems to be worsening.

    One item I do agree with Ms. May on is that enough is enough. It’s about time we named our enemy and found ways to curb his ability to contribute to the destruction of our way of life. No one should have to live in fear of gangs of ideologically motivated men killing using vehicles, knives or bombs. These are marks of chaos and anarchy, not stability and freedom. Perhaps if we addressed the real cause of the problem we could take one step back towards a prosperous and open society.

    Reprinted from Politics Means Politics.

    John Bianchi

    John Bianchi is a marketing professional and the Chapter Leader for America’s Future Foundation in Raleigh. You can keep up to date with his articles on Medium here: https://medium.com/@johnmbianchi21.

    This article was originally published on FEE.org. Read the original article.

  • California Authorities Are Failing to Track and Prevent Abuse of Police Databases

    Police in California have your data literally at their fingertips.

    They can sit at a computer terminal or in their squad car and check your DMV records, your criminal records, your parking citations, any restraining orders you’ve filed or have been filed against you. They can search other state databases and even tap into the FBI’s trove. If you’ve got a snowmobile, they can look up that registration too. Much of this personal data they can access through a smartphone app.

    Is there a name for this information network? Yes, it’s really boring: the California Law Enforcement Telecommunications System (CLETS). Most people pronounce it “Clets.”

    Do police abuse their access to CLETS? You betcha. For example, they’ve used it to stalk their ex-partners, gain advantage in custody proceedings, and screen potential online dates. In one of the worst incidents, an officer allegedly attempted to leak records on witnesses to family of a convicted murderer. According to the latest data, 2016 was a record-breaking year: California hit a statewide, all-time high for police discipline involving CLETS; meanwhile the Oakland Police Department broke an all-time record for individual law enforcement agencies.

    Is anybody doing anything about CLETS misuse? Yes and no. Certainly EFF has been making noise about privacy violations involving CLETS. The government, not so much.

    For years, we’ve pushed for better data to track when California cops misuse CLETS data. We have filed request after request for misuse data under the California Public Records Act. We’ve sent letters, met with staff, assisted journalists, and spoken up during public meetings to demand state officials overseeing these databases take some sort of action. This is the third report we’ve published on misuse data.

    Yet state officials have made zero progress in addressing widespread database misconduct. No hearings on misuse have been held, no disciplinary actions have been taken, and the horror stories continue to mount.

    Who are these state officials? Get ready for another boring acronym: the CLETS Advisory Committee (CAC). Yes, CAC is an acronym containing an acronym. Most people pronounce it “Cack.”

    CAC was created by the California legislature decades ago to oversee CLETS as part policy body, part disciplinary board.  It comes under the California Department of Justice and works hand in hand with CADOJ’s Criminal Justice Information Services department.  CAC has 11 members, with more than half being appointed by special interest groups that lobby for law enforcement and municipalities. That means CAC is controlled by groups that are predisposed to support—not punish—their members.  As a result, the body has gone out of its way to pass policies that police ask for, while simultaneously taking a largely hands-off approach to discipline.

    It used to be that CADOJ and CAC investigated violations, but several years back they handed off that responsibility to the individual agencies that subscribe to CLETS.  Nowadays each of those agencies is required to file disclosures about each investigation they conduct, including an annual summary for CAC to review. Then CAC decides whether further administrative action is necessary

    Or at least that’s how it’s supposed to work. CAC has not even looked at the misuse data in years, and consequently, they’ve taken no action whatsoever against anyone or any department—not even a “don’t do it again” warning letter.

    What’s even worse is that they’ve been remarkably lax about whether agencies need to file anything about CLETS violations at all. This year some of the state’s largest law enforcement agencies failed to file the mandated paperwork. Meanwhile, agencies that do report often list investigations as “pending,” but never follow-up with the eventual outcome as required.

    So, when EFF obtained the latest round of misuse data, we knew it would be bad. But we also knew it would be incomplete—the tip of a very large, blue iceberg.

    Download the 2016 CLETS misuse data.  Previous data available: 2011-2014 (zip) and 2015 (xls)

    Screen grabs from official CLETS training videos. Source: Lemoore Police Department

    What the Misuse Data Told Us

    Police agencies disclosed that a total of 159 misuse investigations were launched in 2016. Of those, 117 investigations found that police had in fact abused CLETS. Another 39 cases were listed as pending conclusion. That means there were only a small number of cases—potentially in single digits—where an investigation cleared the officer.

    Let’s focus on those 117 cases of confirmed misuse. They represent a 14.5% increase over misuse in 2015, and a 50% increase over 2011.

    In 27 cases, the misuse was so severe that the offending police officer either resigned or was terminated. Three cases resulted in a misdemeanor conviction, and three cases resulted in a felony conviction.

    In 24 cases, no action was taken to discipline the offending officer at all. In 28 cases, the result was “counseling.” Another 21 mystery cases were listed as “other” action having been taken, leaving the public in the dark.

    When we opened the data file, two agencies immediately jumped out as repeat offenders.

    First, there was the Oakland Police Department, who for the first time since we’ve been collecting data, actually turned in their disclosures. That’s the good news.

    The bad news is that they reported 17 cases of CLETS misuse—the highest number for any agency in at least seven years. These are likely related to the