Another Word For It Patrick Durusau on Topic Maps and Semantic Diversity

June 26, 2015

DuckDuckGo search traffic soars 600% post-Snowden

Filed under: Privacy,Search Engines,Searching — Patrick Durusau @ 7:42 pm

DuckDuckGo search traffic soars 600% post-Snowden by Lee Munson.

From the post:

When Gabriel Weinberg launched a new search engine in 2008 I doubt even he thought it would gain any traction in an online world dominated by Google.

Now, seven years on, Philadelphia-based startup DuckDuckGo – a search engine that launched with a promise to respect user privacy – has seen a massive increase in traffic, thanks largely to ex-NSA contractor Edward Snowden’s revelations.

Since Snowden began dumping documents two years ago, DuckDuckGo has seen a 600% increase in traffic (but not in China – just like its larger brethren, its blocked there), thanks largely to its unique selling point of not recording any information about its users or their previous searches.

Such a huge rise in traffic means DuckDuckGo now handles around 3 billion searches per year.

DuckDuckGo does not track its users. Instead, it makes money off of displaying key word (from your search string) based ads.

Hmmm, what if instead of key words from your search string, you pre-qualified yourself for ads?

Say for example I have a topic map fragment that pre-qualifies me for new books on computer science, break baking, and waxed dental floss. When I use a search site, it uses those “topics” or key words to display ads to me.

That avoids displaying to me ads for new cars (don’t own one, don’t want one), hair replacement ads (not interested) and ski resorts (don’t ski).

Advertisers benefit because their ads are displayed to people who have qualified themselves as interested in their products. I don’t know what the difference in click-through rate would be but I suspect it would be substantial.

Thoughts?

BBC Pages Censored by the EU

Filed under: Censorship,EU,Privacy — Patrick Durusau @ 1:50 pm

List of BBC web pages which have been removed from Google’s search results by Neil McIntosh.

From the post:

Since a European Court of Justice ruling last year, individuals have the right to request that search engines remove certain web pages from their search results. Those pages usually contain personal information about individuals.

Following the ruling, Google removed a large number of links from its search results, including some to BBC web pages, and continues to delist pages from BBC Online.

The BBC has decided to make clear to licence fee payers which pages have been removed from Google’s search results by publishing this list of links. Each month, we’ll republish this list with new removals added at the top.

We are doing this primarily as a contribution to public policy. We think it is important that those with an interest in the “right to be forgotten” can ascertain which articles have been affected by the ruling. We hope it will contribute to the debate about this issue. We also think the integrity of the BBC’s online archive is important and, although the pages concerned remain published on BBC Online, removal from Google searches makes parts of that archive harder to find.

The pages affected by delinking may disappear from Google searches, but they do still exist on BBC Online. David Jordan, the BBC’s Director of Editorial Policy and Standards, has written a blog post which explains how we view that archive as “a matter of historic public record” and, thus, something we alter only in exceptional circumstances. The BBC’s rules on deleting content from BBC Online are strict; in general, unless content is specifically made available only for a limited time, the assumption is that what we publish on BBC Online will become part of a permanently accessible archive. To do anything else risks reducing transparency and damaging trust.

Kudos for the BBC for demonstrating the extent of censorship implied by the EU’s “right to be forgotten. The “right to be forgotten” combines ignorance of technology with eurocentrism at its very worst. Not to mention being futile when directed at a search engine.

Just to get you started, here are the links from the post:

One caveat: when looking through this list it is worth noting that we are not told who has requested the delisting, and we should not leap to conclusions as to who is responsible. The request may not have come from the obvious subject of a story.

May 2015

http://news.bbc.co.uk/1/hi/england/humber/5070882.stm

http://news.bbc.co.uk/1/hi/england/london/6173888.stm

http://www.bbc.co.uk/news/uk-scotland-edinburgh-east-fife-17449896

http://news.bbc.co.uk/2/hi/uk_news/england/tees/4072892.stm

http://news.bbc.co.uk/1/hi/uk/8229401.stm

http://news.bbc.co.uk/1/hi/northern_ireland/1697871.stm

http://www.bbc.co.uk/news/uk-wales-mid-wales-26820735

http://news.bbc.co.uk/2/hi/business/7968536.stm

http://news.bbc.co.uk/2/hi/business/8607205.stm

http://news.bbc.co.uk/1/hi/england/cornwall/7475762.stm

http://news.bbc.co.uk/1/hi/england/2843343.stm

http://news.bbc.co.uk/2/hi/uk_news/england/3445793.stm

http://news.bbc.co.uk/2/hi/uk_news/england/london/6184091.stm

http://news.bbc.co.uk/1/hi/scotland/8529436.stm

http://news.bbc.co.uk/1/hi/england/surrey/8626921.stm

http://news.bbc.co.uk/1/hi/england/lancashire/7017043.stm

http://www.bbc.co.uk/news/uk-england-lancashire-22570334

http://www.bbc.co.uk/news/uk-scotland-glasgow-west-22633321

http://news.bbc.co.uk/2/hi/uk_news/england/manchester/7031790.stm

http://news.bbc.co.uk/1/hi/england/london/6256193.stm

http://news.bbc.co.uk/1/hi/scotland/7730169.stm

http://news.bbc.co.uk/1/hi/england/london/4102529.stm

http://news.bbc.co.uk/2/hi/uk_news/239774.stm

http://news.bbc.co.uk/1/hi/england/london/3562355.stm

http://news.bbc.co.uk/2/hi/uk_news/england/london/3562355.stm

http://news.bbc.co.uk/2/hi/health/6390421.stm

http://news.bbc.co.uk/1/hi/england/lincolnshire/4465225.stm

April 2015

http://www.bbc.co.uk/news/health-15982608

http://news.bbc.co.uk/2/hi/uk_news/england/cambridgeshire/3837895.stm

http://www.bbc.co.uk/news/uk-england-13524740

http://news.bbc.co.uk/2/hi/uk_news/37979.stm

http://www.bbc.co.uk/news/uk-scotland-edinburgh-east-fife-16986231

http://news.bbc.co.uk/1/hi/england/southern_counties/3124151.stm

http://news.bbc.co.uk/1/hi/northern_ireland/7220428.stm

http://news.bbc.co.uk/1/hi/northern_ireland/7218858.stm

http://news.bbc.co.uk/1/hi/northern_ireland/7229438.stm

http://www.bbc.co.uk/wales/bllcks/me_and_mine/

http://www.bbc.co.uk/wales/bllcks/me_and_mine/iangwynhughes.shtml

http://www.bbc.co.uk/wales/bllcks/me_and_mine/ianwinterton.shtml

http://www.bbc.co.uk/wales/bllcks/me_and_mine/jonfortgang.shtml

http://www.bbc.co.uk/wales/bllcks/me_and_mine/mylesgascoyne.shtml

http://www.bbc.co.uk/wales/bllcks/me_and_mine/sandraosborne.shtml

http://www.bbc.co.uk/news/uk-scotland-glasgow-west-27238412

March 2015

http://www.bbc.co.uk/1/hi/england/west_midlands/3082071.stm

http://news.bbc.co.uk/1/hi/world/europe/863439.stm

http://m.bbc.co.uk/news/uk-scotland-glasgow-west-20998106

http://www.bbc.com/news/uk-12520150

http://news.bbc.co.uk/2/hi/uk_news/education/1471655.stm

http://www.bbc.co.uk/news/uk-scotland-tayside-central-11536013

http://news.bbc.co.uk/1/hi/uk/179398.stm

http://news.bbc.co.uk/1/hi/northern_ireland/7009880.stm

http://news.bbc.co.uk/2/hi/uk_news/england/beds/bucks/herts/3649829.stm

http://news.bbc.co.uk/1/hi/in_pictures/4697892.stm

http://www.bbc.co.uk/newsbeat/20357076

http://news.bbc.co.uk/2/hi/health/6917049.stm

February 2015

http://www.bbc.co.uk/blogs/legacy/theeditors/2007/06/shock_tactics.html

http://news.bbc.co.uk/1/hi/england/london/7506139.stm

http://news.bbc.co.uk/1/hi/england/london/7604051.stm

http://news.bbc.co.uk/1/hi/england/london/4102529.stm

http://news.bbc.co.uk/1/hi/england/london/4093123.stm

http://news.bbc.co.uk/1/hi/health/2068088.stm

http://news.bbc.co.uk/2/hi/europe/126040.stm

http://news.bbc.co.uk/1/hi/uk/146650.stm

http://news.bbc.co.uk/1/hi/uk/3228040.stm

http://news.bbc.co.uk/1/hi/uk/765246.stm

http://news.bbc.co.uk/1/hi/england/southern_counties/4717327.stm

http://news.bbc.co.uk/1/hi/uk/146080.stm

http://news.bbc.co.uk/1/hi/england/2176641.stm

http://www.bbc.co.uk/news/uk-england-gloucestershire-13469941

http://www.bbc.co.uk/news/uk-england-lancashire-16928146

http://www.bbc.co.uk/tyne/content/articles/2006/02/07/shearer_qa_feature.shtml

January 2015

http://www.bbc.co.uk/news/uk-scotland-edinburgh-east-fife-20682672

http://www.bbc.co.uk/news/uk-scotland-edinburgh-east-fife-19559270

http://www.bbc.co.uk/schools/citizenx/being/rights/asylum_p2_big.swf

http://news.bbc.co.uk/1/hi/england/beds/bucks/herts/3663494.stm

December 2014

http://news.bbc.co.uk/1/hi/talking_point/3309723.stm

http://news.bbc.co.uk/1/hi/england/west_midlands/4896906.stm

http://www.bbc.co.uk/leicester/content/articles/2006/01/23/jnrft05_u10s_
league_summary_22012006_feature.shtml

November 2014

http://www.bbc.co.uk/news/uk-scotland-tayside-central-13361261

http://www.bbc.co.uk/news/uk-wales-south-east-wales-24740420

http://www.bbc.co.uk/news/uk-england-13524740

http://news.bbc.co.uk/1/hi/england/3536133.stm

http://news.bbc.co.uk/2/hi/uk_news/215647.stm

http://news.bbc.co.uk/1/hi/scotland/7742450.stm

http://news.bbc.co.uk/2/hi/uk_news/england/3536133.stm

http://news.bbc.co.uk/1/hi/uk/7389677.stm

http://news.bbc.co.uk/1/hi/england/2781665.stm

http://news.bbc.co.uk/2/hi/talking_point/3735199.stm

http://news.bbc.co.uk/1/hi/england/3445763.stm

http://www.bbc.co.uk/blogs/legacy/thereporters/robertpeston/2007/10/
merrills_mess.html

http://news.bbc.co.uk/1/hi/northern_ireland/3874393.stm

http://news.bbc.co.uk/2/hi/uk_news/scotland/north_east/8309109.stm

http://news.bbc.co.uk/2/hi/uk_news/northern_ireland/1630200.stm

http://news.bbc.co.uk/1/hi/education/1793669.stm

http://news.bbc.co.uk/1/hi/wales/1564461.stm

http://news.bbc.co.uk/2/hi/uk_news/scotland/1397426.stm

http://news.bbc.co.uk/2/hi/science/nature/2943946.stm

http://news.bbc.co.uk/2/hi/uk_news/england/oxfordshire/3497532.stm

http://news.bbc.co.uk/2/hi/programmes/correspondent/1888430.stm

http://news.bbc.co.uk/1/hi/talking_point/4232440.stm

http://www.bbc.co.uk/gloucestershire/getfresh/2003/10/wicca_questions.shtml

http://news.bbc.co.uk/1/hi/england/north_yorkshire/7303297.stm

http://news.bbc.co.uk/2/hi/uk_news/wales/920077.stm

http://news.bbc.co.uk/1/hi/england/north_yorkshire/7359543.stm

http://news.bbc.co.uk/1/hi/england/nottinghamshire/4757993.stm

http://news.bbc.co.uk/1/hi/england/nottinghamshire/5237884.stm

http://news.bbc.co.uk/1/hi/england/southern_counties/3777733.stm

http://news.bbc.co.uk/2/hi/uk_news/england/southern_counties/3143478.stm

http://www.bbc.co.uk/news/uk-england-13524740

October 2014

http://news.bbc.co.uk/1/hi/england/2051061.stm

http://news.bbc.co.uk/1/hi/scotland/1887975.stm

http://news.bbc.co.uk/1/hi/scotland/tayside_and_central/7150460.stm

http://www.bbc.co.uk/news/uk-england-lancashire-12045141

http://news.bbc.co.uk/1/hi/england/1766321.stm

http://news.bbc.co.uk/olmedia/1765000/images/_1766321_malcolmbell300.jpg

http://news.bbc.co.uk/2/hi/uk_news/england/2594317.stm

http://www.bbc.co.uk/news/uk-wales-mid-wales-16110563

http://news.bbc.co.uk/1/hi/england/oxfordshire/6361347.stm

http://news.bbc.co.uk/1/hi/programmes/panorama/3710528.stm

http://news.bbc.co.uk/1/hi/programmes/panorama/3008433.stm

http://news.bbc.co.uk/media/images/39191000/jpg/_39191603_vennslim.jpg

http://www.bbc.co.uk/drama/spooks/spooksexpert_questions_1.shtml

http://news.bbc.co.uk/1/hi/scotland/north_east/8309109.stm

http://news.bbc.co.uk/1/hi/scotland/1397426.stm

http://news.bbc.co.uk/2/hi/europe/1105488.stm

http://news.bbc.co.uk/1/hi/uk/818889.stm

http://news.bbc.co.uk/2/hi/uk_news/813596.stm

http://news.bbc.co.uk/2/hi/uk_news/england/bristol/somerset/3721062.stm

http://www.bbc.co.uk/news/mobile/uk-14265891

http://news.bbc.co.uk/1/hi/scotland/2168512.stm

http://news.bbc.co.uk/1/hi/sci/tech/323866.stm

http://news.bbc.co.uk/olmedia/320000/images/_323866_debbiefair.jpg

September 2014

http://news.bbc.co.uk/1/hi/wales/3536991.stm

http://news.bbc.co.uk/1/hi/england/london/4022365.stm

http://news.bbc.co.uk/1/hi/england/london/4025739.stm

http://news.bbc.co.uk/1/hi/england/london/4041953.stm

http://news.bbc.co.uk/1/hi/uk/375816.stm

http://news.bbc.co.uk/1/hi/england/1786346.stm

http://news.bbc.co.uk/1/hi/england/1829377.stm

http://news.bbc.co.uk/1/hi/england/2205961.stm

http://news.bbc.co.uk/1/hi/england/west_midlands/3283037.stm

http://news.bbc.co.uk/1/hi/england/wiltshire/3132175.stm

http://news.bbc.co.uk/1/hi/entertainment/1352097.stm

http://news.bbc.co.uk/1/hi/entertainment/1449259.stm

http://news.bbc.co.uk/1/hi/health/3093087.stm

http://news.bbc.co.uk/1/hi/uk/3115844.stm

http://news.bbc.co.uk/1/hi/england/southern_counties/3143478.stm

http://news.bbc.co.uk/sport1/hi/sports_talk/1521047.stm

http://news.bbc.co.uk/sport1/hi/sports_talk/2254216.stm

http://www.bbc.co.uk/northernireland/yourplaceandmine/topics/
your_questions/A745823.shtml

http://news.bbc.co.uk/1/hi/england/southern_counties/3143478.stm

http://www.bbc.co.uk/news/uk-wales-south-east-wales-24740420

http://www.bbc.co.uk/wiltshire/content/articles/2006/01/16/
mwyml_reports_feature.shtml

http://www.bbc.co.uk/wiltshire/content/articles/2006/01/17/
mwyml_reports_feature.shtml

http://news.bbc.co.uk/1/hi/england/3536133.stm

http://news.bbc.co.uk/1/hi/in_pictures/4005059.stm

http://news.bbc.co.uk/2/hi/europe/2263029.stm

http://news.bbc.co.uk/media/images/38259000/jpg/
_38259272_alexanderbbc150.jpg

http://news.bbc.co.uk/media/images/40517000/jpg/
_40517263_sami300.jpg

http://www.bbc.co.uk/threecounties/teens/2004/07/
james_tapping_work_exp.shtml

http://news.bbc.co.uk/1/hi/england/southern_counties/3156658.stm

http://news.bbc.co.uk/2/hi/uk_news/england/southern_counties/3156658.stm

August 2014

http://news.bbc.co.uk/1/hi/england/2246690.stm

http://news.bbc.co.uk/1/hi/england/cumbria/4493558.stm

http://news.bbc.co.uk/1/hi/uk/146432.stm

http://news.bbc.co.uk/2/hi/programmes/click_online/4316658.stm

http://news.bbc.co.uk/2/hi/programmes/click_online/4386216.stm

http://news.bbc.co.uk/1/hi/uk/469609.stm

http://news.bbc.co.uk/1/hi/wales/920077.stm

http://news.bbc.co.uk/1/hi/england/kent/6161563.stm

http://news.bbc.co.uk/2/hi/europe/3209541.stm

http://news.bbc.co.uk/2/hi/uk_news/3206355.stm

http://news.bbc.co.uk/1/hi/england/bristol/7720506.stm

http://news.bbc.co.uk/2/hi/uk_news/northern_ireland/1382875.stm

July 2014

http://news.bbc.co.uk/1/hi/england/2236046.stm

http://news.bbc.co.uk/1/hi/england/bristol/3721062.stm

http://news.bbc.co.uk/1/hi/programmes/newsnight/4746523.stm

http://news.bbc.co.uk/1/hi/uk/971231.stm

http://news.bbc.co.uk/1/hi/world/middle_east/8375952.stm

http://news.bbc.co.uk/2/hi/talking_point/4137317.stm

http://www.bbc.co.uk/blogs/legacy/thereporters/robertpeston/2007/10/
merrills_mess.html

http://www.bbc.co.uk/news/10603523

One consequence of this listing is that I will have to follow the BBC blog to catch the new list of deletions, month by month. The writing is always enjoyable but it’s one more thing to track.

The thought does occur to me that analysis of the EU censored pages may reveal patterns of what materials are the most likely subjects of censorship.

In addition to the BBC list, one can imagine a search engine that only indexes EU censored pages. Would ad revenue sustain such an index or would it be pay-per-view?

It would be very ironic if EU censorship resulted in more publicity for people exercising their “right to be forgotten.” Not only ironic, but appropriate at well.

PS: You can follow the BBC Internet Blog on Twitter: @bbcinternetblog.

June 24, 2015

Semi-nude Photos and iPhones

Filed under: Privacy — Patrick Durusau @ 1:27 pm

Graham Cluley has advice in Dear politicians, here’s some advice before you check out semi-nude photos on your iPhone… that works for everyone viewing semi-nude photos on their iPhones, not just politicians.

In a prior post, Nude Heather Morris pictures – hacker blamed, Graham has this advice on taking nude photos of yourself (iPhone or not):

nude-photo-advice

Keeping that in your wallet may or may not help.

Startup idea: App that prevents nude or semi-nude photos of the phone owner. 😉

June 16, 2015

Tor for Technologists

Filed under: Cybersecurity,Privacy,Security,Tor — Patrick Durusau @ 3:34 pm

Tor for Technologists by Martin Fowler.

From the post:

Tor is a technology that is cropping up in news articles quite often nowadays. However, there exists a lot of misunderstanding about it. Even many technologists don’t see past its use for negative purposes, but Tor is much more than that. It is an important tool for democracy and freedom of speech – but it’s also something that is very useful in the day-to-day life of a technologist. Tor is also an interesting case study in how to design a system that has very specific security requirements.

The Internet is currently a quite hostile place. There are threats of all kinds, ranging from script kiddies and drive-by phishing attacks to pervasive dragnet surveillance by many of the major intelligence services in the world. The extent of these problems have only recently become clear to us. In this context, a tool like Tor fills a very important niche. You could argue that it’s a sign of the times that even a company like Facebook encourages the use of Tor to access their services. The time is right to add Tor to your tool belt.

Martin does a great job of summarizing Tor and giving a overview of what Tor does and does not do. Both are important for security conscious users (that should include you).

If you aren’t already using Tor and are a technologist, read Martin’s introduction first and then become an active user/supporter of Tor.

June 9, 2015

Studying Law Studying Surveillance

Filed under: Cybersecurity,Privacy — Patrick Durusau @ 3:19 pm

Studying Law Studying Surveillance by Julie Cohen.

Abstract:

The dialogue between law and Surveillance Studies has been complicated by a mutual misrecognition that is both theoretical and temperamental. Legal scholars are inclined to consider surveillance simply as the (potential) subject of regulation, while scholarship in Surveillance Studies often seems not to grapple with the ways in which legal processes and doctrines are sites of contestation over both the modalities and the limits of surveillance. Put differently, Surveillance Studies takes notice of what law does not—the relationship between surveillance and social shaping—but glosses over what legal scholarship rightly recognizes as essential—the processes of definition and compromise that regulators and other interested parties must navigate, and the ways that legal doctrines and constructs shape those processes. This article explores the fault lines between law and Surveillance Studies and considers the potential for more productive confrontation and dialogue in ways that leverage the strengths of each tradition.

Quite an interesting read but to be honest, I would rather confront surveillance studies on its running failure to produce results than on theory questions.

When I say, “its running failure to produce results,” I have to acknowledge that drone strikes and cruise missiles have been used to settle private scores between citizens in Afghanistan and elsewhere, but that seems like a very poor rate of return. And we shouldn’t forget the mentally disturbed and wannabe terrorists that the FBI assists, one assumes on the basis of surveillance evidence.

What I suspect the surveillance camp has yet to comprehend is that assuming 24 x 7 total surveillance of even a smallish group of people, is going to take the collective bandwidth of at least three to four times the number of people under surveillance, to say nothing of the infrastructures to keep all their watching coordinated.

With the limited surveillance data that is being captured now, the surveillance community has demonstrated its inability to do much worthwhile with the data. The recent story of the TSA being unable to identify 73 TSA employees as having links to terrorism being yet another case in point. The surveillance community is unable to effectively share data with agencies that need to have it.

I would start any dialogue or debate about surveillance by putting the burden of proof squarely on the shoulders of the surveillance community. What evidence do they have that surveillance works at all? Or that particular procedures, such as the bulk collection of phone metadata is effective? The latest review on the phone records program suggests for all of the hand wringing over it, it has yet to be useful.

No doubt there is the potential for it to be useful, but that could be said about almost any human activity. We need some basis beyond paranoia and/or the need to sustain agency budgets to support surveillance programs.

It’s not that liberal theory isn’t important for the law, it is, but if there is no factual basis for even evaluating surveillance, then why trouble ourselves?

I first saw this in a tweet by Bruce Schneier.

June 4, 2015

How I tracked FBI aerial surveillance

Filed under: Clojure,Government,Privacy — Patrick Durusau @ 9:42 am

How I tracked FBI aerial surveillance by John Wiseman.

John give full details of how he scooped AP by 25 days on FBI aerial surveillance. Not to mention that he links to how you can build a similar setup. A setup that uses Clojure! (Plus a software defined radio for you hobbyists out there.)

Assembling a cast of watchers/employees at airports who can photograph people exiting specific planes would be a big step towards matching people up to surveillance flights. Not to mention running photo searches to identify the people themselves.

A gold fish bowl world isn’t the best choice but the government has made that choice. It is up to the rest of us to see that they enjoy the full benefit of that choice. Perhaps they will choose differently at some point in the future.

June 3, 2015

Foreign Intelligence Gathering Laws

Filed under: Government,Intelligence,Law,Law - Sources,Privacy — Patrick Durusau @ 10:14 am

Foreign Intelligence Gathering Laws by Peter Roudik, Director of Legal Research, Law Library of Congress.

From the description:

This report contains information on laws regulating the collection of intelligence in the European Union, United Kingdom, France, Netherlands, Portugal, Romania, and Sweden. The report details how EU Members States control activities of their intelligence agencies and what restrictions are imposed on information collection. All EU Member States follow EU legislation on personal data protection, which is a part of the common European Union responsibility.

To the extent that you think intelligence services obey laws or if you need statute and case citations for rhetorical purposes, for the countries covered this report will be quite handy.

Whether you are in the United States or one of the countries listed in this report or elsewhere, your default assumption should be that you are under surveillance and the record light is on.

June 2, 2015

USA Freedom Act Passes:… [Questions for the EFF]

Filed under: Government,Privacy — Patrick Durusau @ 6:07 pm

USA Freedom Act Passes: What We Celebrate, What We Mourn, and Where We Go From Here

From the post:

The Senate passed the USA Freedom Act today by 67-32, marking the first time in over thirty years that both houses of Congress have approved a bill placing real restrictions and oversight on the National Security Agency’s surveillance powers. The weakening amendments to the legislation proposed by NSA defender Senate Majority Mitch McConnell were defeated, and we have every reason to believe that President Obama will sign USA Freedom into law. Technology users everywhere should celebrate, knowing that the NSA will be a little more hampered in its surveillance overreach, and both the NSA and the FISA court will be more transparent and accountable than it was before the USA Freedom Act.

It’s no secret that we wanted more. In the wake of the damning evidence of surveillance abuses disclosed by Edward Snowden, Congress had an opportunity to champion comprehensive surveillance reform and undertake a thorough investigation, like it did with the Church Committee. Congress could have tried to completely end mass surveillance and taken numerous other steps to rein in the NSA and FBI. This bill was the result of compromise and strong leadership by Sens. Patrick Leahy and Mike Lee and Reps. Robert Goodlatte, Jim Sensenbrenner, and John Conyers. It’s not the bill EFF would have written, and in light of the Second Circuit’s thoughtful opinion, we withdrew our support from the bill in an effort to spur Congress to strengthen some of its privacy protections and out of concern about language added to the bill at the behest of the intelligence community.

Even so, we’re celebrating. We’re celebrating because, however small, this bill marks a day that some said could never happen—a day when the NSA saw its surveillance power reduced by Congress. And we’re hoping that this could be a turning point in the fight to rein in the NSA.

For years, the larger EFF community has proven itself capable of fighting bad legislation that would hamper rights and freedoms online, with the clearest example being the 2012 annihilation of the Internet blacklist legislation SOPA. Lawmakers have feared that technology users—organized, politically-savvy, articulate, and educated about the law and its effects on tech—would strike out to stop their misguided legislative efforts. But for all our many victories in stopping bad legislation, we have struggled to pass bills that would better protect our freedoms. Passing a bill is far more difficult than simply killing a bad bill, and takes more sustained pressure from the public, a massive publicity campaign around a central issue, deep connections to lawmakers, and the coordination of diverse groups from across the political spectrum.

The USA Freedom Act shows that the digital rights community has leveled up. We’ve gone from just killing bad bills to passing bills that protect people’s rights.

Surprising that Congress went as far as it did, but I have some questions for the EFF.

What makes you think the NSA or any other part of the intelligence apparatus will follow the law passed by Congress?

We already know that the director of national intelligence was willing to lie to Congress and that other illegal activity has been concealed from Congress (and the public) for years.

Why does the EFF suddenly have confidence that known lawbreakers, who proclaim they aren’t lying, this time, should be taken at face value?

It is altogether possible that telcos will indeed store data, the NSA and others will their parts in requesting data, all while still collecting all data, legal and illegal.

I’m not a conspiracy theorist but we do have documented cases of the intelligence community doing that very thing. “It’s for the good of the country” and all that delusional crap.

I see nothing to celebrate unless and until Congress defunds and dismantles under supervision of random members of the public and press all of the current intelligence apparatus.

Did the US intelligence apparatus foresee the overthrow of the Shah of Iraq? The assassination of Sadat? Or Rabin? Or the fall of the Berlin Wall? 9/11? The American public should be asking what we are getting for all the effort of the US intelligence services? So far, loss of privacy, a lot of insecurity and paper waste.

(No, I don’t credit stories whispered in secret by Saigon warriors, not at all.)


Update: There are a variety of others who have reached the same conclusion:

Why It’s Quite Premature to Celebrate the Death of the Surveillance State by Norman Solomon.

USA Freedom Act gives NSA everything it wants — and less by Joshua Kopstein. (a “nothingburger for the privacy community”)

How The USA Freedom Act is Actually Reducing Freedom in America by Virgil Vaduva.

May 9, 2015

Slicing and Dicing Users – Google Style

Filed under: Cybersecurity,Privacy,Security — Patrick Durusau @ 1:54 pm

Courts docs show how Google slices users into “millions of buckets” by Jeff Gould.

From the post:

The first law of selling is to know your customer. This simple maxim has made Google into the world’s largest purveyor of advertisements, bringing in more ad revenue this year than all the world’s newspapers combined. What makes Google so valuable to advertisers is that it knows more about their customers — that is to say, about you — than anyone else.

Where does Google get this knowledge? Simple. It watches most everything you do and say online — reads your email (paying special attention to purchase confirmations), peers over your shoulder while you browse, knows what you watch on YouTube, and — by tracking your devices — even knows where you are at this very moment. Then it assembles all these bits of information into a constantly updated profile that tells advertisers when, where and what you may hanker to buy.

Your Google profile contains far more than basic facts such as age, gender and product categories you might be interested in. It also makes statistically plausible guesses about things you didn’t voluntarily disclose. It estimates how much you earn by looking up IRS income data for your zip code. It knows if you have children at home — a trick it performs by surveying hundreds of thousands of parents, observing their online behavior, then extrapolating to millions of other users. Google also offers advertisers over 1,000 “interest-based advertising” categories to target users by their web browsing habits. When advertisers are ready to buy ads they can review all these attributes in a convenient browser interface and select exactly the users they want to target.

But these explicit attributes only scratch the surface. The online ad giant knows much more about you than it can put into a form easily understandable by humans. Just how much it knows came to light last year, when a Federal judge ordered the publication of some remarkable internal Google emails discussing how Gmail data mining works. Google’s lawyers fought the disclosure tooth and nail, but they were ultimately overruled. The emails reveal that Gmail can sort users not just into a few thousand demographic and interest categories, but into literally millions of distinct “buckets”. A “bucket” is just a cluster of users, however small, who share some feature in common that might interest advertisers.

The document shown in this post can be found at: https://musictechpolicy.files.wordpress.com/2010/09/183-6-google-employee-emails.pdf

If you want more documents from the case, see: Dunbar v. Google, Inc. (Justia)

Jeff’s post is a great illustration of how massive data collection can discover more about you than you would choose to share.

Efforts to legislate the collection/preservation of data leave your safety in the hands of those with few motivations to follow the law.

A better solution leaves few, if any fingerprints at all. What isn’t visible, can’t be collected.

May 3, 2015

You Can Help Keep Others Secure (Use Tor)

Filed under: Privacy,Security,Tor — Patrick Durusau @ 1:25 pm

Tor Browser 4.5 released by Mike Perry.

From the post:

The Tor Browser Team is proud to announce the first stable release in the 4.5 series. This release is available from the Tor Browser Project page and also from our distribution directory.

The 4.5 series provides significant usability, security, and privacy enhancements over the 4.0 series. Because these changes are significant, we will be delaying the automatic update of 4.0 users to the 4.5 series for one week.

Time to upgrade!

Why use Tor?

The Tor network is a group of volunteer-operated servers that allows people to improve their privacy and security on the Internet. Tor’s users employ this network by connecting through a series of virtual tunnels rather than making a direct connection, thus allowing both organizations and individuals to share information over public networks without compromising their privacy. Along the same line, Tor is an effective censorship circumvention tool, allowing its users to reach otherwise blocked destinations or content. Tor can also be used as a building block for software developers to create new communication tools with built-in privacy features.

Individuals use Tor to keep websites from tracking them and their family members, or to connect to news sites, instant messaging services, or the like when these are blocked by their local Internet providers. Tor’s hidden services let users publish web sites and other services without needing to reveal the location of the site. Individuals also use Tor for socially sensitive communication: chat rooms and web forums for rape and abuse survivors, or people with illnesses.

Journalists use Tor to communicate more safely with whistleblowers and dissidents. Non-governmental organizations (NGOs) use Tor to allow their workers to connect to their home website while they’re in a foreign country, without notifying everybody nearby that they’re working with that organization.

Groups such as Indymedia recommend Tor for safeguarding their members’ online privacy and security. Activist groups like the Electronic Frontier Foundation (EFF) recommend Tor as a mechanism for maintaining civil liberties online. Corporations use Tor as a safe way to conduct competitive analysis, and to protect sensitive procurement patterns from eavesdroppers. They also use it to replace traditional VPNs, which reveal the exact amount and timing of communication. Which locations have employees working late? Which locations have employees consulting job-hunting websites? Which research divisions are communicating with the company’s patent lawyers?

A branch of the U.S. Navy uses Tor for open source intelligence gathering, and one of its teams used Tor while deployed in the Middle East recently. Law enforcement uses Tor for visiting or surveilling web sites without leaving government IP addresses in their web logs, and for security during sting operations.

The variety of people who use Tor is actually part of what makes it so secure. Tor hides you among the other users on the network, so the more populous and diverse the user base for Tor is, the more your anonymity will be protected. (From https://www.torproject.org/about/overview.html.en.)

If you are concerned about privacy, yours and of others, use a Tor browser by default.

April 26, 2015

New York Times Gets Stellarwind IG Report Under FOIA

Filed under: Government,NSA,Privacy — Patrick Durusau @ 4:57 pm

New York Times Gets Stellarwind IG Report Under FOIA by Benjamin Wittes.

A big thank you! to Benjamin Wittes and the New York Times.

They are the only two (2) stories on the Stellarwind IG report, released Friday evening, that give a link to the document!

The NYT story with the document: Government Releases Once-Secret Report on Post-9/11 Surveillance by Charlie Savage.

The document does not appear at:

Office of the Director of National Intelligence (as of Sunday, 25 April 2015, 17:45 EST).

US unveils 6-year-old report on NSA surveillance by Nedra Pickler (Associated Press or any news feed that parrots the Associated Press).

Suggestion: Don’t patronize news feeds that refer to documents but don’t include links to them.

April 23, 2015

Protecting Your Privacy From The NSA?

Filed under: Government,Privacy,Security — Patrick Durusau @ 4:26 pm

House passes cybersecurity bill by Cory Bennett and Cristina Marcos.

From the post:

The House on Wednesday passed the first major cybersecurity bill since the calamitous hacks on Sony Entertainment, Home Depot and JPMorgan Chase.

Passed 307-116, the Protecting Cyber Networks Act (PCNA), backed by House Intelligence Committee leaders, would give companies liability protections when sharing cyber threat data with government civilian agencies, such as the Treasury or Commerce Departments.

“This bill will strengthen our digital defenses so that American consumers and businesses will not be put at the mercy of cyber criminals,” said House Intelligence Committee Chairman Devin Nunes (R-Calif.).

Lawmakers, government officials and most industry groups argue more data will help both sides better understand their attackers and bolster network defenses that have been repeatedly compromised over the last year.

Privacy advocates and a group of mostly Democratic lawmakers worry the bill will simply shuttle more sensitive information to the National Security Agency (NSA), further empowering its surveillance authority. Many security experts agree, adding that they already have the data needed to study hackers’ tactics.

The connection between sharing threat data and loss of privacy to the NSA escapes me.

At present, the NSA can or is:

  • Monitoring all Web traffic
  • Monitoring all Email traffic
  • Collecting all Phone metadata
  • Collecting all Credit Card information
  • Collecting all Social Media data
  • Collecting all Travel data
  • Collecting all Banking data
  • Has spied on Congress and other agencies
  • Can demand production of other information and records from anyone
  • Probably has a copy of your income tax and social security info

You are concerned private information about you might be leaked to the NSA in the form of threat data?

Seriously?

Anything is possible so something the NSA doesn’t already know could possibly come to light, but I would not waste my energy opposing a bill that is virtually no additional threat to privacy.

The NSA is the issue that needs to be addressed. Its very existence is incompatible with any notion of privacy.

April 20, 2015

Sony at Wikileaks! (MPAA Privacy versus Your Privacy)

Filed under: Cybersecurity,Privacy,Security,Wikileaks — Patrick Durusau @ 6:23 pm

Sony at Wikileaks!

From the press release:

Today, 16 April 2015, WikiLeaks publishes an analysis and search system for The Sony Archives: 30,287 documents from Sony Pictures Entertainment (SPE) and 173,132 emails, to and from more than 2,200 SPE email addresses. SPE is a US subsidiary of the Japanese multinational technology and media corporation Sony, handling their film and TV production and distribution operations. It is a multi-billion dollar US business running many popular networks, TV shows and film franchises such as Spider-Man, Men in Black and Resident Evil.

In November 2014 the White House alleged that North Korea’s intelligence services had obtained and distributed a version of the archive in revenge for SPE’s pending release of The Interview, a film depicting a future overthrow of the North Korean government and the assassination of its leader, Kim Jong-un. Whilst some stories came out at the time, the original archives, which were not searchable, were removed before the public and journalists were able to do more than scratch the surface.

Now published in a fully searchable format The Sony Archives offer a rare insight into the inner workings of a large, secretive multinational corporation. The work publicly known from Sony is to produce entertainment; however, The Sony Archives show that behind the scenes this is an influential corporation, with ties to the White House (there are almost 100 US government email addresses in the archive), with an ability to impact laws and policies, and with connections to the US military-industrial complex.

WikiLeaks editor-in-chief Julian Assange said: “This archive shows the inner workings of an influential multinational corporation. It is newsworthy and at the centre of a geo-political conflict. It belongs in the public domain. WikiLeaks will ensure it stays there.”

Lee Munson writes in WikiLeaks publishes massive searchable archive of hacked Sony documents,


According to the Guardian, former senator Chris Dodd, chairman of the MPAA, wrote how the republication of this information signifies a further attack on the privacy of those involved:

This information was stolen from Sony Pictures as part of an illegal and unprecedented cyberattack. Wikileaks is not performing a public service by making this information easily searchable. Instead, with this despicable act, Wikileaks is further violating the privacy of every person involved.

Hacked Sony documents soon began appearing online and were available for download from a number of different sites but interested parties had to wade through vast volumes of data to find what they were looking for.

WikiLeaks’ new searchable archive will, sadly, make it far easier to discover the information they require.

I don’t see anything sad about the posting of the Sony documents in searchable form by Wikileaks.

If anything, I regret there aren’t more leaks, breaches, etc., of both corporate and governmental document archives. Leaks and breaches that should be posted “as is” with no deletions by Wikileaks, the Guardian or anyone else.

Chris Dodd’s privacy concerns aren’t your privacy concerns. Not even close.

Your privacy concerns (some of them):

  • personal finances
  • medical records
  • phone calls (sorry, already SOL on that one)
  • personal history and relationships
  • more normal sort of stuff

The MPAA, Sony and such, have much different privacy concerns:

  • concealment of meetings with and donations to members of government
  • concealment of hiring practices and work conditions
  • concealment of agreements with other businesses
  • concealment of offenses against the public
  • concealment of the exercise of privilege

Not really the same are they?

Your privacy centers on you, the MPAA/Sony privacy centers on what they have done to others.

New terms? You have a privacy interest, MPAA/Sony has an interest in concealing information.

That sets a better tone for the discussion.

March 28, 2015

Who You Gonna Call?

Filed under: Government,Politics,Privacy — Patrick Durusau @ 10:41 am

Confirmation you should join the NRA to protect privacy and the rights of hackers to defend themselves.

The Drug Enforcement Administration abandoned an internal proposal to use surveillance cameras for photographing vehicle license plates near gun shows in the United States to investigate gun-trafficking, the agency’s chief said Wednesday.

DEA Administrator Michelle Leonhart said in a statement that the proposal memorialized in an employee’s email was only a suggestion, never authorized by her agency and never put into action. The AP also learned that the federal Bureau of Alcohol, Tobacco, Firearms and Explosives did not authorize or approve the license plate surveillance plan.

A casual email suggestion warrants two separate high profile denials. That’s power. DEA chief: US abandoned plan to track cars near gun shows.

I’m not sure where else you would investigate gun-trafficking but the bare mention of guns frightens off entire federal agencies.

To protect privacy, who you gonna call?

March 27, 2015

Data and Goliath – Bruce Schneler – New Book!

Filed under: Cybersecurity,Privacy,Security — Patrick Durusau @ 10:03 am

In a recent review of Data and Goliath: The Hidden Battles to Capture Your Data and Control Your World by Bruce Schneler, Steven Aftergood writes in Data and Goliath: Confronting the Surveillance Society that:

“More than just being ineffective, the NSA’s surveillance efforts have actually made us less secure,” he says. Indeed, the Privacy and Civil Liberties Oversight Board found the “Section 215″ program for bulk collection of telephone metadata to be nearly useless, as well as likely illegal and problematic in other ways. But by contrast, it also reported that the “Section 702″ collection program had made a valuable contribution to security. Schneier does not engage on this point.

I’m waiting on my copy of Data and Goliath to arrive but I don’t find it surprising that Bruce overlooked and/or chose to not comment on the Section 702 report.

Starting with the full text, Report on the Surveillance Program Operated Pursuant to Section 702 of the Foreign Intelligence Surveillance Act, at one hundred and ninety-six pages (196), you will be surprised at how few actual facts are recited.

In terms of the efficacy of the 702 program, this is fairly typical:

The Section 702 program has proven valuable in a number of ways to the government’s efforts to combat terrorism. It has helped the United States learn more about the membership, leadership structure, priorities, tactics, and plans of international terrorist organizations. It has enabled the discovery of previously unknown terrorist operatives as well as the locations and movements of suspects already known to the government. It has led to the discovery of previously unknown terrorist plots directed against the United States and foreign countries, enabling the disruption of those plots.

That seems rather short on facts and long on conclusions to me. Yes?

Here’s a case the report singles out as a success:

In one case, for example, the NSA was conducting surveillance under Section 702 of an email address used by an extremist based in Yemen. Through that surveillance, the agency discovered a connection between that extremist and an unknown person in Kansas City, Missouri. The NSA passed this information to the FBI, which identified the unknown person, Khalid Ouazzani, and subsequently discovered that he had connections to U.S.-based Al Qaeda associates, who had previously been part of an abandoned early stage plot to bomb the New York Stock Exchange. All of these individuals eventually pled guilty to providing and attempting to provide material support to Al Qaeda.

Recalling that “early stage plot” means a lot of hot talk with no plan for implementation, which accords with pleas to “attempting to provide material support to Al Qaeda.” That’s grotesque.

Oh, another case:

For instance, in September 2009, the NSA monitored under Section 702 the email address of an Al Qaeda courier based in Pakistan. Through that collection, the agency intercepted emails sent to that address from an unknown individual located in the United States. Despite using language designed to mask their true intent, the messages indicated that the sender was urgently seeking advice on the correct mixture of ingredients to use for making explosives. The NSA passed this information to the FBI, which used a national security letter to identify the unknown individual as Najibullah Zazi, located near Denver, Colorado. The FBI then began intense monitoring of Zazi, including physical surveillance and obtaining legal authority to monitor his Internet activity. The Bureau was able to track Zazi as he left Colorado a few days later to drive to New York City, where he and a group of confederates were planning to detonate explosives on subway lines in Manhattan within the week. Once Zazi became aware that law enforcement was tracking him, he returned to Colorado, where he was arrested soon after. Further investigative work identified Zazi’s co-conspirators and located bomb-making components related to the planned attack. Zazi and one of his confederates later pled guilty and cooperated with the government, while another confederate was convicted and sentenced to life imprisonment. Without the initial tip-off about Zazi and his plans, which came about by monitoring an overseas foreigner under Section 702, the subway-bombing plot might have succeeded.

Sorry, that went by rather fast. The unknown sender in the United States did not know how to make explosives? And despite that, the plot is described as “…planning to detonate explosives on subway lines in Manhattan within the week.” Huh? That’s quite a leap from getting advice on explosives to being ready to execute a complex operation.

What’s wrong with the “terrorists” being tracked by the NSA/FBI? Almost without exception, they lack the skills to make bombs. The FBI fills in, supplying bombs in many cases, Cleveland, 2012, Portland, 2010, and that’s two I remember right off hand. (I don’t have a complete list of terror plots where the FBI supplies the bomb or bomb making materials. Do you? It would save me the work of putting one together. Thanks!)

A more general claim rounds out the “facts” claimed by the report:

A rough count of these cases identifies well over one hundred arrests on terrorism-related offenses. In other cases that did not lead to disruption of a plot or apprehension of conspirators, Section 702 appears to have been used to provide warnings about a continuing threat or to assist in investigations that remain ongoing. Approximately fifteen of the cases we reviewed involved some connection to the United States, such as the site of a planned attack or the location of operatives, while approximately forty cases exclusively involved operatives and plots in foreign countries.

Well, we know that “terrorism-related offense” includes “…attempting to provide material support to Al Qaeda.” And that conspiracy to commit a terrorist act can consist of talking about wanting to commit a terrorist act with no ability to put such a plan in action. Like no knowing how to make a bomb. Fairly serious impediment there, at least for a would be terrorist.

Not to mention that detention has no real relationship to the commission of a crime, as we have stood witness to at Guantanamo Bay (directions).

In Bruce’s defense, like he needs my help!, ;-), no one has an obligation to refute every lie told in support of government surveillance or its highly fictionalized “war on terrorism.” To no small degree, repeating those lies ad nauseam gives them credibility in group think circles, such as inside the beltway in D.C. Especially among agencies whose budgets depend upon those lies and the contractors who profit from them.

Treat yourself to some truth about cybersecurity, order your copy of Data and Goliath: The Hidden Battles to Capture Your Data and Control Your World by Bruce Schneler.

March 26, 2015

Congressional Influence Model [How To Choose Allies 4 Hackers]

Filed under: Cybersecurity,Government,Politics,Privacy — Patrick Durusau @ 1:51 pm

Congressional Influence Model by Westley Hennigh.

From the webpage:

This is a collection of data and code for investigating influence in Congress. Specifically, it uses data generated by MapLight and the Center for Responsive Politics to identify opposing interest groups and analyze their political contributions.

Unfortunately, due to size constraints, not all of the campaign finance data can be included in this repo. But if you’re curious you can download it using this scraper (see further instructions there).

I found this following the data for:

When interest groups disagreed on legislation, who did the 113th Congress vote with?

Sorted to show groups most frequently on opposite sides of legislation

congressional-influence

To fully appreciate the graphic, see the original at: Congress is a Game, and We Have the Data to Show Who’s Winning by Westley Hennigh.

Where Westley also notes after the graphic:

Amongst more ideologically focused groups the situation is much the same. Conservative Republican interests were very often at odds with both health and welfare and human rights advocates, but Congress stood firmly with conservatives. They were almost twice as likely to vote against the interests of human rights advocates, and more than twice as likely to vote against health & welfare policy organizations.

The force driving this correlation between support by certain groups and favorable votes in Congress isn’t incalculable or hard to guess at. It’s money. The groups above that come out on top control massive amounts of political campaign spending relative to their opponents. The conservative Republican interests in conflict with health and welfare policy groups spent an average of 26 times as much on candidates that won seats in the 113th Congress. They outspent human rights advocates by even more — 300 times as much on average. The Chambers of Commerce, meanwhile, has spent more on lobbying than any other group every year since 1999.

As Westley points out, this is something we all “knew” at some level and now the data makes the correlation between money and policy undeniable.

My first reaction was Westley’s data is a good start towards: How much is that Representative/Senator in the window? The one with the waggly tail., a website where the minimum contribution for legislative votes, taking your calls, etc., is estimated for each member of the United States House and Senate. Interest groups could avoid overpaying for junior members and embarrassing themselves with paltry contributions to more senior members. Think of it as a public price list for legislation.

A How much is that Representative/Senator in the window? The one with the waggly tail. website would be very amusing, but it wouldn’t help me because I don’t have that sort of money. And it isn’t a straight out purchase, which is how they avoid the quid pro quo issue. Many of these interest groups have been greasing the palms of, sorry, contributing to, politicians for years.

In order to gain power by contributions, real power, requires a contribution/issue campaign that spans the political careers of multiple politicians, starting at the state and local level and following those careers into Congress. Which means, of course, getting upset about this or that outrage isn’t enough to sustain the required degree of organization and contributions. Contributions and reminders of contributions have to flow 7 x 365, in good years and lean years, perhaps even more so in lean (non-election) years.

Not to mention that you will need to make friends fast and enemies, permanent ones anyway, very slowly. Perhaps a member of Congress has too much local opposition to favor your side on a minor bill. They have simply be absent rather than vote. You have to learn to live with the reality that your representative/senator has other pressure points. Not unless you want to own one outright. They exist I have no doubt but the asking price would be very high. Easier to get one issue representatives elected than senators but I don’t know how useful that would be in the long term.

After thinking about it for a while, I concluded we know three things for sure:

  • Congress votes with conservatives twice as often as human rights advocates.
  • Conservatives outspend other groups and have for decades.
  • Outspending conservatives would require national/state/local contributions for decades.

Based on those facts, would you choose an ally that:

  • Loses twice as often on their issues as other groups?
  • Doesn’t regularly contributed to campaigns at state/local/federal levels?
  • That has no effective national/state/local organization that has persisted for decades?

How you frame your issues makes a difference in available allies.

Take for example the ACLU and its suit against the NSA to take back the Internet Backbone. The NSA Has Taken Over the Internet Backbone. We’re Suing to Get it Back.

The ACLU complaint against the NSA has issues such as:

48. Plaintiffs are educational, legal, human rights, and media organizations. Their work requires them to engage in sensitive and sometimes privileged communications, both international and domestic, with journalists, clients, experts, attorneys, civil society organizations, foreign government officials, and victims of human rights abuses, among others.

49. By intercepting, copying, and reviewing substantially all international text-based communications—and many domestic communications as well—as they transit telecommunications networks inside the United States, the government is seizing and searching Plaintiffs’ communications in violation of the FAA and the Constitution.

Really makes you feel like girding your loins and putting on body armor doesn’t it? Almost fifty (50) pages of such riveting prose.

Don’t get me wrong, I support the ACLU and deeply appreciate their suing the NSA. The NSA needs to be opposed in every venue by everyone who cares about having any semblance of freedom in the United States.

I hope the ACLU is victorious but at best, the NSA will be forced to obey existing laws, assuming you can trust known liars when they say “…now we are obeying the law, but we can’t let you see that we are obeying the law.” Somehow that doesn’t fill me with confidence, assuming the ACLU is successful.

What happens if we re-phrase the issue of NSA surveillance? So we can choose stronger allies to have on our side? Take the mass collection of credit card data for example. Sweeping NSA Surveillance Includes Credit-Card Transactions, Top Three Phone Companies’ Records by Ryan Gallagher.

What would credit card data enable? Hmmm, can you say a de facto national gun registry? With purchase records for guns and ammunition? What reason other than ownership would I have for buying .460 Weatherby Magnum ammunition?

By framing the issue of surveillance as a gun registration issue, we find the NRA joining with the ACLU and others in ACLU vs. Clapper, No. 13-cv-03994 (WHP), saying:

For more than 50 years since its decision in Nat’l Ass’n for Advancement of Colored People v. State of Ala. ex rel. Patterson, 357 U.S. 449 (1958), the Supreme Court has recognized that involuntary disclosure of the membership of advocacy groups inhibits the exercise of First Amendment rights by those groups. For nearly as long—since the debates leading up to enactment of the Gun Control Act of 1968—the Congress has recognized that government recordkeeping on gun owners inhibits the exercise of Second Amendment rights. The mass surveillance program raises both issues, potentially providing the government not only with the means of identifying members and others who communicate with the NRA and other advocacy groups, but also with the means of identifying gun owners without their knowledge or consent, contrary to longstanding congressional policy repeatedly reaffirmed and strengthened by Congresses that enacted and reauthorized the legislation at issue in this case. The potential effect on gun owners’ privacy is illustrative of the potential effect of the government’s interpretation of the statute on other statutorily protected privacy rights. The injunction should be issued.

That particular suit was unsuccessful at the district court level but that should give you an idea of how “framing” an issue can enable you to attract allies who are more successful than most.

With support of the ACLU, perhaps, just perhaps the NSA will be told to obey the law. Guesses for grabs on how successful that “telling” will be.

With the support of the NRA and similar groups, the very existence of the NSA data archives will come into question. Not beyond possibility that the NSA will be returned to its former, much smaller footprint of legitimate cryptography work.

And what of other NRA positions? (shrugs) I’m sure that any group you look closely enough at will stand for something you don’t like. As I put it to a theologically diverse group forming to create a Bible encoding, “I’m looking for allies, not soul mates. I already have one of those.”

You?

PS: As of April, 2014, Overview of Constitutional Challenges to NSA Collection Activities and Recent Developments, is a summary of legal challenges to the NSA. Dated but I thought it might be helpful.

March 25, 2015

2nd Amendment-Summary-4-Hackers

Filed under: Cybersecurity,Privacy,Security — Patrick Durusau @ 4:30 pm

As promised, not a deeply technical (legal) analysis of District of Columbia vs. Heller but summary of the major themes in Scalia’s opinion for the majority.

District of Columbia v. Heller, 554 U.S. 570, 128 S. Ct. 2783, 171 L. Ed. 2d 637 (2008) [2008 BL 136680] has the following pagination markers:

* U.S. (official)
** S. Ct. (West Publishing)
*** L. Ed. 2d (Lawyers Editon 2nd)
**** BL (Bloomberg Law)

In the text you will see: [*577] for example which is the start of page 577 in the official version of the opinion. I use the official pagination herein.

Facts: Heller, a police officer applied for a handgun permit, which was denied. Without a permit, possession of a handgun was banned in the District of Columbia. Even if a permit were obtained, the handgun had to be disabled and unloaded. Heller sued the district saying that the Second Amendment protects an individual’s right to possess firearms and that the city’s ban on handguns and the non-functioning requirement, should the handgun be required for self-defense, infringed on that right.

[Observation: When challenging a law on constitutional grounds, get an appropriate plaintiff to bring the suit. I haven’t done the factual background but I rather doubt that Heller was just an ordinary police officer who decided on his own to sue the District of Columbia. Taking a case to the Supreme Court is an expensive proposition. In challenging laws that infringe on hackers, use security researchers, universities, people with clean reputations. Not saying you can’t win with others but on policy debates its better to wear your best clothes.]

Law: Second Amendment: “A well regulated Militia, being necessary to the security of a free State, the right of the people to keep and bear Arms, shall not be infringed.”

Scalia begins by observing:

“[t]he Constitution was written to be understood by the voters; its words and phrases were used in their normal and ordinary as distinguished from [****4] technical meaning.” United States v. Sprague, 282 U. S. 716, 731 (1931); see also Gibbons v. Ogden, 9 Wheat. 1, 188 (1824). [*576]

The crux of Scalia’s argument comes early and is stated quite simply:

The Second Amendment is naturally divided into two parts: its prefatory clause and its operative clause. The former does not limit the latter grammatically, but rather announces a purpose. The Amendment could be rephrased, “Because a well regulated Militia is necessary to the security of a free State, the right of the people to keep and bear Arms shall not be infringed.” [*577]

With that “obvious” construction, Scalia sweeps to one side all arguments that attempt to limit the right to bear arms to a militia context. Its just an observation, not binding in any way on the operative clause. He does retain it for later use to argue the interpretation of the operative clause is consistent with that purpose.

Scalia breaks his analysis of the operative clause into the following pieces:

a. “Right of the People.”

b. “Keep and Bear Arms”

c. Meaning of the Operative Clause.

“Right of the People.” In perhaps the strongest part of the opinion, Scalia observes that “right of the people” occurs in the unamended Constitution and Bill of Rights only two other times, First Amendment (assemby-and-petition clause) and Fourth Amendment (search-and-seizure) clause. The Fourth Amendment has fallen on hard times of late but the First Amendment is still attractive to many. He leaves little doubt that the right to “keep and bear arms” (the next question), is undoubtedly meant to be an individual right. [*579]

“Keep and Bear Arms” Before turning to “keep” and “bear,” Scalia makes two important points with regard to “arms:”

Before addressing the verbs “keep” and “bear,” we interpret their object: “Arms.” The 18th-century meaning is no different from the meaning today. The 1773 edition of Samuel Johnson’s dictionary defined “arms” as “[w]eapons of offence, or armour of defence.” 1 Dictionary of the English Language 106 (4th ed.) (reprinted 1978) (hereinafter Johnson). Timothy Cunningham'[****6] s important 1771 legal dictionary defined “arms” as “any thing that a man wears for his defence, or takes into his hands, or useth in wrath to cast at or strike another.” 1 A New and Complete Law Dictionary; see also N. Webster, American Dictionary of the English Language (1828) (reprinted 1989) (hereinafter Webster) (similar).

The term was applied, then as now, to weapons that were not specifically designed for military use and were not employed in a military capacity. For instance, Cunningham’s legal dictionary gave as an example of usage: “Servants and labourers shall use bows and arrows on Sundays, & c. and not bear other arms.” See also, e.g., An Act for the trial of Negroes, 1797 Del. Laws ch. XLIII, § 6, in 1 First Laws of the State of Delaware 102, 104 (J. Cushing ed. 1981 (pt. 1)); see generally State v. Duke, 42 Tex. 455, 458 (1874) (citing decisions of state courts construing “arms”). Although one founding-era thesaurus limited “arms” (as opposed to “weapons”) to “instruments of offence generally made use of in war,” even that source stated that all firearms constituted “arms.” 1 J. Trusler, The Distinction Between Words Esteemed [*582] Synonymous in the English Language 37 (3d ed. 1794) (emphasis added).

Some have made the argument, bordering on the frivolous, that only those arms in existence in the 18th century are protected by the Second Amendment. We do not interpret constitutional rights that way. Just as the First Amendment protects modern forms of communications, e. g., Reno v. American Civil Liberties Union, 521 U. S. 844, 849 (1997), and the Fourth Amendment applies to modern forms of search, e.g., Kyllo v. United States, 533 U. S. 27, 35-36 (2001), the Second Amendment extends, [**2792] prima facie, to all instruments that constitute bearable arms, even those that were not in existence at the time of the founding. [*581-*582]

Although he says “The 18th-century meaning is no different from the meaning today.” at the outset, the sources cited make it clear that it is the character of an item as a means of offense or defense, generally used in war, that makes it fall into the category “arms.” Which extends to bows and arrows as well as 18th century firearms as well as modern firearms.

“Arms” not limited to 18th Century “Arms”

The second point, particularly relevant to hackers, is that arms are not limited to those existing in the 18th century. Scalia specifically calls out both First and Fourth Amendment cases where rights have evolved along with modern technology. The adaptation to modern technology under those amendments is particularly relevant to making a hackers argument under the Second Amendment.

Posession/Bearing Arms

The meaning of “keep arms” requires only a paragraph or two:

Thus, the most natural reading of “keep Arms” in the Second Amendment is to “have weapons.” [*582]

Which settles the possession of arms question, but what about the right to carry such arms?

The notion of “bear arms” devolves into a lively contest of snipes between Scalia and Stevens. You can read both the majority opinion and the dissent if you are interested but the crucial text reads:

We think that JUSTICE GINSBURG accurately captured the natural meaning of “bear arms.” Although the phrase implies that the carrying of the weapon is for the purpose of “offensive or defensive action,” it in no way connotes participation in a structured military organization.

From our review of founding-era sources, we conclude that this natural meaning was also the meaning that “bear arms” had in the 18th century. In numerous instances, “bear arms” was unambiguously used to refer to the carrying of weapons outside of an organized militia. [*584]

I mention that point just in case some wag argues that cyber weapons should be limited to your local militia or that you don’t have the right to carry such weapons on your laptop, cellphone, USB drive, etc.

Meaning of the Operative Clause

c. Meaning of the Operative Clause. [4] Putting all of these textual elements together, we find that they guarantee the individual right to possess and carry weapons in case of confrontation. This meaning is strongly confirmed by the historical background of the Second Amendment. [5] We look to this because it has always been widely understood that the Second Amendment, like the First and Fourth Amendments, codified a pre-existing right. The very text of the Second Amendment implicitly recognizes the pre-existence of the right and declares only that it “shall not be infringed.” As we said in United [****11] States v. Cruikshank, 92 U. S. 542, 553 (1876), “[t]his is not a right granted by the Constitution. Neither is it in any manner dependent upon that instrument for its existence. The [**2798] second amendment declares [***658] that it shall not be infringed. . . .”[fn16] [*592]

You can’t get much better than a pre-existing right, at least not with the current Supreme Court composition. Certainly sounds like it would extent to defending your computer systems, which the government seems loathe to undertake.

Motivation for the Second Amendment

Skipping over the literalist interpretation of the prefactory clause, Scalia returns to the relationship between the prefatory and operative clause. The opinion goes on for twenty-one (21) pages at this point but an early paragraph captures the gist of the argument if not all of its details:

The debate with respect to the right to keep and bear arms, as with other guarantees in the Bill of Rights, was not over whether it was desirable (all agreed that it was) but over whether it needed to be codified in the Constitution. During the 1788 ratification debates, the fear that the Federal Government would disarm the people in order to impose rule through a standing army or select militia was pervasive in Anti-federalist rhetoric. See, e. g., Letters from The Federal Farmer III (Oct. 10, 1787), in 2 The Complete Anti-Federalist 234, 242 (H. Storing ed. 1981). John Smilie, for example, worried not only that Congress’s “command of the militia” could be used to create a “select militia,” or to have “no militia at all,” but also, as a separate concern, that “[w]hen a select militia is formed; the people in general may be disarmed.” 2 Documentary History of the Ratification of the Constitution 508-509 (M. Jensen ed. 1976) (hereinafter [*599] Documentary Hist.). Federalists responded that because Congress was given no power to abridge the ancient right of individuals to keep and bear arms, such a force could never oppress the people. See, e.g., A Pennsylvanian III (Feb. 20, 1788), in The Origin of the Second Amendment 275, [****15] 276 (D. Young ed., 2d ed. 2001) (hereinafter Young); White, To the Citizens of Virginia (Feb. 22, 1788), in id., at 280, 281; A Citizen of America (Oct. 10, 1787), in id., at 38, 40; Foreign Spectator, Remarks on the Amendments to the Federal Constitution, Nov. 7, 1788, in id., at 556. It was understood across the political spectrum that the right helped to secure the ideal of a citizen militia, which might be necessary to oppose an oppressive military force if the constitutional order broke down.[*598-*599]

Whether you choose to emphasize the disarming of the people by regulation of cyberweapons or the overreaching of the Federal government, the language here is clearly of interest in arguing for cyberweapons under the Second Amendment. The majority opinion on this point is found at pages [*598-*619].

Limitations on “Arms”

The right to possess arms, including cyberweapons, isn’t a slam dunk. The Federal and State governments can place some regulations on the possession of arms. One example that Scalia discusses is United States v. Miller, 307 U. S. 174, 179 (1939). Reading Miller:

…to say only that the Second Amendment [**2816] does not protect those weapons not typically possessed by law-abiding citizens for lawful purposes, such as short-barreled shotguns. That accords with the historical understanding of the scope of the right, see Part III, infra.[fn25] [*625]

So hackers will lose on blue boxes, if you know the reference but quite possibly win on software, code, etc. So far as I know, no one has challeged the right of computer users to protect themselves.

Is there a balancing test for cyber weapons?

The balance of the opinion is concerned with the case at hand and sparring with Justice Breyer but it does have this jewel when it is suggested that the Second Amendment should be subject to a balancing test (a likely argument about cyber weapons):

We know of no other enumerated constitutional right whose core protection has been subjected to a freestanding “interest-balancing” approach. The very enumeration of the right takes out of the hands of government — even the Third Branch of Government — the power to decide on a case-by-case basis whether the right is really worth insisting upon. A constitutional guarantee subject to future judges’ assessments of its usefulness is no constitutional guarantee at all. [15] Constitutional rights are enshrined with the scope they were understood to have when the people adopted [*635] them, whether or not future legislatures or (yes) even future judges think that scope too broad. We would not apply an “interest-balancing” approach to the prohibition of a peaceful neo-Nazi march through Skokie. See National Socialist Party of America v. Skokie, 432 U. S. 43 (1977) (per curiam). The First Amendment contains the freedom-of-speech guarantee that the people ratified, which included exceptions for obscenity, libel, and disclosure of state secrets, but not for the expression of extremely unpopular and wrongheaded views. The Second Amendment is no different. Like the First, it is the very product of an interest balancing by the people — which JUSTICE BREYER would now conduct for them anew. And whatever else it leaves to future evaluation, it surely elevates above all other interests the right of law-abiding, responsible citizens to use arms in defense of hearth and home. [*634-*635]

I rather like the lines:

The very enumeration of the right takes out of the hands of government — even the Third Branch of Government — the power to decide on a case-by-case basis whether the right is really worth insisting upon. A constitutional guarantee subject to future judges’ assessments of its usefulness is no constitutional guarantee at all.

Is the right to privacy no right at all because the intelligence community lapdog FISA court decides in secret when our right to privacy is unnecessary?

Open Issues

Forests have been depopulated to produce the paper required for all the commentaries on District of Columbia v. Heller. What I have penned above is a highly selective summary in hopes of creating interest in a Second Amendment argument for the possession and discussion of cyber weapons.

Open issues include:

  • Evolution of the notion of “arms” for the Second Amendment.
  • What does it mean to posses a cyber weapon? Is code required? Binary?
  • Defensive purposes of knowledge or cyber weapons.
  • Analogies to disarming the public.
  • Others?

As I suggested in A Well Regulated Militia, a Second Amendment argument to protect our rights to cyber weapons could prove to be more successful than other efforts to date.

Unless you like being disarmed while government funded hackers invade your privacy of course.

Let me know if you are interested in sponsoring research on Second Amendment protection for cyber weapons.

PS: Just so you know, I took my own advice and joined the NRA earlier this week. Fights like this can only be won with allies, strong allies.

March 21, 2015

GCHQ May Be Spying On You!

Filed under: Cybersecurity,Privacy,Security — Patrick Durusau @ 3:12 pm

UK government: GCHQ is permitted to break into computers anywhere in the world by Dave Neal.

Add one (1) to your present count of known cyber-adversaries.

GCHQ, like many similar agencies, have been given carte blanche to snoop around the world.

Dave reports that GCHQ has responded to this disclosure not with denial but protesting that it would never ever snoop without following all of the rules, except for those against snooping of course.

What fails in almost every government scandal isn’t the safeguards against wrong doing, but rather the safeguards against anyone discovering the wrong doing. Yes? So it isn’t that the government doesn’t lie, cheat, abuse, etc., but that they are seldom caught. Safeguards against government violating its own restrictions seem particularly weak.

The UK and other governments fail to realize every retreat from the rule of law damages the legitimacy of that government. If they think governing is difficult now, imagine the issues when the average citizen obeys the law only with due regard to the proximity of a police officer. People joke about that now but watch people obey even mindless traffic rules. To say nothing of more serious rules.

The further and further governments retreat into convenience of the moment decision making, the less and less call they will have on the average citizen to “do the right thing.” Why should they? Their leadership has set the example that whether it is lying to get elected (Benjamin Netanyahu) or lying to start a war (George W. Bush) or lying to get funding (Michael Rogers, its ok.

Since GCHQ has decided it isn’t subject to the law, would you report a plot against GCHQ or the UK government? (Assume you just overheard it and weren’t involved.)

March 16, 2015

Sharing and the IoT?

Filed under: IoT - Internet of Things,Privacy — Patrick Durusau @ 4:47 pm

Walter Adamson writes in Why the Internet of Things is about the data, not the ‘Thing’:

Wouldn’t it also be nice if you could learn the following about yourself and your lifestyle:

  • when you haven’t had a good enough sleep to undertake hard physical exertion without risking more fatigue;
  • when you seem to have an identifiable chronic bad sleep pattern that needs attention from an expert;
  • when your heart is healthy, and when it is needing attention;
  • your level of real fitness, and how your activity patterns are changing it for better or worse;
  • your real level of exertion, and which exercises/activities give you best fitness benefits;
  • When you are in danger of over-exercising and weakening your immune system;
  • how you compare to your peers and community and what you can learn from them?
Sharing the data shares the goodness

I’m sorry, I am old enough to have had any number of bad habits and poor lifestyle choices over the years. Deeply enjoyed all of them.

The very last thing I needed was my watch, TV, or car whining at me about my choices.

Adamson’s vision of the Internet of Things scenario is a nightmare where you may not live to be 100 but you will feel like it.

PS: You should cultivate good health habits, in moderation, but be mindful that no one says on their death bed: “I’m sorry I had such a good time.”

February 27, 2015

Onion.city – a search engine bringing the Dark Web into the light

Filed under: Privacy,Tor — Patrick Durusau @ 8:10 pm

Onion.city – a search engine bringing the Dark Web into the light by Mark Stockley.

From the post:

The Dark Web is reflecting a little more light these days.

On Monday I wrote about Memex, DARPA’s Deep Web search engine. Memex is a sophisticated tool set that has been in the hands of a few select law enforcement agencies for a year now, but it isn’t available to regular users like you and me.

There is another search engine that is though.

Just a few days before I wrote that article, on 11 February, user Virgil Griffith went onto the Tor-talk mailing list and announced Onion City, a Dark Web search engine for the rest of us.

The search engine delves into the anonymous Tor network, finds .onion sites and makes them available to regular users on the ordinary World Wide Web.

onion-city

Search and Access to Onion sites for Amusement ONLY! All of your activities are transparent to anyone capturing your web traffic.

If you need security and privacy, use a Tor client.

With that understanding: Onion City awaits your requests.

Is there a demand for an internal to Tor network search engine? Supported by internal to Tor advertising? Or is most Tor “marketing” by referral?

February 16, 2015

Jeb EMails – Poor Pickings for SSNs

Filed under: Privacy,Security — Patrick Durusau @ 4:57 pm

I have been meaning to mention Jeb Bush’s release of his emails as Florida governor as training data. JebEmails A reported 300,000+ emails were available in six files (original Outlook (.pst) format). The raw files aren’t available now due to SSNs being included in the original data release?

Anyone with a copy of the original data have a pointer?

That may seem callous but one of the rantings about the privacy violation, does mention:

Most of the exposed numbers (roughly 12,500) came from a spreadsheet attached to an email, meaning most of the people screwed over weren’t just randomly messaging their personal information to the then-governor. The bulk of the social security numbers were from a PowerPoint email attachment about people on a family services waiting list.

How many people on a family services waiting list do you think have accounts at stock trading houses or even a credit card with an unlimited overdraft privilege?

What are the odds that some of the 80 million SSNs hacked from Anthem Health Insurance might fall into one or both of those categories?

To say “privacy” and “breach” in the same sentence isn’t a signal to go to DEFCON 1.

Some breaches of privacy are more serious than others. Unless and until priorities are debated and adopted for sliding scale of types of privacy, public discussion will continue to flail about ineffectually every time privacy is mentioned.

When Jeb’s emails become available, again, I will return to the topic of using them as demonstration data.

PS: I saw that Jeb’s emails ended in 2007. Did Jeb stop using email after he left the governor’s office? Or is there a seven year blank spot in his email record?

I first saw this in a tweet by Charles Ditzel.

February 11, 2015

Cellphone Privacy for $$$?

Filed under: Cybersecurity,Privacy — Patrick Durusau @ 4:28 pm

Cyrus Farivar writes in: FBI really doesn’t want anyone to know about “stingray” use by local cops:

If you’ve ever filed a public records request with your local police department to learn more about how cell-site simulators are used in your community—chances are good that the FBI knows about it. And the FBI will attempt to “prevent disclosure” of such information.

Not only can these devices, commonly known as “stingrays,” be used to determine a phone’s location, but they can also intercept calls and text messages. During the act of locating a phone, stingrays also sweep up information about nearby phones. Last fall, Ars reported on how a handful of cities across America are currently upgrading to new hardware that can target 4G LTE phones.

The newest revelation about the FBI comes from a June 2012 letter written by the law enforcement agency to the Minnesota Bureau of Criminal Apprehension. It was first acquired and published by the Minneapolis Star Tribune in December 2014—similar language likely exists between the FBI and other local authorities that use stingrays.

As the letter states:

In the event that the Minnesota Bureau of Criminal Apprehension receives a request pursuant to the Freedom of Information Act (5 USC 552) or an equivalent state or local law, the civil or criminal discovery process, or other judicial, legislative, or administrative process, to disclose information concerning the Harris Corporation [REDACTED] the Minnesota Bureau of Criminal Apprehension will immediately notify the FBI of any such request telephonically and in writing in order to allow sufficient time for the FBI to seek to prevent disclosure through appropriate channels.

While the FBI did not immediately respond to Ars’ request for comment, privacy activists were dismayed to see this language.

“It’s remarkable to see collusion by state and federal agencies to undermine public records requests, which are clearly aimed at keeping the public in the dark about the use of Stingray technology,” Hanni Fakhoury, a lawyer with the Electronic Frontier Foundation, told Ars. “After all, any truly sensitive law enforcement details could be redacted under traditional public records act law. But the notion that the federal government would work to actively block disclosure of records seems clearly to have a chilling effect on obtaining information about this controversial surveillance tool.”

Coming to the attention of the FBI is a honor that puts you in good company, Lucille Ball, Truman Capote, Charlie Chaplin, John Denver, Walt Disney, Rock Hudson, Whitney Houston, Steve Jobs, Hellen Keller, Martin Luther King, Marilyn Monroe, Jackie Robinson, Anna Nicole Smith, George Steinbrenner, just to name some of the honorees.

But Hanni Fakhoury points out, the meek and mild are unlikely to ask, even if it means better protecting their privacy and the privacy of others.

Freedom of Information requests are a rope-a-dope strategy that relies on the largesse of government agencies in releasing details of their own misdeeds. Not to lessen the importance of Freedom of Information act like requests, shouldn’t we be more proactive, that is to say preventative, in the protection of our privacy?

For example, you use your cellphone ever day but most likely transition between a limited number of cell towers. Which cell phone towers? You can check any of these three sources: CellMapper.net, MapMuse.com, CellReception.com. (All from: Cell Phone Tower Locations by Michael Kwan.)

If you know your usual cellphone towers and you bother to check before sending text messages, you can eek out a little more privacy.

For searching purposes you can use “stingray” if you want to be confused with lots of entries about marine life (it does look like an FBI agent and cars (one of my favorites). Otherwise, use IMSI-Catcher (the privacy invading device) and/or IMSI-Catcher Detector (the defensive side). The Android IMSI-Catcher Detector (#AIMSICD) is an example of one IMSI-Catcher-Detector and they have a great list of other projects in the same area (software and hardware).

If you are afraid of being noticed by the FBI, I’m not sure having software on your phone to detect their snooping is the best option for you. For the moderately bolder, have a look. Contribute to the projects if at all possible.

Detecting IMSI-Catchers on your own is a great first step, but that doesn’t increases everyone’s privacy, just your own. What if there was a more aggressive way to protect your cellphone privacy and the cellphone privacy of others?

I ask because in reading the documentation at #AIMSICD, I ran across OpenCellID.

From the OpenCellID wiki:

OpenCellID is the world’s largest collaborative community project that collects GPS positions of cell towers, used free of charge, for a multitude of commercial and private purposes.

More than 49,000 contributors have already registered with OpenCellID, contributing more than 1 million new measurements every day in average to the OpenCellID database. Detailed statistics are available in real time.

The OpenCellID project was primarily created to serve as a data source for GSM localisation.
As of Jan, 2015, the database contained almost 7 million unique GSM Cell IDs and 1.2 Billion measurements.

OpenCellID provides 100% free Cell ID data (CC-BY-SA 3.0 license).
The OpenCellID database is published under a Creative Commons open content license with the intention of promoting free use and redistribution of the data.

All data uploaded by any of the contributors can also be downloaded again free of charge – no exceptions!

So, any GPS reading for a cell tower that is NOT registered with the FCC and that DOES NOT appear in OpenCellID (at least in the United States), is either a criminal or some government agency (is there a difference these days?) trying to invade your privacy. Reasoning than unregistered and cell towers that “move,” aren’t public structures delivering cellphone service.

Agreed?

Rather than asking the government for invoices for purchases of IMSI-catcher software, why not create listening posts for IMSI-catchers and de-dupe that data against the known (legitimate) cell towers and contribute the legitimate data back to OpenCellID under the OpenCellID license?

For a fee (think $$$ in your local currency), you can text warnings to your subscribers about IMSI-catchers that have been detected in their area.

For example, I want to visit the U.S. District Court in Atlanta and while near the courthouse, I want to send private text messages to a client and/or an attorney. Today, can I do that safely?

federal-court-atl

Judging from the map portion I have reproduced from OpenCellID, I would guess, remember, guess only, yes.

But that is a guess in the absent of any data on IMSI-catchers in the area.

How much would you pay to turn that “guess” into a fact?

For example, what if I had deployed sensitive IMSI-Catcher-Detectors in the area:

Traffic-Cone-200x300

(Amazing what a handful of asphalt and a traffic cone can conceal in plain sight.)

With a grid of IMSI-Catcher-Detectors in place, I can answer your question about texting a client or attorney in the vicinty of the U.S. District Courthouse with a fact-based YES or NO! For a fee.

IMSI-Catcher-Detectors in temporary, permanent or semi-permanent locations, deduped against the OpenCellID database, enables the creation of commercially valuable data to sell in real time to cellphone users who value their privacy. Moreover, with enough coverage, the history of such data will provide insights simply not possible to obtain from purchase dates of IMSI-catchers by criminals (governmental and otherwise).

Monetizing the right to privacy isn’t the only way to defend it but it could hardly do worse than civil libertarians have done over the past couple of decades.

Yes?

PS: You do realize that with enough granularity of tracking that IMSI-catchers can be tracked in real time with inferred GPS locations? Just in case you want to say “hello” to anyone trying to intercept your communications. Think of it as an “Eaves-Dropper-Near-Me” app. Certainly an additional fee item.

February 1, 2015

Mapping the Blind Spots:…

Filed under: Data Science,Mapping,Maps,Privacy — Patrick Durusau @ 4:48 pm

Mapping the Blind Spots: Developer Unearths Secret U.S. Military Bases by Lorenzo Franceschi-Bicchierai.

From the post:

If you look closely enough on Google or Bing Maps, some places are blanked out, hidden from public view. Many of those places disguise secret or sensitive American military facilities.

The United States military has a foothold in every corner of the world, with military bases on every continent. It’s not even clear how many there are out there. The Pentagon says there are around 5,000 in total, and 598 in foreign countries, but those numbers are disputed by the media.

But how do these facilities look from above? To answer that question, you first need to locate the bases. Which, as it turns out, is relatively easy.

That’s what Josh Begley, a data artist, found out when he embarked on a project to map all known U.S. military bases around the world, collect satellite pictures of them using Google Maps and Bing Maps, and display them all online.

The project, which he warns is ongoing, was inspired by Trevor Paglen’s book “Blank Spots on the Map” which goes inside the world of secret military bases that are sometimes censored on maps.

A great description of how to combine public data to find information others prefer to not be found.

I suspect the area is well enough understood to make a great high school science fair project, particularly if countries that aren’t as open as the United States were used as targets for filling in the blank spaces. Would involve obtaining public maps for that country, determining what areas are “blank,” photo analysis of imagery, correlation with press and other reports.

Or detection of illegal cutting of forests, mining, or other ecological crimes. All of those are too large scale to be secret.

Better imagery is only a year or two away, perhaps sufficient to start tracking polluters who truck industrial wastes to particular states for dumping.

With satellite/drone imagery and enough eyes, no crime is secret.

The practices of illegal forestry, mining, pollution, virtually any large scale outdoor crime will wither under public surveillance.

That might not be a bad trade-off in terms of privacy.

December 28, 2014

Prying Eyes: Inside the NSA’s War on Internet Security

Filed under: Cybersecurity,NSA,Privacy,Security — Patrick Durusau @ 5:03 pm

Prying Eyes: Inside the NSA’s War on Internet Security

Summary:

US and British intelligence agencies undertake every effort imaginable to crack all types of encrypted Internet communication. The cloud, it seems, is full of holes. The good news: New Snowden documents show that some forms of encryption still cause problems for the NSA.

A very long and comprehensive article from the SPIEGEL on encryption that may cause issues for the NSA. It is too complete to easily summarize so I suggest you read it in full and then take the following actions:

  • If you are not a cryptographer or child of a cryptographer, donate to one of more of the open source encryption projects you will find in the SPIEGEL article. Monthly if at all possible. Perhaps you can’t write encryption code but you can support those who do.
  • Use and consistently update your encryption technology and support those who work to make encryption easier to use. We need to create a tsunami of highly encrypted data everyday. From phone calls and IMs to emails and documents.
  • Politically resist all laws or regulations that make interception and/or decryption of communications legal and/or easier. You may not think you are committing a crime, but when government officials declare crimes and execute the guilty in private, how do you know?
  • Should you encounter any documents or data that expose government surveillance programs, there are existing examples of what you should do.

Once upon a time, privacy was a matter of the difficulty of tracking down physical copies of public records and asking neighbors what you liked to talk about. Those difficulties no longer exist and the electronic debris of our lives tells more than you might know.

The only privacy you have today is the privacy that you stake out and protect on your own. There are no guarantees that you will be successful in protecting your privacy but I can guarantee you won’t have any privacy if you don’t try.

December 9, 2014

The Coming Era of Egocentric Video Analysis

Filed under: Identifiers,Identity,Image Processing,Privacy — Patrick Durusau @ 3:58 pm

The Coming Era of Egocentric Video Analysis

From the post:

Head-mounted cameras are becoming de rigueur for certain groups—extreme sportsters, cyclists, law enforcement officers, and so on. It’s not hard to find content generated in this way on the Web.

So it doesn’t take a crystal ball to predict that egocentric recording is set to become ubiquitous as devices such as Go-Pros and Google Glass become more popular. An obvious corollary to this will be an explosion of software for distilling the huge volumes of data this kind of device generates into interesting and relevant content.

Today, Yedid Hoshen and Shmuel Peleg at the Hebrew University of Jerusalem in Israel reveal one of the first applications. Their goal: to identify the filmmaker from biometric signatures in egocentric videos.

A tidbit that I was unaware of:

Some of these are unique, such as the gait of the filmmaker as he or she walks, which researchers have long known is a remarkably robust biometric indicator.”Although usually a nuisance, we show that this information can be useful for biometric feature extraction and consequently for identifying the user,” say Hoshen and Peleg.

Makes me wonder if I should wear a prosthetic device to alter my gait when I do appear in range of cameras. 😉

Works great with topic maps. All you may know about an actor is that they have some gait with X characteristics. And a perchance for not getting caught planting explosive devices. With a topic map we can keep their gait as a subject identifier and record all the other information we have on such an individual.

If we ever match the gait to a known individual, then the information from both records, both as the anonymous gait owner and the known known individual will be merged together.

It works with other characteristics as well, which enables you to work from “I was attacked…,” to more granular information that narrows the pool of suspects down to a manageable size.

Traditionally the job of veterans on the police force who know their communities and who are the usual suspects but a topic map enhances their value by capturing their observations for use by the department long after a veterans retirement.

From arXiv: Egocentric Video Biometrics

Abstract:

Egocentric cameras are being worn by an increasing number of users, among them many security forces worldwide. GoPro cameras already penetrated the mass market, and Google Glass may follow soon. As head-worn cameras do not capture the face and body of the wearer, it may seem that the anonymity of the wearer can be preserved even when the video is publicly distributed.
We show that motion features in egocentric video provide biometric information, and the identity of the user can be determined quite reliably from a few seconds of video. Biometrics are extracted by training Convolutional Neural Network (CNN) architectures on coarse optical flow.

Egocentric video biometrics can prevent theft of wearable cameras by locking the camera when worn by people other than the owner. In video sharing services, this Biometric measure can help to locate automatically all videos shot by the same user. An important message in this paper is that people should be aware that sharing egocentric video will compromise their anonymity.

Now if we could just get members of Congress to always carry their cellphones and wear body cameras.

November 20, 2014

FISA Judge To Yahoo: If US Citizens Don’t Know They’re Being Surveilled, There’s No Harm

Filed under: Cybersecurity,Privacy,Security — Patrick Durusau @ 8:22 pm

FISA Judge To Yahoo: If US Citizens Don’t Know They’re Being Surveilled, There’s No Harm

From the post:

A legal battle between Yahoo and the government over the Protect America Act took place in 2008, but details (forced from the government’s Top Secret file folders by FISA Judge Reggie Walton) are only emerging now. A total of 1,500 pages will eventually make their way into the public domain once redactions have been applied. The most recent release is a transcript [pdf link] of oral arguments presented by Yahoo’s counsel (Mark Zwillinger) and the US Solicitor General (Gregory Garre).

Cutting to the chase:

But the most surprising assertions made in these oral arguments don’t come from the Solicitor General. They come from Judge Morris S. Arnold, who shows something nearing disdain for the privacy of the American public and their Fourth Amendment rights.

In the first few pages of the oral arguments, while discussing whether or not secret surveillance actually harms US citizens (or the companies forced to comply with government orders), Arnold pulls a complete Mike Rogers:

If this order is enforced and it’s secret, how can you be hurt? The people don’t know that — that they’re being monitored in some way. How can you be harmed by it? I mean, what’s –what’s the — what’s your — what’s the damage to your consumer?

By the same logic, all sorts of secret surveillance would be OK — like watching your neighbor’s wife undress through the window, or placing a hidden camera in the restroom — as long as the surveilled party is never made aware of it. If you don’t know it’s happening, then there’s nothing wrong with it. Right? [h/t to Alex Stamos]

In the next astounding quote, Arnold makes the case that the Fourth Amendment doesn’t stipulate the use of warrants for searches because it’s not written right up on top in bold caps… or something.

The whole thrust of the development of Fourth Amendment law has sort of emphasized the watchdog function of the judiciary. If you just look at the Fourth Amendment, there’s nothing in there that really says that a warrant is usually required. It doesn’t say that at all, and the warrant clause is at the bottom end of the Fourth Amendment, and — but that’s the way — that’s the way it has been interpreted.

What’s standing between US citizens and unconstitutional acts by their government is a very thin wall indeed.

Bear in mind that you are not harmed if you don’t know you are being spied upon.

I guess the new slogan is: Don’t Ask, Don’t Look, Don’t Worry.

Suggestions?

UK seeks to shutter Russian site streaming video from webcams

Filed under: Cybersecurity,Privacy,Security — Patrick Durusau @ 8:21 pm

UK seeks to shutter Russian site streaming video from webcams by Barb Darrow.

From the post:

If you feel like someone’s watching you, you might be right.

A mega peeping Tom site out of Russia is collecting video and images from poorly secured webcams, closed-circuit TV cameras and even baby monitors around the world and is streaming the results. And now Christopher Graham, the U.K.’s information commissioner, wants to shut it down, according to this Guardian report.

According to the Guardian, Graham wants the Russian government to put the kibosh on the site and if that doesn’t happen will work with other regulators, including the U.S. Federal Trade Commission, to step in.

Earlier this month a NetworkWorld blogger wrote about a site, presumably the same one mentioned by Graham, with a Russian IP address that accesses some 73,000 unsecured security cameras.

The site has a pretty impressive inventory of images it said were gleaned from Foscam, Linksys, Panasonic security cameras, other unnamed “IP cameras” and AvTech and Hikvision DVRs, according to that post. The site was purportedly set up to illustrate the importance of updating default security passwords.

Apologies but it looks like the site is offline at the moment. Perhaps overload from visitors given the publicity.

An important reminder that security begins at home and with the most basic steps, such as changing default passwords.

Only if you access the site and find out that you have been spied upon will you suffer any harm.

I am completely serious, only if you discover you have been spied upon can you suffer any harm.

Authority for that statement? FISA Judge To Yahoo: If US Citizens Don’t Know They’re Being Surveilled, There’s No Harm.

November 18, 2014

6 links that will show you what Google knows about you

Filed under: Cybersecurity,Privacy,Security — Patrick Durusau @ 9:27 am

6 links that will show you what Google knows about you by Cloud Fender.

After reviewing these links, ask yourself: “How do I keep Google, etc. from knowing more about me?”

November 9, 2014

Another Big Brother? [Dark Car Services]

Filed under: Cybersecurity,Privacy,Security — Patrick Durusau @ 7:30 pm

Lenders Can Now Disable Your Car When You’re Driving on the Freeway by Cliff Weathers.

From the post:


The New York Times recently reported that about 2 million cars are now outfitted with such kill switches in the U.S., which is about one-quarter of subprime car loans, and creditors are not shy when it comes to remotely disabling cars whose owners are behind on their payments:

“Some borrowers say their cars were disabled when they were only a few days behind on their payments, leaving them stranded in dangerous neighborhoods. Others said their cars were shut down while idling at stoplights. Some described how they could not take their children to school or to doctor’s appointments. One woman in Nevada said her car was shut down while she was driving on the freeway.

“Beyond the ability to disable a vehicle, the devices have tracking capabilities that allow lenders and others to know the movements of borrowers, a major concern for privacy advocates. And the warnings the devices emit — beeps that become more persistent as the due date for the loan payment approaches — are seen by some borrowers as more degrading than helpful.”

Subprime automotive-loan borrowers, those with FICO credit scores below 660, debt-to-income ratios of more than 50% or a bankruptcy in the past 60 months, are a growing segment of automotive borrowers. This phenomenon has been buoyed by auto dealers trying to continue a strong sales rebound after years of weak sales and by securities investors who buy bonds backed by those loans and see them as a way to get ample returns when other interest rates remain low.

Hacking automobiles isn’t a new idea. (Rootkit for an Automobile Near You) But building automobiles for remote control by others? Of course we all trust our well-meaning government with such powers (NOT!) but what do you do when the disabling device becomes as common as seat belts?

Not that I think you will be able to stop this trend but you may want to start or invest in “dark car” services. That is services that replace/remove and/or disable systems that make your car hackable or subject to control by others.

Automobile privacy will become a luxury of the well to do and selling privacy may be your ticket to joining that class.

PS: Here’s an idea for a Dark Hat conference contest. Have a car hacking offense and defense contest on a car with all the usual features and a kill switch.

November 8, 2014

Terms of Service

Filed under: BigData,Cybersecurity,Privacy,Security,WWW — Patrick Durusau @ 11:53 am

Terms of Service: understanding our role in the world of Big Data by Michael Keller and Josh Neufeld.

Caution: Readers of Terms of Service will discover they are products and only incidentally consumers of digital services. Surprise, dismay, depression, and despair are common symptoms post-reading. You have been warned.

Al Jazeera uses a comic book format to effectively communicate privacy issues raised by Big Data, the Internet of Things, the Internet, and “free” services.

The story begins with privacy concerns over scanning of Gmail content (remember that?) and takes the reader up to present and likely future privacy concerns.

I quibble with the example of someone being denied a loan because they failed to exercise regularly. The authors innocently assume that banks make loans with the intention of being repaid. That’s the story in high school economics but a long way from how lending works in practice.

The recent mortgage crisis in the United States was caused by banks inducing borrowers to over state their incomes, financing a home loan and its down payment, etc. Banks don’t keep such loans but package them as securities which they then foist off onto others. Construction companies make money building the houses, local government gain tax revenue, etc. Basically a form of churn.

But the authors are right that in some theoretical economy loans could be denied because of failure to exercise. Except that would exclude such a large market segment in the United States. Did you know they are about to change the words “…the land of the free…” to “…the land of the obese…?”

That is a minor quibble about what is overall a great piece of work. In only forty-six (46) pages it brings privacy issues into a sharper focus than many longer and more turgid works.

Do you know of any comparable exposition on privacy and Big Data/Internet?

Suggest it for conference swag/holiday present. Write to Terms-of-Service.

I first saw this in a tweet by Gregory Piatetsky.

« Newer PostsOlder Posts »

Powered by WordPress