Are Apple, Google, Microsoft And Mozilla Helping Governments Carry Out Man-In-The-Middle Attacks?

(Mis)Uses of Technology

from the and-what-can-they-do-about-it? dept

Back in September, we reported on the Chinese authorities using man-in-the-middle attacks to spy on citizens who carry out Google searches over encrypted connections. That’s done by using a fake security certificate to redirect traffic to a server where the traffic is decrypted, analyzed, and blocked if necessary. A new post on the Greatfire.org Web site points out that this approach can only work if the user’s computer trusts the certificate’s issuing authority, in this case the China Internet Network Information Center, and that it’s curious that browsers from the West do so quite so readily:

Although the logic of revoking CNNIC as a trusted certificate authority might seem inarguable, the consequences of doing so are likely to be serious. For example, the Chinese government might decide to ban the use of any browser that did not include CNNIC. That’s hard to police, but the threat alone would be enough to dissuade any software company from removing CNNIC’s certificate from its browser.

Perhaps the best solution is simply making users aware of the issue, and explaining how they can remove any certificate authority they have doubts about. And not just for China: these problems can arise in any country where a local trusted certificate authority is under the direct — or indirect — control of the government.

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Filed Under: certificate authorities, china, man in the middle attacks, security, trust
Companies: apple, cnnic, google, microsoft, mozilla

Islamic Extremists Use YouTube's Automated Copyright Dispute Process To Access Critics' Personal Data

Copyright

from the the-further-breaking-of-a-very-broken-system dept

YouTube’s infringement reporting system is — like many others around the web — fundamentally broken. Making bogus copyright claims is still an easy way to get channels shut down or to siphon ad revenue from existing videos. It can also be used as a censor — a cheap and dirty way to shut up critics or remove compromising video.

Apparently, Islamic extremists linked with Al-Qaeda have found another use for YouTube’s mostly automated dispute process: low-effort doxxing. According to German news sites, a YouTube channel (Al Hayat TV) known for its criticism of Islam has had to send its listed contact person into hiding after bogus copyright claims filed by extremists led to the exposure of his personal information.

On September 25th, someone using the name “First Crist, Copyright” filed bogus copyright complaints against Al Hayat TV. In order to prevent the channel from being shut down for multiple “strikes,” Al Hayat TV was forced to file a counter notification. But in order to do so, the channel operators had to expose sensitive information.

From the YouTube Help section on counter notifications:

After we receive your counter notification, we will forward it to the party who submitted the original claim of copyright infringement. Please note that when we forward the notice, it will include your personal information. By submitting a counter notification, you consent to having your information revealed in this way.

Some of the people behind the channel contacted YouTube and tried to explain the danger of releasing this personal information, especially considering a majority of its contributors operated anonymously for safety reasons. These pleas went unheeded, thanks to the automation of the copyright dispute process. Each request was greeted with pre-generated responses from YouTube support. Discussions with actual humans at YouTube only confirmed that the channel wouldn’t be reinstated without following the counter notice procedure — including handing over details on the channel’s contact person.

Unfortunately unaware of the fact that it could have used a legal representative to handle this, Al Hayat TV filed formal counter notices using one of its member’s names. Shortly thereafter, it received threats from the supposed copyright holder warning the contact person to “watch your head” (a phrase basically understood to be a death threat in Arabic) and promising to spread this info across several extremist websites. The message also told the contact person to [paraphrased slightly] enjoy living in fear under police protection. The contact person has since gone into hiding.

The quid pro quo of the copyright dispute process netted Al Hayat TV death threats and a completely bogus “First Crist, Copyright” contact person: Samuel George of 245 George Street in Sydney, Australia. Google Street View shows this address to be right in the middle of some prime downtown shopping.

At this point, it would be beyond tedious to rehash the problems with these automated enforcement systems. But this story shows the system can be easily exploited to satisfy very twisted ends. YouTube’s copyright dispute process is automated out of necessity. The fact that it instantly “sides” with the accuser contributes to the problem. Trying to sort out the legitimacy of copyright claims without chewing up thousands of man-hours would be a logistical nightmare and would quite possibly result in a system inferior to the irreversibly-broken one in place today. The unfortunate lesson to be drawn from this debacle is that those on the “inside” need to game the system as effectively as those on the “outside.” If YouTube’s going to treat copyright claims issued by “Crist” from the middle of the Establishment Bar in Sydney, Australia as wholly legitimate, Al Hayat TV should be shown the same disinterested “courtesy” and be allowed to issue a counter notices signed by an imaginary attorney residing at some random address. After all, if the dispute continues past this point, YouTube simply washes its hands of the entire situation and tells both parties to work it out themselves.

Copyright isn’t really the culprit here. It’s the systems that have been developed in response to rights holders’ complaints. They’re too easily gamed and little to nothing in the way of deterrents. Unfortunately, unlike incidents where copyright enforcement has been clumsily deployed as a censor, there’s no Streisand Effect equivalent for those who greet speech they don’t like with threats and violence. Extremists like this simply don’t care what others think of their irrational hatred and colossally stupid worldview.

Filed Under: al hayat tv, al qaeda, automated process, contentid, copyright, dmca, doxxing, identification, terrorists
Companies: google, youtube

James Comey Again Demands Tech Companies Do As He Says And Grant The FBI Complete Access To Whatever It Wants

(Mis)Uses of Technology

from the please-please-please-let-me-get-what-I-want dept

FBI director James Comey — (again) citing no legal authority or precedent — is demanding Google and Apple hand over the keys to their default phone encryption.

The director of the FBI on Monday doubled down on demands that Silicon Valley giants cooperate in the course of criminal investigations, saying that tech companies such as Apple and Google have to unlock cellphones, if authorities request it.

And what has all this “demanding” and “doubling down” netted Comey? Nothing really. He still needs a compliant legislative body to oblige his fantasies of subservient tech companies opening wide for fat-fingered g-men.

Comey’s latest attempt to sell the government’s plan to exchange fear for all-access mobile phone passes came at a counterterrorism conference hosted by Fordham University. And, once again, Comey followed up his baseless demands with a whole lot of nothing.

Comey didn’t specify what he wants Apple and Google to do but said that to find a solution requires an “honest debate.”

“I don’t want to tell people what to do,” he said. “But I want to try to foster a national conversation about this.”

“There has to be some solution that will allow us with lawful authority to be able to have the company unlock the device,” he added.

There’s nothing honest about Comey’s approach and walking around claiming that phone encryption will lead to new highs in terrorist attacks and pedophilia is only part of the dishonesty. Comey claims he doesn’t want to “tell people what to do,” apparently completely unaware that throwing around the weight of his agency and position and demanding phone makers play by his rules is the very definition of “telling people what to do.”

Unfortunately for Comey, throwing around this weight just isn’t enough anymore. No one in the tech world is going to be cowed into obeisance. Not anymore. Now, everyone wants to stick it to The Man, even many of those that worked in close proximity with government agencies over the past several years. Why? Because the nation’s intelligence and investigative agencies are always hungry. They always want more.

The “solution” Comey’s looking for runs through Congress. Historically, legislators have almost always come down on the side of law enforcement. The twin specters of terrorism and child molestation have resulted in plenty of government expansion and law enforcement leeway over the years. But maybe even the legislators are beginning to realize that this is something that can never be satiated. You can give and give and give and the same people will return over and over again, asking for just a little more. The government is — and has been for years — a mixture of junkies and their enablers.

Maybe we’re at the point that a certain number of enablers have become sick of the constant need. Maybe they’ll cut Comey and his ilk off and put up with the keening, inarticulate sounds of their withdrawal. Or maybe they’ll meet them out back and slip them a fix when they think no one’s looking. As I’ve said before, the voices out front are claiming the FBI will find no assistance here. It’s the large number of those who’ve offered no opinion we need to keep an eye on. Law enforcement’s emotional blackmail has worked for years. It may have recently lost its edge, but it’s still too powerful to count out completely.

“In one way or another, our entire lives — our social lives, our work lives — reside online and on these devices,” Comey said. “And that’s a great thing. But that’s also where the bad guys are.”

Yeah. As in “real life” itself. I guess we should expect him to ask for “golden key” access to every front door in America. As long as he’s transparent about it, what’s there to be concerned about? Comey just wants to keep America safe. Who are we to deny complete access to our “entire lives?”

Filed Under: back doors, encryption, fbi, front door, james comey, mobile encryption
Companies: apple, google

Germany's Top Publisher Admits Its Web Traffic Plummeted Without Google; Wants Politicians To 'Take Action'

Copyright

from the careful-what-you-wish-for dept

A couple of weeks ago, we wrote about the decision by German publishers to grant Google a “free license” to post snippets — a humiliating climbdown from their earlier position that Google should pay for the privilege of sending them traffic. Now Germany’s leading publisher, Springer, has admitted in a Reuters article that stopping Google from using snippets for a while was catastrophic for its titles:

The Reuters article provides some interesting figures quantifying the power of Google in Germany:

In the same piece, a Google spokesperson provided some other numbers:

Doepfner said his company’s climbdown was

As we wrote recently, there’s a risk he may well get his wish, especially in the light of these newly-released figures demonstrating Google’s huge power in driving traffic to sites. Given the complete failure of attempts to “curb” Google’s powers in Germany, It’s hard to see how that will turn out well Europe-wide.

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Filed Under: copyright, germany, snippets
Companies: axel springer, google

Former NSA Lawyer Says Reason Blackberry Failed Was 'Too Much Encryption' Warns Google/Apple Not To Make Same Mistake

Say That Again

from the give-it-a-rest,-stew dept

There are times that I wonder if former NSA General Counsel Stewart Baker is just trolling with his various comments, because they’re so frequently out of touch with reality, even though he’s clearly an intelligent guy. His latest is to join in with the misguided attacks on Apple and Google making mobile encryption the default on iOS and Android devices, with an especially bizarre argument: protecting the privacy of your users is bad for business. Oh really? Specifically, Baker engages in some hysterically wrong historical revisionism concerning the rise and fall of RIM/Blackberry:

Baker said encrypting user data had been a bad business model for Blackberry, which has had to dramatically downsize its business and refocus on business customers. ?Blackberry pioneered the same business model that Google and Apple are doing now – that has not ended well for Blackberry,? said Baker.

He claimed that by encrypting user data Blackberry had limited its business in countries that demand oversight of communication data, such as India and the UAE and got a bad reception in China and Russia. ?They restricted their own ability to sell. We have a tendency to think that once the cyberwar is won in the US that that is the end of it – but that is the easiest war to swim.?

While it’s true that some countries, like India, demanded the right to spy on Blackberry devices, the idea that this was the reason for the company’s downfall is ludicrous. First of all, RIM gave in to some of those demands anyway. But, more importantly, the reason that Blackberry failed was because the company just couldn’t keep up from an innovation standpoint — and that’s because early on it made the decision to focus onenforcing patents, rather than truly innovating. RIM got fat and lazy by getting an early lead and then focusing on protecting it, rather than keeping up with the market. And… one of the reasons it got that early lead was because companies were willing to buy into the Blackberry in part because of its strong encryption.

The idea that encryption was bad for business because China and Russia couldn’t spy on people is not only ridiculous and silly, but it appears to be Baker supporting authoritarian states spying on its citizenry. What the hell, Stewart?

Beyond that, Baker insists that, really, the public doesn’t want encryption anyway, and if people only knew what was really going on with the “bad guys,” we’d all be willing to give up our privacy:

Baker said the market for absolute encryption was very small, and that few companies wanted all their employees? data to be completely protected. ?There?s a very comfortable techno-libertarian culture where you think you?re doing the right thing,? said Baker.

?But I?ve worked with these companies and as soon as they get a law enforcement request no matter how liberal or enlightened they think they are, sooner to later they find some crime that is so loathsome they will do anything to find that person and identify them so they can be punished.

Right. And that’s what basic police and detective work is for. It doesn’t mean that you need to weaken the security and privacy of everyone else. Anyway, let’s see if Baker goes out and shorts Apple and Google’s stock now that he believes encryption and protecting the privacy of their users is really so bad for business.

Filed Under: blackberry, china, cryptowars, encryption, india, nsa, russia, stewart baker, surveillance
Companies: apple, blackberry, google, rim

Spain Passes Copyright Law; Demands Payment For Snippets And Linking To Infringing Content

Copyright

from the taxing-google dept

Apparently ignoring just how badly this worked out for publishers in Germany, the Spanish Parliament has passed a law to fine aggregators and search engines for using snippets or linking to infringing content. As plenty of folks have described, the bill is clearly just a Google tax. As we had discussed, the proposed bill would be a disaster for digital commons/open access projects. There had been some thought that the proposed bill might be delayed because of a referral to the EU Court of Justice on a related issue, but apparently that didn’t happen. Either way, it looks like the bill kept the ridiculous “inalienable right” to being paid for snippets — meaning that Creative Commons-type licenses may not even be allowed, and people won’t even be allowed to offer up their content for free. That’s ridiculous.

It appears that almost everyone dislikes the law that passed. On the internet/aggregator side of things, the law doesn’t make any sense at all, and seems likely to harm any sort of aggregator setup. And, meanwhile, those who want greater copyright expansion felt the law was a “missed opportunity” that is described as “vague and weak.” I guess the silver lining is that “it could have been worse.”

This idea of taxing aggregators for promoting your content is still completely ridiculous. It remains to be seen if Google takes the same approach as it did in Germany, removing the snippets of those who protest, only to have them begging to put them back — except that, unlike in Germany, the newspapers may not be able to grant a free license thanks to the whole “inalienable right” thing. Either way, it’s unfortunate that this seems to be the direction Europe is heading in. These kinds of laws are a recipe for chilling effects on innovation online, scaring companies away from doing useful things.

Filed Under: aggregators, copyright, google tax, links, snippets, spain
Companies: google

Europe's New Digital Commissioner Explores Imposing An EU-Wide 'Google Tax'

Failures

from the not-learning-from-experience dept

Last week, Techdirt reported on the humiliating and inevitable climbdown by German publishers in their attempt to force Google to pay for daring to drive traffic to their sites by using snippets from their publications. Despite that abject failure, it seems that the European Union’s new commissioner for the digital realm, Günther Oettinger, is thinking about bringing in exactly the same misguided idea across the whole of the European Union, as the Handelsblatt newspaper reports (translation by Pirate Party MEP Julia Reda):

Coming from the person who is charged with reforming European copyright, this does not augur well. If Oettinger really thinks that such a tax is the way forward for copyright in the digital age, he is evidently as clueless about the Internet as everyone feared he was, after telling the European Parliament that celebrities storing nude pictures online are stupid.

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Filed Under: copyright, eu, europe, google tax, gunther oettinger, snippets
Companies: google

German Publishers Grant Google A 'Free License' Google Never Needed To Post News Snippets

Failures

from the well-that-solves-that dept

Remember earlier this year when German newspaper publishers, led by rights management firm VG Media, demanded Google pay them a massive amount of money (11% of all ad revenue on any page linking to their works) for having the gall to send those publishers traffic via Google News? VG Media insisted that Google’s use of “snippets” was illegal. German regulators rejected this demand, but VG Media was still pursuing legal efforts to force Google to pay. Given that, Google did what made the most sense and removed the snippets for VG Media associated publishers. You’d think that this would make VG Media happy. Instead, it claimed that Google was engaged in “blackmail.”

Yes, VG Media claimed that using snippets was illegal, but getting rid of them was “blackmail.” The logic of a legacy industry.

Taking that logic one step further, VG Media has now decided to (and I’m not making this up) grant Google a “free license” to let Google use the snippets. This whole thing was about money in the first place, and now VG Media isn’t getting any money… and it looks ridiculous and foolish for having tried this in the first place. The end result is the same: snippets are in Google News, VG Media publications are getting traffic, but VG Media has made itself look silly.

Filed Under: germany, google news, snippets
Companies: google, vg media

Google Continues To Try To Appease Hollywood, Though It Is Unlikely To Ever Be Enough

Overhype

from the because-of-course-not dept

Google has come out with the latest version of its “How Google Fights Piracy” report (pdf link), going to great lengths to show how the company goes above and beyond what is required by law to try to drive people to authorized copies of content while also increasing opportunities for content creators to monetize their own content. There really aren’t too many surprises in the report — it just looks like an extension of what they’ve said in the past. The company is apparently about to roll out an update to its program that “downranks” certain sites based on how many DMCA notices it gets — something that’s been a huge point of contention from the RIAA and MPAA. In effect Google is basically saying to the major music and movie companies: you guys still haven’t figured out how to optimize your content for search engines (like nearly everyone else online) so, fuck it, we’ll do it for you if you’ll just stop these ridiculous accusations. Of course, it’s unlikely to work.

Just this week James Murdoch insisted, incorrectly, that search engines love piracy because it brings them revenue. This has never made any sense at all, but it’s a myth that flows through the legacy entertainment industry. How Google actually makes any money from those links is never explained, because there isn’t an answer. And the question of why the industry doesn’t do a better job getting its own content more highly ranked is ignored as well.

And, of course, there’s a real risk that by strengthening the “signalling” power of DMCA notices, what Google is really doing is giving the legacy players a tool for search engine “de-optimization”, so that rather than improving their own offerings, they now have every incentive in the world to just file a bunch of DMCA notices against sites they don’t like. This is why there’s reasonable fear from many that this new move by Google will actually lead to an increase in bogus DMCA notices that result in legitimate content being censored.

But, here’s the thing: as we said when Google first came out with this report, it will never be enough for the legacy guys in Hollywood. That’s because they incorrectly blame Google for their own inability to adapt to the changing market. They blame their diminishing revenue on Google, and even as Google makes it harder and harder to find unauthorized content, that revenue isn’t going to come back… so they’ll still blame Google. But Google was never the problem. The legacy entertainment industry and its political supporters will continue to point to search results that don’t exist and search terms that are never used as some sort of “proof” because that’s what they do. Rather than adapt, they really just want Google to do things for them. And for whatever reason, Google is doing more and more… and it’s unlikely to ever please the likes of James Murdoch, because Google “not doing things” was never the real problem.

Filed Under: copyright, dmca, hollywood, piracy, search engines, takedowns
Companies: google