Feds To FISC: Of Course We Don't Have To Share Our Full Legal Filings With Companies Suing Us Over NSA Transparency

from the because dept

As you may recall, in the ongoing lawsuit by various tech companies against the government, in which they’re seeking to reveal some rather basic details about how many surveillance data requests they get and how many users are impacted, much of the feds’ brief was redacted… even to the tech companies. The companies argued, quite reasonably, that it was crazy to make them fight a legal battle in which the DOJ could make arguments that the companies themselves couldn’t see or respond to. They asked the FISA Court to either let them see the arguments or to remove them from the case.

The DOJ has now filed its response, which basically says “we’ve revealed enough.”

The Government’s public brief meets and exceeds the requirements of Rule 7(j). The rule clearly provides that submissions to the Court “which may include classified information” will be reviewed by the Court “ex parte and in camera” and that adversarial parties will receive only “an unclassified or redacted version” which “clearly articulate[s] the government’s legal arguments.” Rule of Procedure 7(j). Not only does the Government’s public brief “clearly articulate the government’s legal arguments,” the legal arguments are fully disclosed. The redacted information contains no additional legal arguments, no case citations, and no discussion of statutory or other law.

Of course, that raises other questions. If the redacted portions (which are fairly large) don’t raise legal arguments, then what are they doing?

The government also argues that the executive branch gets the right to determine what to redact and the court should defer to the government on such things:

… this Court does not independently review Executive Branch classification decisions…. Executive Branch classification decisions are entitled to “the utmost deference”… and that such deference is especially appropriate where the Executive Branch bases its classification decision, as here, on a review of all pertinent information, including whether disclosure of the data in the manner proposed by the companies would risk filling out the mosaic of information available to our adversaries in their efforts to assess and avoid our surveillance capabilities.

And so we’re back to the “mosaic theory,” in which the feds argue they can redact stuff out of a fear that a bunch of random info can be put together by bad people to figure out more than the feds want to reveal. But… that makes no sense here. The companies are asking at this point that their own lawyers be able to see the arguments, not necessarily that the details be made public. The court could easily seal the filings from the public while letting the companies’ lawyers see it.

Filed Under: doj, first amendment, fisa, fisc, redacted, transparency
Companies: apple, facebook, google, linkedin, microsoft, yahoo

Most Big Internet Companies Speak Out For Major Surveillance Reform

from the about-time dept

Since the Snowden leaks began we’ve highlighted that the US internet companies should be furious about the NSA’s actions, because it was almost certainly going to harm their ability to get any business outside of the US. Some of the companies seemed to be lying low, and we argued they should be speaking out and fighting back. While many of them did decide to sue for greater transparency, we argued that transparency was just one issue, and not even the most important one. About a month ago, with the revelations of the NSA infiltrating data centers, it appeared to finally dawn on the major internet companies that this was a serious issue.

Basically all of the largest internet companies — with the exception of Amazon (and Apple, if you consider them an internet company) have now launched a website demanding major reforms for government surveillance. Facebook, Yahoo, Twitter, Microsoft, Google, LinkedIn and AOL have all joined in this effort, with a bunch of specific requests:

1. Limiting Governments’ Authority to Collect Users’ Information
2. Increase Oversight and Accountability (such as by making FISA an adversarial process)
3. Transparency About Government Demands
4. Respecting the Free Flow of Information
5. Avoiding Conflicts Among Governments

With the website, they’ve also sent a specific open letter to the government highlighting why this is important, focusing on the rights of individuals and the ability to keep their information private.

We understand that governments have a duty to protect their citizens. But this summer’s revelations highlighted the urgent need to reform government surveillance practices worldwide. The balance in many countries has tipped too far in favor of the state and away from the rights of the individual — rights that are enshrined in our Constitution. This undermines the freedoms we all cherish. It’s time for a change.

For our part, we are focused on keeping users’ data secure — deploying the latest encryption technology to prevent unauthorized surveillance on our networks and by pushing back on government requests to ensure that they are legal and reasonable in scope.

We urge the US to take the lead and make reforms that ensure that government surveillance efforts are clearly restricted by law, proportionate to the risks, transparent and subject to independent oversight.

Some will, undoubtedly, argue that this is all just noise for the sake of public perception, but compare what these companies are doing to the major telco companies, which not only have refused to comment on all of this, but have actively fought efforts by their own shareholders to make them just slightly more transparent (up to the level many internet companies were even before the Snowden leaks).

The question, now, is how much effort these companies will really put into getting Congress to change the laws. There are a number of different bills in Congress. Having the tech companies assist the efforts for real reform would certainly be helpful.

Filed Under: internet, nsa, reform, surveillance, tech companies
Companies: aol, facebook, google, linkedin, microsoft, twitter

DOJ Refuses To Let Tech Companies See Legal Arguments It's Making Against Them

from the isn't-that-convenient dept

The ongoing legal fight, in which a bunch of US tech and internet companies — namely Google, Facebook, Microsoft, Yahoo and LinkedIn — are suing the US government, claiming a First Amendment right to publish some details on the number of requests they get from the NSA under Section 702 of the FISA Amendments Act, as well as the number of users impacted by those requests, is getting ever weirder. The government had filed its response back at the end of September. And, you might notice, large portions of it are totally redacted. For example, here is page 13 of the document (though, numbered page 8):

At least they didn’t redact the page number Of course, stuff gets filed under seal all the time, and it’s not particularly uncommon to see redacted passages in legal documents — especially (obviously) when it has to do with matters of national security. But, here’s what’s different. Normally the opposing parties in the case are allowed to see the details of what’s redacted. Here, the DOJ is simply refusing to let the tech companies see its own argument. In response, the companies have filed a pretty direct and somewhat angry motion, asking the FISA court to either let them see the arguments, or to strike the redacted portions from the DOJ’s motion. Basically, the DOJ is saying that it can make legal arguments that only the court can see, but which the tech companies suing it cannot see. That goes against every basic concept of due process.

The government has submitted a response and supporting declaration for ex parte, in camera review. It has given the providers only a heavily redacted version of its submissions, and it has rejected all requests for greater access.

Unless the government reconsiders its refusal to accommodate the providers’ legitimate need to understand the basis for the government’s response, the providers respectfully request that this Court strike the redacted portions of the government’s brief and supporting declaration. The redacted version of the government’s submissions does not comply with Foreign Intelligence Surveillance Court Rule 7(j) because it does not “clearly articulate the government’s legal arguments,” as the rule requires. If the government’s interpretation of the rule were correct, the rule would violate both the First Amendment and the Due Process Clause. To avoid that result, the Court should construe the rule to require fuller disclosure to the providers.

Allowing the government to file an ex parte brief in this case will cripple the providers’ ability to reply to the government’s arguments and is likely to result in a disposition of the providers’ First Amendment claims based on information that the providers will never see. The providers do not dispute that in some cases it may be appropriate for this Court to consider ex parte filings. In this case, however, such a course is neither justified nor constitutional. The providers already know the core information that the government seeks to protect in this litigation–the number of FISC orders or FAA directives to which they have been subject, if any. At issue here is only the secondary question whether the providers may be told the reason why the government seeks to keep that information a secret. The government has not argued that sharing those reasons with the providers or their counsel would endanger national security. Accordingly, unless the government allows the providers’ counsel to access its response, the Court should strike the redacted portions of the response.

The whole thing is really quite incredible. Our government is so focused on the secrecy of its secret laws and secret demands that it won’t even tell the companies fighting the secrecy the secret reasons it’s telling the court it has to keep stuff secret? How is that possibly consistent with basic due process under the law?

Filed Under: due process, faa, fisa, fisa amendments act, fisa court, fisc, free speech, gag order, nsa, redactions, section 702
Companies: facebook, google, linkedin, microsoft, yahoo

GCHQ's Response To Hacking Slashdot And LinkedIn: No Comment, But It Was Perfectly Legal

from the yeah,-nice-try dept

Over the weekend it came out that GCHQ used a packet injection attack on Slashdot and LinkedIn pages in order to do a “quantum insert” — basically a man-in-the-middle attack to install malware on the computers of key employees at Belgian telco Belgacom, which they then used to get much greater access to Belgacom’s infrastructure for spying. It would appear that neither LinkedIn, nor the owners of Slashdot, are particularly pleased about this. After requesting more information, GCHQ had a useful response: “no comment.”

In an emailed statement to Slashdot, the GCHQ’s Press and Media Affairs Office wrote: “We have no comment to make on this particular story.” It added:

“All GCHQ’s work is carried out in accordance with a strict legal and policy framework which ensure that our activities are authorised, necessary and proportionate, and that there is rigorous oversight, including from the Secretary of State, the Interception and Intelligence Services Commissioners and the Intelligence and Security Committee.”

Right. So we can’t comment on this, but we assure you that it’s very much legal that we effectively ran a man-in-the-middle attack on your site, guaranteeing that people are less willing to go to your sites any more. Meh. Collateral damage for the very important work of spying on everyone.

Filed Under: gchq, packet injection, quantum insert, slashdot, surveillance
Companies: linkedin

Tech Companies Lawsuit Over Transparency Concerning NSA Surveillance Put On Hold Due To Government Shutdown

from the please-hold... dept

This is hardly a surprise, but it appears that the tech companies’ lawsuit against the federal government, in which they’re arguing a First Amendment right to reveal details (at least in terms of numbers) related to NSA information requests, has been put on hold. The DOJ told the court that the government shutdown means that its lawyers really can’t work on the case and the Court has agreed to put the case on hold until the government is up and running again. It has also told the feds to declassify yet another court ruling concerning the interpretation of Section 215 of the Patriot Act, though it will let that wait until after the government opens up again too.

Filed Under: first amendment, government shutdown, nsa, nsa surveillance, transparency
Companies: dropbox, google, linkedin, microsoft, yahoo

LinkedIn Passwords Leaked… Congress Immediately Wants To 'Do Something!'

from the grandstanding... dept

As you hopefully have heard already, a ton of Linkedin passwords were leaked online. They were leaked in encrypted forms — and without associated usernames — leading some to suggest there was no real threat for users, unless someone also had the full list of usernames as well. However, that doesn’t seem quite accurate. Since the passwords were hashed but not salted, it’s made it relatively easy for the passwords to be decrypted. Yes, the usernames haven’t been released, but some are suggesting that whoever leaked the data probably only released this subset, because they had already decrypted a bunch of easier passwords (and probably had the usernames) and just needed “the crowd” to help decrypt the rest.

Linkedin took its time, but did admit that there was a breach, and reset those passwords. However, Congress is never one to miss an opportunity to grandstand. Rep. Mary Bono Mack was quick to jump up and announce that something must be done!

“How many times is this going to happen before Congress finally wakes up and takes action?” said Rep. Mary Bono Mack, R-Palm Springs, who heads a House Energy and Commerce subcommittee that has looked at online-privacy issues, in a statement. “This latest incident once again brings into sharp focus the need to pass data protection legislation.”

Similarly, Senator Pat Leahy jumped in with a similar statement:

“Reports of another major data breach should give pause to American consumers who, now more than ever, share sensitive personal information in their online transactions and networking,” Leahy said in a statement provided to The Hill. “Congress should make comprehensive data privacy and cybercrime legislation a top priority.”

First of all, it does appear that LinkedIn wasn’t using particularly smart security techniques (no salting? really?). But would a law really change things? And Leahy’s claim that we need “cybercrime” legislation, again doesn’t seem likely to help “fix” anything. If anything, the “cybersecurity” legislation that’s out there might make such data even more vulnerable, by making companies more encouraged to share information.

Yes, these kinds of data breaches are bad. And we should be concerned when we find out that a company as big as LinkedIn still uses such weak security practices. But does that really mean we need a law?

Filed Under: congress, data breach, mary bono mack, passwords, pat leahy, security
Companies: linkedin

How Disruption Works: Job Loss Isn't Really Job Loss

from the jobs-move-around dept

One of the key points in understanding how disruption works is to recognize that as old industries fail, new industries grow up to take their place. For a true free market to work, failure has to be not just accepted, but embraced. Tragically, in the crony capitalist system we have today, large incumbents go running to the government as soon as they’re disrupted, whining about how the disruption is not the normal workings of disruptive innovation, but rather “the end of the world” and a sign of clear evil. It’s why you hear talk of “too big to fail” and all sorts of efforts to paint new innovations as illegal, rather than just disruptive competition. Yet, as we’ve seen over time, disruptive innovation may move jobs around and cause certain sectors to diminish, but it tends to open just as many, if not more, opportunities elsewhere over time. I don’t think I’ve ever seen that displayed quite as clearly in graphic form as in a chart that LinkedIn recently released, looking at what parts of the industry have been growing and which parts have been shrinking over the past few years:

This chart caught the attention of Paul Smalera, who specifically noted that newspapers are at the very bottom, but online publishing is right near the top on the growth side — a near perfect showing of how jobs shift over time. He notes the classic Innovator’s Dilemma issue with news companies, where they thought they were in the business of selling newspapers, and that held back their ability to innovate:

They have been trapped in a terrible mindset that they are in the business of selling newspapers. The leap from paper to digital may be vast, but to newspaper publishers, it seemed like vaulting to a different business entirely, one they were loathe to get into. No matter what kind of lip service newspapers paid to the digital transformation, the most prominent paywall model out there, that of the New York Times, still protects print subscriptions with a tiered digital pricing strategy – one so annoying that it motivated its former digital design director to complain publicly about the entire signup process.

The lesson online media companies have taken from newspapers’ slow, public death is to move beyond the idea of selling the product. Online sites are selling their audience. It’s a simple twist of the equation, but one that changes everything about how a media company is run. A CEO who has realized that her audience – her customers – is the most important thing the company has will stop at nothing to give those customers what they want. Anything to make them feel as if they’re getting value from the company. And although she’ll monetize their aggregate value with advertisers and marketers, she’ll also protect them from underhanded sales pitches or confusing pricing strategies that infuriate the web-savvy.

This is a really good point on multiple levels. Beyond the innovator’s dilemma (and the key point of figuring out what the real product is), Smalera is also debunking one of the popular myths of the internet era: when you’re selling a user’s attention, companies will naturally abuse their users. What he notes is that companies that do this don’t end up lasting through the long haul, because users get annoyed and go elsewhere. Even though it’s become a common pejorative statement among neo-luddites to mock the idea that the “users is the product,” one thing that is true when that happens is that the companies need to treat their users right, or they have a crappy product that they can’t sell.

Similarly, Mathew Ingram uses this to discuss why it’s so difficult for legacy businesses to adapt, noting that it’s difficult to change business models on the fly. Not only do you have to make big bets on new things, but you also have to keep the legacy business running while at the same time trying to undercut it with the new thing. It’s why so many companies fail the innovator’s dilemma test. Unless you have incredibly visionary leadership who can push a company through with a strong and clear vision of why the company must move in that direction, the magnetic appeal of trying to prop up increasingly obsolete businesses is just too strong.

But, the failure comes not because of some new “threat” or because of some kind of disgraceful activity (no matter how much legacy players try to describe it that way), but because corporate leadership chose to let others innovate, rather than supporting a plan of out-innovating themselves. Very, very few companies are willing to cannibalize their own business models — but the failure to do that just means that someone else cannibalizes it for you.

And it goes way beyond news. The chart above shows some other key areas of disruption as well. That clump of retail, automotive, construction, banking, telecommunications, pharmaceuticals and real estate represents prime feeding ground for the next decade of disruption — much of which has already started. You don’t necessarily see the corresponding growth points on the opposite side of the chart, but as with newspapers and online publishing, give it a few years, and those new jobs and industries will make their way up the chart, as the legacy players continue to shrivel up (and whine all the way down).

Filed Under: disruption, growth, jobs
Companies: linkedin

Tons Of Companies Sued In Class Action Lawsuit Over Uploading Phone Addressbooks

from the class-actions-in-action dept

There was some controversy a month or so ago, when it came out that app maker Path was secretly uploading your entire address book to its servers. The company apologized and deleted all the data. Of course, pretty quickly, people realized that lots of apps do this, if you allow the app to search your address book to see who else you know is already using the service. The way they do this is to upload your address book. I would have thought this was, well, obvious, but not everyone seemed to think so (it’s also why I never use that feature). Either way, lots of apps quickly changed either how they work or how they explain what happens with that feature.

But, of course, in our litigious society, that’s not going to stop the class action lawsuits from being filed. In a 152 page document, a class action lawsuit has been filed against pretty much every big name company in the space:

Path, Inc., Twitter, Inc., Apple, Inc., Facebook, Inc., Beluga, Inc. ., Yelp! Inc., Burbn, Inc., Instagram, Inc., Foursquare Labs, Inc., Gowalla Incorporated, Foodspotting, Inc., Hipster, Inc., LinkedIn Corporation, Rovio Mobile Oy, ZeptoLab UK Limited aka ZeptoLab, Chillingo Ltd., Electronic Arts Inc., and Kik Interactive, Inc.,

The lawsuit kicks off by quoting Robert Fulghum’s “All I really Need to Know I Learned In Kindergarten,” saying, “Don’t take things that aren’t yours.” Of course, as with many such class actions, this one is all about getting the lawyers paid. This isn’t to say that I think the actions in uploading the address books were ok, but worth a lawsuit? Seems a bit extreme. It seems that the public pressure about all of this has caused pretty much all of these companies to change how they work, and it’s unlikely any real significant “harm” came from this.

Filed Under: address books, class action, privacy, uploading
Companies: ea, facebook, foursquare, instagram, linkedin, path, rovie, twitter, yelp

Can A Company Keep An Employee's LinkedIn Account After They're No Longer Employed?

from the how-does-that-make-sense dept

Venkat Balasubramani has the story of a bizarre fight between a company, Sawabeh Information Services, and the founders of Edcomm, a company that Sawabeh bought in 2010. A few months later, the founders of Edcomm were fired, and the lawsuits commenced. There are a variety of issues here, and Venkat’s post goes through most of them in detail, but I wanted to focus on just one: the fight over who gets to control Dr. Linda Eagle’s LinkedIn account. Eagle was one of the founders of Edcomm and the key figure in this fight. Sawabeh claims that Eagle “misappropriated” her own LinkedIn account and the contacts associated with it, by continuing to use it after being fired.

While I can kind of understand some of the legal fights over who gets to control Twitter accounts, the entire point of a LinkedIn account is to represent an individual and their job history. How would it possibly make sense for a company to control an ex-employee’s LinkedIn account?

The company seems to think that the LinkedIn account was more like a rolodex. Because (for reasons that are beyond me), Eagle had let others in the company access and manage her account, as soon as she was fired, people at the company accessed her account and then changed her “name” and profile picture to someone else at the company. That would be pretty shocking for her connections, who might not know who the guy was at all. They also tried to do this with the account of one of the other fired founders, but they didn’t have his password. Apparently the company asked LinkedIn to hand over the password, and LinkedIn, properly, told the company to get lost.

Either way, the court digs into the “misappropriation” question with the LinkedIn account and refuses to dismiss it out of hand (at this stage of the case), which seems too bad. However, there’s an unclear issue of who “developed” the contacts in the account:

The Counterclaim Complaint expressly alleges that, with respect to the LinkedIn account connections and content, “Edcomm personnel, not Dr. Eagle, developed and maintained all connections and much of the content on the LinkedIn Account, actions that were taken solely at Edcomm?s expense and exclusively for its own benefit.” … While Plaintiff argues that Edcomm fails to allege facts that would show that it made a substantial investment of time, effort, and money into creating the cell phone number or LinkedIn account, Edcomm counters that its employees developed the accounts and maintained the connections, which are the route through which Edcomm contacts instructors and specific personnel within its clients. As these conflicting allegations create an issue of fact requiring further discovery, the Court must deny the Motion for Judgment on the Pleadings as to the misappropriation counterclaim.

Of course, I wonder if they’re arguing about the wrong thing here. If the company developed the contacts, perhaps it has a right to ask for a copy of the contacts, but the account itself seems like it should belong to Eagle. Part of the problem here is the idea that contacts are some scarce resource. Both parties can have them, and the simplest thing would be, if there is a legitimate claim that the company developed those relationships, to require that their contact info be provided to the company — but leave the account in the hands of Eagle.

Either way, the case should be a warning for any company that wants to control the LinkedIn accounts of its employees.

Filed Under: contacts, linda eagle, ownership, social media
Companies: edcomm, linkedin, sawabeh information services, siscom