London's Facial Recognition Rollout Trips Over The Pandemic As Facemasks Render The System Even More Useless

(Mis)Uses of Technology

from the of-course,-some-people-still-refuse-to-wear-them-so... dept

The rollout of London’s facial recognition cameras — hundreds of them — is being held up by unexpected developments. No, it’s not the efforts of legislators, privacy activists, or some sudden concern about the unreliability of the tech. It’s the global pandemic, which has taken away many of the facial features the cameras are looking for. (h/t Jeffrey Nonken in the TD Chat window)

The Metropolitan Police is considering whether to pause its use of facial recognition cameras because so many Londoners are wearing face masks.

Use of the technology, which was deployed across London from January in a bid to spot serious criminals, is regarded as controversial by civil liberties campaigners.

One assembly member, Caroline Pidgeon, made the obvious point that a rollout during a pandemic necessitating face mask use isn’t the best timing for tech that already has demonstrated an inability to correctly recognize unmasked faces.

This point is driven home in a letter composed by Pidgeon and Sian Berry, another assembly member. The letter says the tech’s failures — and the lack of public input or oversight — means Londoners should only expect bad things from a large-scale rollout of live facial recognition.

In a letter published [PDF] on the London Assembly website, the two elected representatives said: “We both believe that the way in which LFR [live facial recognition] is being rolled out as an operational tool in London is ill-advised, and that this technology will have a chilling effect on civil liberties if it is not used with clarity, accountability and with full democratic consent.”

The letter says the tech used by the Metropolitan Police isn’t merely error-prone. It’s pretty much all errors, all the time.

In a recent answer to a written question, the Mayor made clear that in the first two deployments of LFR this year more than 13,000 faces were scanned. Out of these 13,200 people scanned only six individuals were stopped. However, of those six, five were misidentified and incorrectly stopped by the police, not being wanted for any crime. Furthermore, of the total of eight people who created a ‘system alert’, seven were incorrectly identified. This is a concerning pattern of inaccuracy and misidentification of innocent people, which was also identified during the trials of this technology.

The letter also points out that London’s law enforcement has refused to cooperate with the government’s oversight of this tech, telling legislators to refer to previously published documents rather than directing them to anything more recent that might provide insight on the current state of the technology. The assembly members say the available documents do not fully address tests mandated by the London Policing Ethics Panel. They also note that while the Ethics Panel has suggested this tech only be used to investigate “serious crimes,” the Metropolitan Police has made it clear it has no intention to comply with this guideline.

The letter asks more questions of the MPS which will likely also go unanswered. The assembly members want assurance these systems won’t be deployed during protests, demonstrations, or public events. They also want to know if the forces of law and order are cool with blowing off Parliamentary directives.

The House of Commons Science and Technology Committee has called for a halt to the police’s use of live facial recognition, until relevant regulations are in place. Do you feel comfortable ignoring Parliament?

The answer to the last one is probably “yes.” The Metropolitan Police has continued to deploy the tech despite a constant stream of false positives. The only thing standing between it and a full rollout is the pandemic itself. The MPS can’t honestly say its system will be a useful crime fighting tool when people’s faces are partially hidden from view. The MPS couldn’t honestly say this prior to en masse mask-wearing, but at least the system still had access to full faces. Continuing the rollout would show the police care more about playing with their toys then ensuring the safety and well-being of London residents.

Filed Under: cameras, covid-19, face masks, facial recognition, london, metropolitan police, privacy

Minnesota's Top Court Says Hotel Guest Records Are Protected By The State's Constitution

Privacy

from the take-your-bait-and-tackle-elsewhere,-coppers dept

Minnesota’s top court has redefined the contours of the Third Party Doctrine for the betterment of the state’s residents and visitors. [h/t FourthAmendment.com] The case deals with hotel/motel guest records, which have historically been given almost no legal protection.

The argument against protection is that guests give up this information voluntarily to private companies. But you can’t get a room without giving up this information, so it’s not nearly as voluntary as the government portrays it. This came to head in the US Supreme Court back in 2015. The nation’s Supreme Court decided — very narrowly — that a Los Angeles ordinance giving police officers warrantless access to guest records violated hotel owners’ rights by not giving them any way to challenge demands (other than going to jail).

The Minnesota Supreme Court does not rely on this decision despite reaching a conclusion that results in better protections for hotel guests. The difference between the two cases is the entity petitioning the court. In the US Supreme Court case, it was motel operators arguing warrantless access violated the Fourth Amendment, if not California’s own Constitution. In this case, it’s a guest arguing against the warrantless access to his records — something the Minnesota court points out in a footnote. From the decision [PDF]:

The court of appeals also concluded that Leonard erroneously relied on City of Los Angeles v. Patel, 576 U.S. 409, 135 S. Ct. 2443 (2015). State v. Leonard, 923 N.W.2d 52. Patel involved a challenge by hotel operators, not hotel guests, concerning the operators’ constitutional rights, therefore avoiding the issue of the third-party doctrine.

Nevertheless, the Third Party Doctrine is explored by the state court, leading it to a conclusion that narrow that doctrine’s reach. The resulting conviction for check forgery began with nothing but a fishing expedition.

Law enforcement officers arrived at a Bloomington hotel on August 14, 2015, for a hotel interdiction. The officers were not responding to a particular call. Without a warrant and without any individualized suspicion of criminal activity, the officers told the clerk on duty that they wanted to examine the guest registry and to be provided with the name of any guest who paid in cash.

State law says all hotel operators must collect this information and make it available to law enforcement. If they don’t (like in the city of Los Angeles), the hotel operators can be charged with a crime. But this isn’t about the hotel operator, who wasn’t involved in this challenge of a law enforcement search. It’s about the defendant, who argued a warrantless, suspicionless search of hotel records violated the state’s Constitution.

This was the end result of the officers’ perusal of hotel records.

The officers then ran a background check and found that Leonard had prior arrests for, among other things, drugs, firearms, and fraud. Based on this information, the officers developed an individualized suspicion that Leonard was involved in criminal activity and decided to conduct a “knock and talk” at the door of Leonard’s hotel room. When Leonard heard the officers knock, he opened the door and gave them limited consent to search the room, but withheld access to his laptop, cell phone, and a file folder where several checks were visible. The officers subdued Leonard through a physical struggle after he tried to flee. After securing a search warrant, the officers discovered over $2,000 worth of suspicious checks paid to the order of “Spencer Alan Hill,” over $5,000 in cash, and check-printing paper.

Paying in cash shouldn’t be treated as reasonable suspicion of criminal activity. Perfectly innocent people often engage in this activity, if only to lower their digital footprint. Here’s another excellent footnote from the court:

The dissent contends that Leonard did not exhibit a subjective expectation of privacy in his sensitive location information. We disagree. In a world of electronic money transfers using debit cards, credit cards, and other electronic means of payment, Leonard’s cash payment evidences an intent to conceal his presence at the hotel.

Both the trial court and the state appeals court found in favor of the government. They said warrantless, suspicionless searches of hotel guest records did not violate the state’s Constitution, which prohibits “unreasonable searches.” The top court disagrees.

First off, the officers had no compelling reason to show up at the hotel to demand records.

The Bloomington Police officers had never heard of Leonard when they arrived at the hotel. They had not procured a warrant to search anything. Nor were they called to the hotel by its employees because of concerns regarding any particular guest. Thus, it is undisputed that they acted without individualized suspicion when they conducted the hotel interdiction and examined the guest registry.

The court goes on to say that even though this fishing expedition resulted in the discovery of criminal activity, there are several reasons for people to conceal their identity from hotel operators and several reasons one’s privacy might be unreasonably invaded by a suspicionless search of hotel records.

Imagine instead that Leonard had stayed overnight at the hotel to attend a political or religious conference in the hotel ballroom, or that he had stayed overnight before a medical appointment in hopes of keeping a diagnosis private. In these examples, the guest’s highly sensitive location information is revealed, regardless of what actually occurred in the hotel room. That such information would be accessible to the government through a fishing expedition, where the hotel guest was a stranger to law enforcement before the officers’ random search, offends our core constitutional principles.

The court says guest records are sensitive information. As such, they cannot be swallowed up by the Third Party Doctrine. The court doesn’t create a warrant requirement, but does say officers need to have something more than an excessive amount of free time on their hands before demanding access to guest records.

We hold that the law enforcement officers conducted a search under Article I, Section 10 of the Minnesota Constitution when they examined the guest registry. We hold further that law enforcement officers must have at least a reasonable, articulable suspicion to search a guest registry.

Part of the underlying discussion pits society’s view of the term “reasonable” versus the government’s very liberal interpretation of this term. The government comes out on the losing end here.

Simply put, we think that most Minnesotans would be surprised and alarmed if the sensitive location information found in the guest registries at hotels, motels, or RV campsites was readily available to law enforcement without any particularized suspicion of criminal activity.

The court further points out that its declaration that access to guest records does not mean “access without any articulable suspicion” will not keep cops from busting criminals.

Nothing about our decision prevents law enforcement from partnering with hotels to help staff members recognize signs of trafficking or other crimes. And nothing about our decision prevents hotel operators from contacting law enforcement to relay suspicious observations. If such observations provide the officers with reasonable, articulable suspicion of criminal activity, they may examine the sensitive location information found in a guest registry.

The conclusion is this: the state’s Constitution prohibits suspicionless searches, even when read in conjunction with ordinances regulating the hotel/motel industry. While this industry may be subject to more law enforcement scrutiny than most, that fact does not eliminate Constitutional protections granted to residents and visitors. The evidence disappears, along with this source of law enforcement fishing expeditions. Staying somewhere other than your own home does not eliminate privacy protections.

Filed Under: 3rd party doctrine, hotel records, law enforcement, minnesota, records, third party doctrine

FBI Holds Press Conference To Claim Apple Prevented It From [Checks Notes] Verifying Attribution In The Pensacola Air Base Shooting

Overhype

from the what-a-compelling-argument-for-broken-encryption dept

The FBI held a very performative press conference to announce it had finally gained access to communications and data originating from the Pensacola Naval Air Station shooter. The coup, apparently, is that the FBI was able to — after months of fighting iPhone encryption — um… nail down attribution. Here’s CNN’s report on the FBI’s press conference:

The Saudi military trainee who killed three US sailors and wounded several others in a terror attack last year on a military base in Pensacola, Florida, was in touch with a suspected al Qaeda operative, according to multiple US officials briefed on the matter.

US investigators uncovered the al Qaeda connection after the FBI broke through the encryption protecting the Saudi attacker’s iPhones, the officials said.

So, the FBI discovered that a shooter who al Qaeda claimed to be one of theirs was actually one of theirs. I’m sure the FBI found a few more leads to investigate — potentially targeting US persons involved with the terrorist group — but it’s far from the wealth of evidence the agency continually asserted was definitely present on the phones agents weren’t able to access.

It’s big news in a smaller way.

If Alshamrani was directed or trained by al Qaeda, it would mark the first time since 9/11 that a foreign terrorist organization had done so in a deadly attack in the US, according to New America, a think tank.

That’s an 18-year gap between foreign terrorist group-directed attacks on US soil. Not much to write home about, but the FBI seems to feel we all should be writing about it. Hopefully, this isn’t the FBI’s linchpin argument, because something that happens once every other decade is hardly worth the broad undermining of encryption the agency seeks.

CNN’s report says something the FBI doesn’t actually say: the “FBI broke through the encryption” statement. Chris Wray’s remarks at the press conference don’t actually state that the FBI broke the phones’ encryption. (And nothing is said about the iPhone that was damaged by a bullet, which possibly rendered it completely useless.)

On the topic of innovation—I want to thank and congratulate the men and women at the FBI who devoted months of hard work to accessing these devices. They successfully tackled a problem that required tenacity, creativity, and technical expertise. Those qualities are valuable in any organization—so I know how fortunate we are, and how fortunate the American people are, that we have so many people with those qualities at the Bureau. That’s why we work to recruit the kind of people we do.

The magnitude of the challenge they faced is hard to overstate.

[…]

Unfortunately, the technique that we developed is not a fix for our broader Apple problem—it’s of pretty limited application. But it has made a huge difference in this investigation.

This doesn’t clarify anything. This just says the FBI was finally able to access some of the contents, which means it could have found a way to exfiltrate or recover some data without actually breaking encryption.

What I’ve excised in this quote shows that this press conference wasn’t about announcing these findings. It was an anti-encryption pep rally pretending to be a dry announcement about an ongoing investigation. The FBI’s ulterior motives made their way to the forefront, starting with this:

We received effectively no help from Apple.

Wrong. The FBI received all the help Apple could give it. Apple was compliant with turning over all data and communications it could access. What it didn’t do was offer to break the encryption on the seized devices. And while Wray may talk about delays and (no, seriously) agents “toiling through the pandemic,” it was the FBI that sat on this investigation, waiting a month before asking Apple for assistance.

Then there’s this statement, in which Wray says everyone’s been misinformed about encryption-breaking tools sold by a handful of vendors.

We canvassed every partner, and every company, that might have had a solution to access these phones. None did, despite what some claimed in the media.

“What some claimed in the media” is a fucking disingenuous statement. This is what was claimed by vendors offering tools that bypassed Apple’s built-in protections to provide access to iPhone contents. The media didn’t spin this. If vendors over-promised and under-delivered, that’s on them, not the journalists reporting on the latest in encryption-breaking tech.

This is twice as disingenuous when you remember the FBI refused to seek outside options in the San Bernardino shooter case because it really would rather have had legal precedent. While the FBI and DOJ went after Apple in court, vendors tried to offer their assistance. When the FBI finally decided to work with a still-undisclosed vendor to obtain the (useless) contents of the shooter’s iPhone, FBI officials were upset this had derailed their attempt to obtain judicial blessing for compelled decryption. This is pure spin and it was delivered by the head of the FBI solely to portray Apple as an enemy of the rule of law and the public’s safety.

Flow my collective tears, the federal policeman said.

Public servants, already swamped with important things to do to protect the American people—and toiling through a pandemic, with all the risk and hardship that entails—had to spend all that time just to access evidence we got court-authorized search warrants for months ago. Our engineers and computer scientists working to access these phones were also needed on other, pressing, national security and criminal investigations.

But the delay getting into these devices didn’t just divert our personnel from other important work. It’s also seriously hampered this investigation.

Finally getting our hands on the evidence al-Shamrani tried to keep from us is great. But we really needed it months ago, back in December, when the court issued its warrants.

Needed it for what? Confirming what al Qaeda said after the shooting? If that’s all there is, it really isn’t worth undermining the security of millions of encryption users, including those who work at the FBI. And it sure as hell didn’t stop the FBI from performing an investigation. Wray states the FBI interviewed 500 people and obtained all the evidence it could from sources other than the locked iPhones. The investigation continued and personnel still worked round-the-clock “through a pandemic” to put this case together. Apple’s contribution (or lack thereof) is only a footnote, but Wray insists it’s the headline.

Don’t be swayed by Wray’s cheap shots. This press conference was held to directly (in Apple’s case) and indirectly smear every US company that offers encryption to their users. If the FBI had held an intellectually honest press conference, it simply would have noted it found evidence linking the Pensacola shooter to al Qaeda and left it at that. (It also might have explained why it still hasn’t updated its count of encrypted devices in its possession.) Instead, Wray grabbed a bunch of nails and hung his agency on the cross, punctuating every hammer strike with oblique assertions that a refusal to create encryption backdoors may result in another foreign-directed terrorist strike on the homeland sometime in the next twenty years. When the facts alone aren’t compelling, the rhetoric has to make up the difference. And all we have here is a lot of anti-encryption filler.

Filed Under: al qaeda, chris wray, encryption, fbi, iphone, pensacolar, phones, terrorism
Companies: apple

Documents Show NSO Group Is Pitching Its Malware To US Local Law Enforcement Agencies

(Mis)Uses of Technology

from the get-in-bed-with-the-UAE,-locals dept

Infamous Israeli malware developer NSO Group is currently being sued by Facebook for using WhatsApp as its preferred attack vector. Malicious links and malware payloads are sent to targets, allowing government agencies — including those in countries with horrendous human rights records — to intercept communications and otherwise exploit compromised phones.

NSO has argued it can’t be sued for the things done by its customers, all of which appear to be government agencies. The company says those actions are protected by sovereign immunity. NSO insists it only sells the malware. It does not assist its customers with target acquisition or malware deployment. Documents filed by Facebook say otherwise. NSO appears to deploy malware through servers it owns or rents in the United States, suggesting it is actually more involved in its customers’ actions than it has sworn in court.

Like any business, NSO Group wants more customers. It’s not content to sell exploits to questionable governments that have used its offerings to target journalists, lawyers, activists, and dissidents. It wants to do business in the United States, where there are thousands of potential law enforcement customers.

Some details of NSO’s stateside push emerged a few years ago, when reports showed the DEA had met with NSO to discuss its offerings. Motherboard has obtained additional documents indicating NSO is courting local law enforcement as well.

NSO Group, the surveillance vendor best known for selling hacking technology to authoritarian governments, including Saudi Arabia, also tried to sell its products to local U.S. police, according to documents obtained by Motherboard.

[…]

“Turn your target’s smartphone into an intelligence gold mine,” a brochure for the hacking product, called Phantom, reads. The brochure was made by Westbridge Technologies, “the North American branch of NSO Group,” it says. Motherboard obtained the document and related emails through a public records act request.

“Phantom” is just US branding for NSO’s “Pegasus” — the hacking tool sold to foreign governments that’s at the center of Facebook’s lawsuit. According to the marketing documents sent to the San Diego Police Department, Phantom turns targeted phones into a steady stream of intercepted communications. The software allows police to grab emails, text messages, contact lists, track the device’s location, and surreptitiously activate the phone’s camera and microphone. Once a phone is compromised, encryption is no longer a problem, as NSO’s sales materials point out.

Pitching a tool this powerful to the San Diego PD had a predictable response:

After talking to the company in a phone call, SDPD Sergeant David Meyer told Westbridge in an email that the hacking system “sounds awesome.”

The PD’s statement says the department is always looking at products that could aid them in investigations. But as tempting as this one was, it was out of the PD’s price range.

In his email, Sergeant Meyer added, “we simply do not have the kind of funds to move forward on such a large scale project.”

That the NSO Group is seeking US law enforcement customers isn’t a surprise. But the nation’s police agencies should try to be selective about who they purchase from. NSO has sold malware to serial human rights abusers and one would hope US agencies would voluntarily choose not to buy from a company with such shady clientele. Unfortunately, this single sampling of law enforcement documents shows at least one cop shop showed interest in buying what NSO was selling, and was only held back by budgetary constraints.

Filed Under: hacking, law enforcement, police, spyware, us
Companies: nso group

Court Tosses Lawsuit From Man Claiming Twitter Discriminated Against Him For Being A Heterosexual Christian

Legal Issues

from the you-can't-fix-stupid-but-you-can-immunize-against-it dept

Suing private companies over their alleged trampling of First Amendment rights is rarely going to go anywhere. That’s not stopping people from trying. Again and again and again. Some of these plaintiffs aren’t even represented by Larry Klayman.

Like this guy, Robert Eugene Wilson, who sued Twitter for deleting his accounts. Wilson represented himself, arguing… well, it’s perhaps best to quote directly from the dismissal [PDF]. (via Eric Goldman)

Plaintiff, Robert Eugene Wilson (“Wilson”), filed a complaint in this Court on January 23, 2020. (ECF No. 2). In the complaint, Wilson assets that Defendant, Twitter, Inc., (“Twitter”), “has on more than 2 times = 3 times [sic] closed my account based on my freedom of speech and or heterosexual expressions, and or whatever excuses.”

Ah, the 28th Amendment: Congress shall make no law abridging expressive heterosexuality. Of course, Twitter isn’t Congress and “heterosexual expression” — while protected by the First Amendment — isn’t going to turn Twitter into a government body, no matter how incensed the plaintiff is about their revoked Twitter privileges.

Having been deleted once, Wilson tried to create more accounts, three of which were deleted by Twitter before he could create any tweets. The status of the fourth account Wilson created is not listed in the record, but it was apparently deployed to send an “all Caps” tweet to Twitter telling the company “You will not get this account back!”

The deletion of three accounts and the subsequent damage to Wilson’s expressions of “heterosexuality and Christian affiliation” allegedly violated the First Amendment, the 1866 Civil Rights Act, and the 1964 Civil Rights Act to the tune of $50 million. Twitter’s actions also apparently harmed Wilson’s relationship with his neighbors, who were apparently “disturbed” by his “angry outbursts.”

In addition to $50 million for rights violations, Wilson asked for $250 million in damages related to Twitter’s deletion of his multiple accounts, the first of which graced the platform with this stellar content:

Wilson describes the nature of this content which included “insults” against public figures such as “Oprah Winfrey/Gayle King/President Obama/Sunny Hostin/Michelle Obama and many more insulted.” Wilson also objects to the suspension of his account based on “insults” he levied against “homosexuality” in general. These insults included the terms “‘gayness/Homos/Fagots [sic]/Dykes/Low Down Bi-Bisexuals [sic]/Queer Dogs/Trans Mutants.’”

Wilson also demanded at least half of his requested damages be immediately paid because Twitter’s legal reps had the temerity to call him and ask if he was represented by counsel to determine where case materials should be sent.

Wilson asserts that this amounts to “total deception and ‘legal abuse.’” Wilson believes that counsel for Twitter only asked if Wilson was represented by counsel so that they could present a motion to dismiss with “frivolous case references.” Wilson objects to counsel for Twitter’s “‘snake in tall weeds’ tactic” and asks that this Court deny Twitter’s “elementary ‘Motion to Dismiss.’”

All of Wilson’s arguments fail. The First Amendment does not govern the moderation efforts of private companies.

Beyond generalized assertions that Twitter’s motion to dismiss contains “frivolous case references” and amounts to “legal abuse,” Wilson does not address Twitter’s assertion that, as a private entity, it is not constrained by the First Amendment. Even if Wilson were to argue that Twitter is subject to the First Amendment under the state-action doctrine, such an argument would fail. While Twitter no doubt provides a valuable public forum, one in which millions of users, including the President of the United States, participate in wide-ranging public discourse, this alone is insufficient to establish that Twitter is a state actor.

So does Wilson’s allegation that Twitter discriminated against him because of his race… which he might possibly believe is “heterosexual.”

Wilson is clearly unable to state a plausible claim for relief under this section as he does not allege that Twitter discriminated against him due to his race. Wilson states his belief that Twitter was biased against him because of his statements in favor of “heterosexuality,” as well as his adherence to Christian beliefs, however, nowhere in his complaint does Wilson provide any facts that could conceivably suggest Twitter discriminated against him due to his race. In fact, it is not apparent from Wilson’s complaint whether Twitter was even aware of Wilson’s race, much less that the decision to suspend his account was based on such knowledge.

Wilson’s theory about being discriminated against for his chosen religion fares no better:

The facts contained in Wilson’s complaint simply do not lay out a plausible factual claim that Twitter’s actions in suspending his accounts were motivated by religious animus, rather than representing Twitter’s neutral enforcement of its rules prohibiting harassment on its platform. In other words, assuming that Wilson’s assertion he was compelled to create tweets denigrating homosexuality and its practitioners because of a sincerely held religious belief is true, and assuming that his account was suspended due to the content of those tweets is also true, he has not successfully established that Twitter targeted him because of his religious beliefs, rather than because of the content of the tweets themselves.

And Section 230 finishes Wilson’s lawsuit off:

Wilson is clearly attempting to hold Twitter liable as a publisher or speaker. The Fourth Circuit has recognized that §230 intended to immunize interactive computer service providers where they exercised “a publisher’s traditional editorial functions” while hosting the content of others. Zeran, 129 F.3d at 330. This includes “deciding whether to publish, withdraw, postpone or alter content.” Wilson seeks to hold Twitter liable for its decision to delete his posts and terminate (or withdraw) his account. As Twitter’s decision to suspend Wilson’s accounts, based on tweets that reportedly used derogatory slurs for homosexuality, was reached in the course of a traditional editorial function—namely deciding what type of content to publish—Wilson’s claim is precluded by application of §230(c)(1) of the CDA.

Wilson’s complaint is dismissed with prejudice. Wilson advanced some seriously dubious legal theories — something that’s perhaps expected from non-lawyer plaintiffs that represent themselves. But it might be one others find useful, especially if they’re more concerned with scoring political points than actually winning lawsuits. Here’s Eric Goldman’s take on Wilson’s attempt to claim Twitter engaged in religious discrimination.

Yes, Wilson appears to be arguing that Twitter discriminated against him because he’s a Christian heterosexual–a potentially mockable position in light of the many ways online systems implicitly privilege people with such characteristics. This case might be part of a longer-term trend where “conservatives” counter-intuitively attempt to weaponize civil rights laws to perpetuate majority privilege.

This isn’t too far removed from the constant claims from the political party in power that social media companies discriminate against “conservatives” and Republicans — a demographic largely composed of white Christians. It’s a historically-protected group that insists on playing the victim. Fortunately, Section 230 is still alive and (mostly) well, making most legal action along these lines untenable.

Filed Under: 1st amendment, content moderation, discrimination, robert eugene wilson, section 230
Companies: twitter

Senate Passes Surveillance Reauthorization Bill 80-16 — One Stripped Of Almost All Of Its Reforms

Privacy

from the but-at-least-we-get-an-official-burial-of-the-bulk-phone-records-program dept

The Senate voted today to give us five more years of pretty much unaltered surveillance. The reauthorization of key spy powers is back on again, after Congressional inaction ran head-on into a global pandemic, allowing these to (briefly) expire. Not that this temporary expiration resulted in any less surveillance. And with this overwhelming vote in favor of resumed spying, it will probably only be a matter of days before a consolidated bill ends up on Trump’s desk. Despite his continual agitation against the “Deep State,” Trump is expected to give these powers his official blessing.

The Senate on Thursday overwhelmingly voted to reauthorize three national security surveillance authorities that have been expired since March.

The chamber voted 80-16 to extend the surveillance authorities under the Foreign Intelligence Surveillance Act.

The vote occurred after the Senate adopted a bipartisan amendment on Wednesday from Republican Sen. Mike Lee of Utah and Democratic Sen. Patrick Leahy of Vermont to provide additional legal protections in the FISA court for targets of surveillance warrants. The Senate’s amendment means the House will have to pass the new version of the legislation before it goes to the President’s desk.

The additional protections in the amendment would expand outside review of FISA surveillance cases. The USA Freedom Act allowed for the appointment of amicus curiae (outside, neutral advocates) at the court’s discretion. This amendment makes it a bit more mandatory, requiring the court to appoint one in any case involving “sensitive investigative matters.” That covers a lot of ground, but the amendment was written with the targeting of US persons in mind.

More importantly, it grants the amicus the power to raise any issue at any time and gives them access to all pertinent court documents, including underlying warrant applications.

Unfortunately, this bill moved forward without stronger surveillance reforms, including an amendment written by Senators Ron Wyden and Steve Daines that would have added a warrant requirement for the collection of internet browsing history and search data. This fell one vote shy of passing — something that any of the four missing senators that supported the amendment could have fixed by showing up and voting.

The Senate’s approved version reauthorizes authorities affected by 2015’s USA Freedom Act and parts of Section 215, like the infamous “roving wiretap” authority and the apparently never-used “lone wolf” provision that allows for the surveillance of people with no known ties to any terrorist group.

If it remains intact before passage, the bill would also formally end the NSA’s bulk phone data collection. The NSA voluntarily retired this after it was unable to avoid over-collection even while having to approach telcos directly with reasonable suspicion-supported requests for call records. Having gone from mostly useless to completely useless, the NSA decided this collection was no longer worth the compliance headache. For whatever reason, the FBI fought to keep this zombie program alive, claiming that the slim possibility of it being useful as some undetermined point in the future justified its continued existence.

We’ll have to see what survives the House’s second pass before it heads to Trump for a signature. That’s the version that’s had plenty of input from Bill Barr, who apparently wants as much surveillance power as possible even as the Commander-in-Chief complains about the abuse of these powers to target him and his.

Filed Under: fisa, patriot act, reauthorization, senate, surveillance