Appeals Court Says Prosecutors Who Issued Fake Subpoenas To Crime Victims Aren't Shielded By Absolute Immunity

Legal Issues

from the dodging-one-court-to-get-reprimanded-by-two-others dept

For years, the Orleans Parish District Attorney’s Office in Louisiana issued fake subpoenas to witnesses and crime victims. Unlike subpoenas used in ongoing prosecutions, these were used during the investigation process to compel targets to talk to law enforcement. They weren’t signed by judges or issued by court clerks but they did state in bold letters across the top that “A FINE AND IMPRISONMENT MAY BE OPPOSED FOR FAILURE TO OBEY THIS NOTICE.”

Recipients of these bogus subpoenas sued the DA’s office. In early 2019, a federal court refused to grant absolute immunity to the DA’s office for its use of fake subpoenas to compel cooperation from witnesses. The court pointed out that issuing its own subpoenas containing threats of imprisonment bypassed an entire branch of the government to give the DA’s office power it was never supposed to have.

Allegations that the Individual Defendants purported to subpoena witnesses without court approval, therefore, describe more than a mere procedural error or expansion of authority. Rather, they describe the usurpation of the power of another branch of government.

The court stated that extending immunity would be a judicial blessing of this practice, rather than a deterrent against continued abuse by the DA’s office.

The DA’s office appealed. The Fifth Circuit Appeals Court took the case, but it seemed very unimpressed by the office’s assertions. Here’s how it responded during oral arguments earlier this year:

“Threat of incarceration with no valid premise?” Judge Jennifer Elrod said at one point during arguments. She later drew laughter from some in the audience when she said, “This argument is fascinating.”

“These are pretty serious assertions of authority they did not have,” said Judge Leslie Southwick, who heard arguments with Elrod and Judge Catharina Haynes.

The Appeals Court has released its ruling [PDF] and it will allow the lawsuit to proceed. The DA’s office has now been denied immunity twice. Absolute immunity shields almost every action taken by prosecutors during court proceedings. But these fake subpoenas were sent to witnesses whom prosecutors seemingly had no interest in ever having testify in court. This key difference means prosecutors will have to face the state law claims brought by the plaintiffs.

Based upon the pleadings before us at this time, it could be concluded that Defendants’ creation and use of the fake subpoenas was not “intimately associated with the judicial phase of the criminal process,” but rather fell into the category of “those investigatory functions that do not relate to an advocate’s preparation for the initiation of a prosecution or for judicial proceedings.” See Hoog-Watson v. Guadalupe Cty., 591 F.3d 431, 438 (5th Cir. 2009)

[…]

Defendants were not attempting to control witness testimony during a break in judicial proceedings. Instead, they allegedly used fake subpoenas in an attempt to pressure crime victims and witnesses to meet with them privately at the Office and share information outside of court. Defendants never used the fake subpoenas to compel victims or witnesses to testify at trial. Such allegations are of investigative behavior that was not “intimately associated with the judicial phase of the criminal process.”

Falling further outside the judicial process was the DA’s office itself, which apparently felt the judicial system didn’t need to be included in its subpoena efforts.

In using the fake subpoenas, Individual Defendants also allegedly intentionally avoided the judicial process that Louisiana law requires for obtaining subpoenas.

The case returns to the lower court where the DA’s office will continue to face the state law claims it hoped it would be immune from. The Appeals Court doesn’t say the office won’t ultimately find some way to re-erect its absolute immunity shield, but at this point, it sees nothing on the record that says prosecutors should be excused from being held responsible for bypassing the judicial system to threaten crime victims and witnesses with jail time.

Filed Under: fake subpoenas, immunity, louisiana, orleans parish, prosecutors

UK City Leaves Nearly Nine Million License Plate/Location Data Records Exposed On The Open Web

(Mis)Uses of Technology

from the city-hopes-to-one-day-achieve-minimum-competence dept

Government officials always remind us that the price of order and lawfulness requires us, as a society, to give up some of our privacy and liberty. It shouldn’t be that way, but it almost always is.

For UK motorists, the exchange rate for orderly motorway traffic is millions of their travel records left exposed on the open internet.

In a blunder described as “astonishing and worrying,” Sheffield City Council’s automatic number-plate recognition (ANPR) system exposed to the internet 8.6 million records of road journeys made by thousands of people, The Register can reveal.

The ANPR camera system’s internal management dashboard could be accessed by simply entering its IP address into a web browser. No login details or authentication of any sort was needed to view and search the live system – which logs where and when vehicles, identified by their number plates, travel through Sheffield’s road network.

Oh my no. This isn’t acceptable. Sure, the Surveillance Camera Commissioner (yes, that’s a thing in the UK) called it “astonishing and worrying,” but even those terms fail to capture the horrendousness of this blunder. If it seems like a lot of records to leave unsecured on the open web, it is. It could allow anyone to retrace the travels of thousands of drivers with minimal effort.

It takes a while to amass nearly nine million license plate photos, but not nearly as long as one might expect. As The Register points out, the system’s 100 cameras collect thousands of photos every day. On February 24, the cameras collected 21,000 photos. The only thing slowing the system down is the coronavirus. Stay at home orders dropped the record collection down to a more manageable 13,000 records on April 13.

The massive system went live in 2018, accompanied by documents that do not contain the word “privacy” anywhere in their 164-pages of bureaucratese. Apparently, no one bothered to perform any sort of penetration test that might have discovered this wide-open door before security researchers did. The best summation of this clusterfuck comes from the person who discovered the unsecured license plate portal.

The Register learned of the unprotected dashboard from infosec expert and author Chris Kubecka, working with freelance writer Gerard Janssen, who stumbled across it using search engine Censys.io. She said: “Was the public ever told the system would be in place and that the risks were reasonable? Was there an opportunity for public discourse – or, like in Hitchhiker’s Guide to the Galaxy, were the plans in a planning office at an impossible or undisclosed location?”

The Sheffield City Council’s response to the news is less than comforting. While properly calling the breach unacceptable, the city (and the local assistant chief constable) claims (without offering any evidence) that no one was “harmed” or “suffered any detrimental effects” from the exposed database. I beg to differ. It quite clearly harmed the trust drivers may have had in their local government and didn’t do any favors for the traffic camera system provider either. Overseeing a system whose pervasiveness is only surpassed by its insecurity seems pretty detrimental to the “there’s always a tradeoff” posturing governments use when subjecting constituents to even more omnipresent surveillance.

Filed Under: leak, license plate, location data, privacy, sheffield, uk

Israeli Malware Merchant's Employee Used Powerful Spyware To Snoop On A Potential Love Interest

(Mis)Uses of Technology

from the surprising-no-one dept

NSO Group is not having a great year. At least not on the PR front. The books may be balancing, but its indiscriminate distribution of malware/spyware to questionable governments has been raising eyebrows and blood pressure for years. Now, it’s being sued by Facebook for using WhatsApp as its preferred delivery system for malware payloads.

These payloads target criminals and national security threats. But — since NSO doesn’t care who it sells to or what they do with its powerful software — the payloads also target journalists, dissidents, activists, and attorneys. This malware can take over devices, feeding communications and phone contents to government agencies that want to keep an eye on their enemies — even when their “enemies” are just critics and people who disagree with their policies.

But the malware can be used for other reasons, too. Any powerful surveillance tool ultimately ends up being misused. Just ask the NSA. And the FBI. And now, ask NSO, as Joseph Cox has for Motherboard.

An employee of controversial surveillance vendor NSO Group abused access to the company’s powerful hacking technology to target a love interest, Motherboard has learned.

The previously unreported news is a serious abuse of NSO’s products, which are typically used by law enforcement and intelligence agencies. The episode also highlights that potent surveillance technology such as NSO’s can ultimately be abused by the humans who have access to it.

How adorable. Israel’s biggest malware merchant thinks it’s a cop shop. Even more adorably, the company more or less admits (1) this sort of thing is going to happen occasionally, and (2) there’s nothing NSO Group can do about it.

“There’s not [a] real way to protect against it. The technical people will always have access,” a former NSO employee aware of the incident told Motherboard. A second former NSO employee confirmed the first source’s account, another source familiar confirmed aspects of it, and a fourth source familiar with the company said an NSO employee abused the company’s system.

This isn’t just something NSO employees can do. It’s also anything any of NSO’s customers can do. Not every target of surveillance is a government-ordained target. Give enough people access and power, and abuse will happen. It’s more surprising it’s happening at NSO, which has always portrayed itself as a blood-on-the-hands-free purveyor of powerful tools. Once it sells them, it takes no responsibility for what’s done with them.

And I agree with that point. NSO is not responsible for the acts of its customers. But it should choose better customers, considering how powerful its spyware is. As Cox explains, it’s capable of taking over even fully up-to-date devices by manipulating a number of zero-day exploits. Targets never know their devices have been compromised. In some cases, no action needs to be taken on their end, so dodging suspicious links sent via text, chat, or email isn’t even needed.

This obviously makes the software a temptation for its employees, who can use it to target whoever they want. The inevitability has occurred. And it has probably occurred more than the single instance detailed here.

As if this development wasn’t unpleasant enough, the illicit targeting happened while the NSO employee was working with one of NSO’s more unsavory customers, the United Arab Emirates. Not that the customer matters. It could have happened anywhere. But this one happened when the NSO was providing customer service for a country that engages in torture, operates secret prisons, criminalizes criticism of the government, and officially blesses mistreatment of anyone who isn’t a Muslim male.

It’s pretty tough for a company with minimal moral boundaries to expect its employees to respect the rules it has (well, let’s assume NSO has forbidden illicit use of its tools) established to minimize abuse. When you’re willing to sell spyware to monsters, you can’t really expect employees to maintain their halos.

Filed Under: employee abuse, love interest, lovint, surveillance
Companies: nso group

Ring Docs Show Company Is Testing Consumer Enthusiasm For Facial Recognition, License Plate Reader Capabilities

Privacy

from the be-the-implemented-changes-you-want-to-see-in-the-world dept

It seems like Ring really wants to add facial recognition tech to its cameras. It employs a “Head of Facial Recognition Tech.” It pitches this still-nonexistent feature to law enforcement. And it says it will “continue to innovate” to meet customer feature demands in response to Congressional queries about its facial recognition plans.

But now is not the best time to be trotting out new facial recognition products. Cities and one entire state have enacted bans or moratoriums on facial recognition tech use by government agencies. Even the leader in law enforcement body cams (Axon, formerly Taser) has pulled back from adding this tech to its products. So, Ring is playing it safe even if it’s inevitably going to add this feature in as soon as it can justify it.

And it’s looking for ways to justify it. Just like it promised Congress, it will continue to “innovate” by adding features customers say they want — even if it’s tech many feel is untrustworthy, if not possibly dangerous. A document obtained by Ars Technica shows the company is feeling out its newest customers on several potential features, including facial recognition.

Ring last week distributed a confidential survey to beta testers weighing sentiment and demand for several potential new features in future versions of its software. According to screenshots shared with Ars, potential new features for Ring include options for enabling or disabling the camera both physically and remotely, both visual and audible alarms to ward off “would-be criminals,” and potential object, facial, and license plate detection.

The survey actually suggests two possible facial recognition tech uses: one alert for “familiar faces” and another for “unfamiliar.” This feature would presumably be tied to a user-generated whitelist of “familiar” faces, rather than something maintained by Ring. But just as presumably, Ring would have access to user selections and recorded footage. Law enforcement agencies are already running obtained Ring footage through their own facial recognition programs, so this addition would just save them a little bit of time.

And, as noted above, Ring is pitching something new — at least for its line of products: license plate recognition. This is a new development.

The company has also not publicly discussed any plans for potentially deploying object detection or license plate scanning technology. In the same letter, lawmakers asked Amazon if employees had access to “any previously tagged information in video feeds that specifically identify a person or vehicle,” including specific license plate data; to that question, Amazon answered simply “no.”

The survey doesn’t actually call this “recognition.” It calls it “license plate detection.” This feature would send an alert to users if a vehicle’s license plate is detected and readable by the camera. Again, this wouldn’t be linked to any license plate database and would rely on whitelisting for “recognition,” but it’s still somewhat surprising to see a home security system offer this functionality.

It’s not that license plate readers are unheard of in the residential sector. It’s just that they’re usually included in more expensive systems tied to lucrative 24/7 monitoring contracts. This would put some of that power in a doorbell camera, allowing Ring users to operate not-so-automatic license plate readers during their downtime.

Ring continues to claim it’s just engaging in blue-skying with beta testers and has no immediate plans to implement either of these features. But it’s not denying it has an interest in being a market leader in domestic surveillance tech and will follow the market wherever it’s led… or wherever it nudges the market towards.

Filed Under: doorbells, facial recogntion, license plate readers, privacy, surveillance
Companies: amazon, ring

Court Filings Show NSO Group Ran Malware Attacks Through Servers Located In California

Legal Issues

from the not-immune-from-its-own-carelessness dept

Things are getting even more interesting in Facebook’s lawsuit against Israeli malware merchant, NSO Group. Facebook was getting pretty tired of NSO using WhatsApp as an attack vector for malware delivery, which resulted in the company having to do a lot more upkeep to ensure users were protected when utilizing the app.

Unfortunately, Facebook wants a court to find that violating an app’s terms of service also violates the CFAA — something most of us really don’t want, even if it would keep NSO and its customers from exploiting messaging services to target criminals, terrorists… and, for some reason, lots of journalists, dissidents, and activists.

NSO finally responded to Facebook’s lawsuit by saying it could not be sued over the actions of its customers. Its customer base is mainly government agencies — including some especially sketchy governments. NSO claims all it does is sell the stuff. What the end users do with it is between the end users and their surveillance targets. Since its customers are governments, sovereign immunity applies… which would dead-end this lawsuit (wrong defendant) and any future lawsuits against governments by Facebook (the sovereign immunity).

NSO’s claims it can’t be touched by this lawsuit are falling apart. Citizen Lab researcher John Scott-Railton pointed out on Twitter that Facebook’s latest filings point to NSO operating its malware servers from inside the United States — apparently doing far more than simply selling malware to government customers and letting them handle the deployment details.

Facebook’s answer to NSO’s attempt to dismiss the lawsuit concedes NSO’s point: it is not its customers. But that’s precisely why it can be sued. From Facebook’s response [PDF]:

A flawed premise runs through the motion to dismiss (“MTD”). Defendants contend that they cannot be held responsible for designing and marketing spyware and then deploying it using WhatsApp’s U.S.-based servers, including in California, to hack into WhatsApp users’ devices. Instead, Defendants pin blame on unidentified foreign sovereigns. That argument fails at every turn: Defendants cannot cloak themselves in their putative clients’ immunity; they are accountable for suit in a California court; and the Complaint states valid claims for relief based on Defendants’ unauthorized access to and hijacking of WhatsApp’s servers.

[…]

The statute confers immunity only on foreign states—not private companies who develop and operate their own technology and then claim to act on a foreign state’s behalf.

The claim that NSO Group operates from California (making this venue appropriate for the lawsuit) isn’t some distended stretch where malware briefly passed through WhatsApp servers in the US on its way to its targets. Declarations [PDF] by Facebook’s expert witnesses show NSO is routing malware deliveries through California data centers. This is only a small part of the list of IP addresses linked to NSO deployments Facebook has uncovered.

Attached as Exhibit 1 is a true and accurate screenshot from IP2Location.com obtained on April 22, 2020, for IP address 104.223.76.220. Exhibit 1 shows that IP address 104.223.76.220 is currently located in Los Angeles, California, and is owned by QuadraNet Enterprises LLC.

According to historical IP address location information from Maxmind.com for IP address 104.223.76.220 obtained through the website archive.org, IP address 104.223.76.220 was located in Los Angeles, California, and owned by QuadraNet Enterprises LLC as of May 28, 2019. Attached as Exhibit 2 is a true and accurate screenshot of the Maxmind.com csv.zip file available for download at archive.org that contains historical IP location information. Attached as Exhibit 3 is a true and accurate screenshot of the unzipped Maxmind.com csv.zip file showing the date of the files as May 28, 2019. Attached as Exhibits 4a, 4b, and 4c are true and accurate screenshots of the netblock for IP address 104.223.76.220 showing the location and ownership of IP address 104.223.76.220 as of May 28, 2019.

This is the upshot of Facebook’s investigation of NSO’s WhatApp-based efforts:

NSO used QuadraNet’s California-based server more than 700 times during the attack to direct NSO’s malware to WhatsApp user devices in April and May 2019.

These filings appear to show something very different than what NSO Group has claimed. It is not a blind provider of malware to government agencies. This indicates NSO is purchasing and operating servers stateside that its customers use to deploy malware. And if it runs these servers, then it quite possibly knows who its customers are targeting. This is far more involved than its sworn statements have said. The plausible deniability it’s trying to project just isn’t that plausible.

Facebook’s response points out the logical leap NSO is demanding from the court.

The Complaint alleges targeting of 1,400 separate devices, Compl. ¶ 42, and NSO does not specify who it was working for in each attack. Instead, NSO relies on a conclusory declaration from its CEO Shalev Hulio stating that “NSO markets and licenses its Pegasus technology exclusively to sovereign governments and authorized agencies,” and those sovereigns—not NSO—“operate [the] Pegasus technology.” Hulio Decl. ¶¶ 9, 14-15. But Hulio fails to identify any specific foreign sovereign for whom NSO worked—let alone cite a single contract or any evidence establishing NSO’s purportedly limited operational role.

NSO’s options are all unappealing at the moment. It can’t hope to settle since its customers aren’t going to be willing to give up exploitation of an encrypted messaging app used by millions of people around the world. It also can’t be looking forward to continued litigation since that’s only going to mean more exposure of its actions and inner workings as the lawsuit drags on. But these are the risks you take when your favored attack vector is another company’s service and your payload deliveries route themselves through rented/purchased servers located in the United States.

NSO turned itself into a villain by selling its products to governments wanting to target dissidents, journalists, activists, and attorneys. A little more judiciousness would have gone a long way. Running attacks through services owned by one of the most powerful tech companies in the world may have provided NSO’s customers with a broad user base to attack, but it also ensured it would find itself in court facing a well-funded and well-equipped adversary.

Filed Under: cfaa, hacking, jurisdiction, spying, surveillance
Companies: facebook, nso group, whatsapp

Prisons Replace Ankle Bracelets With An Expensive Smartphone App That Doesn't Work

(Mis)Uses of Technology

from the check-out-anytime-you-want-but-you-can-never-leave dept

Tired: monitoring parolees with ankle bracelets. Wired: monitoring parolees with smartphone apps.

Maybe it will be a better idea someday, but that day isn’t here yet. Ankle bracelets are prone to unexpected failure, just like any other electronic device. False negatives — alerts saying a parolee isn’t at home — are no better than false positives in the long run, although the former is the only one that can take away someone’s freedom.

The costs of ankle bracelets are borne by the parolee. Smartphone apps may be slightly cheaper… but only if you don’t factor in the cost of a smartphone or the app itself. Smartphones aren’t easy for parolees to obtain. Neither are the jobs needed to subsidize both the phone and the app’s monthly charge.

Those lucky enough to secure a smartphone are discovering the new solution is just as prone to error as its predecessor.

On the day Layla got out of prison and back to her home in Georgia, she was told she would need to purchase a smartphone—not an insignificant task for someone who’d just completed a sentence, but Layla was lucky to have a friend who could buy one for her. She says she was at home in bed a few days later when the app she had been mandated to install under the terms of her release went off unexpectedly, the high-pitched warning alarm blaring as it sent a notification to her parole officers telling him that she was not, in fact, at home.

Panicked, Layla took a picture of herself and sent him her location, trying to correct the app’s mistake. The process would repeat relentlessly, she says, waking her up every half hour during the night. “I’d wake up crying,” she says. Sometimes, when she tried to authenticate her location or check in the app would tell her it didn’t recognize her voice. “I’d feel so tired, and I thought if I didn’t answer, I was going to go back to prison.” Soon, she says, she was “begging my parole officer to put an ankle monitor on me.”

Guardian is the app that’s so unable to do its job properly some parolees are asking to be rolled back to the previous version of parolee monitoring: ankle bracelets. Guardian has almost 50,000 “users,” according to its data, and Layla isn’t the only parolee in danger of being violated back into prison by the malfunctioning app. Other parolees spoken to by Gizmodo are reporting the same issues. They say the app is almost “unusable” due to its inability to accurately report location info or recognize the biometric data they’re required to upload.

Unsurprisingly, the app is owned by Telmate, the same company that operates Global Tel*Link. Global Tel*Link is in the business of selling prisoners access to the outside world. It runs a number of prison communication networks — ones known for charging exorbitant per-minute fees for phone calls originating from prisons, as well as controlling the entertainment devices (like tablets and mp3 players) of nearly every other digital interaction engaged in by inmates. That it would release a sloppily-coded app into the wild with the oversold promise to simplify monitoring of released inmates is also no surprise, since any costs ($$$, freedom) will be paid for by the same inmates the company has shown repeatedly it cares nothing about.

The app is intrusive — even more intrusive than unannounced in-home visits by parole officers. The app does what corrections officers physically can’t do: demand dozens of check-ins a day.

“Guardian cost me my job,” says another person who had been incarcerated for more than a decade who used the app and remembers it asking him to check in more than 10 times an hour. “At night I couldn’t sleep, and then at work I’d have to pull my phone out all the time.” Half the time, he says, it wouldn’t accurately recognize his face or his voice.

Guardian demands more but does less. A P.O. could easily verify a person’s identity when meeting them in person. The app taking their place is apparently unable to reliably do this. It fails at this simple task multiple times an hour, day after day. An app unable to balance its ID books isn’t going to help anyone return to a normal life after repaying their debt to society.

A quick cost-benefit analysis sides heavily with costs. The app costs $90/month and doesn’t work correctly. What it does do is put compliant parolees at risk of being incarcerated again. Even when it’s working somewhat correctly, it’s a problem.

As we found in the review, Guardian checks in with Telmate’s servers every single minute, waking up a phone if it’s asleep and ignoring the operating system’s requests to optimize the battery. Given what Guardian is used for, the app predictably relies on the user granting it access to a number of potentially privacy-invasive sensors on their device, including wifi, Bluetooth, audio settings, and camera access.

All day, everyday surveillance parolees are expected to pay for. And even when they follow the rules, the app says they aren’t. Also included in the code are hooks for surreptitious recording — hidden access to devices’ microphones that can be triggered in standby or sleep mode. Not that sleep mode means anything when the app is phoning home every sixty seconds.

The expectation of privacy for paroled prisoners is low. But it’s not nonexistent. This expensive app removes everything that’s left and replaces it with intrusive check-ins that are so badly implemented they may as well be a malfunctioning ankle bracelet for all the good it’s doing for parolees. But this is likely the best prisoners are ever going to get. Very few people who matter — those with the power to change things — care what happens to ex-criminals. Every sentence can be a life sentence with the proper amount of indifference.

Filed Under: ankle bracelets, apps, guardian, home confinement, prison, smartphone apps
Companies: telmate

Filings In Facebook's Lawsuit Against NSO Show FBI Director Chris Wray Was For Encryption Before He Was Against It

Say That Again

from the just-a-little-awkward dept

I have opined that FBI Director Chris Wray needs to shut the fuck up about encryption. Wray has presented a completely skewed perspective on the issue, following in the footsteps of Jim Comey. Wray claims encryption is leading to a criminal apocalypse, even as crime rates remain at historic lows. He also claims encryption is making it impossible to follow through with investigations, but has presented no evidence to back this claim.

The best argument the FBI could present was its always-growing number of encrypted devices in its possession. In the space of a couple of years, the number jumped from less than 900 to nearly 8,000. This seemed to indicate encryption was a growing problem, but when the FBI tried to verify this number for Congress, it found out it had overstated the amount of locked devices in its possession. In reality, the number of locked devices is likely less than 2,000 — hardly the apocalypse of impregnability Wray and Comey continuously presented. This was discovered in May 2018. The FBI has yet to hand over an accurate count of these devices.

Now, there’s this bit of news, which surfaced during Facebook’s lawsuit against malware developer, NSO Group. Chris Wray was for encryption before he was against encryption. Documents filed by Facebook detail Wray’s defense of WhatsApp and its encryption in an earlier legal battle while Wray was working for the King & Spalding law firm. [paywall-free link here]

In the earlier case, which has never been made public, Mr. Wray, then a partner at King & Spalding, was hired to “analyze and protect” WhatsApp’s software from a Justice Department effort to weaken its encryption in order to conduct wiretap of a WhatsApp user’s data.

The arguments made by Mr. Wray’s firm in favor of WhatsApp’s encryption may undercut his recent calls to push tech firms — including his previous client WhatsApp — to roll back encryption, a move many security experts have likened to a government “backdoor.”

Facebook wants King & Spalding booted from the case, citing its previous involvement in defending WhatsApp against actions brought against it by the DOJ. Facebook raises a good point: someone with intimate knowledge of WhatsApp’s inner workings shouldn’t be allowed to use this inside information to defend itself against this lawsuit.

Facebook’s redacted motion [PDF] names Chris Wray as one of the litigators with inside information, gleaned during a still-sealed legal proceeding that appears to have dealt with the DOJ seeking a court’s permission to break (or block) WhatsApp’s encryption to deploy wiretaps.

At the time, WhatsApp was in the process of implementing end-to-end encryption of communications sent on its platform.

[…]

WhatsApp was jointly represented by King & Spalding and ZwillGen PLLC. Specifically, Christopher Wray, Catherine O’Neil, Nick Oldham, and Paul Mezzina of King & Spalding…

Another filing [PDF] — a letter sent from Facebook’s legal reps to NSO Group after it became apparent it was seeking to retain King & Spalding — names Chris Wray as well.

The man who declared Facebook’s move to encrypt Messenger communications as a gift to the world’s criminals once defended WhatsApp’s encryption against the DOJ’s attempt to have it broken or blocked. This apparently occurred around the same time the DOJ was trying to get Apple to break the encryption protecting the San Bernardino shooter’s iPhone.

The New York Times learned of the 2015 matter through confidential sources. At the time, the Justice Department was also engaged in a court battle with Apple, pushing the company to unlock an iPhone belonging to one of the gunmen in a shooting in San Bernardino, Calif. The government ultimately dropped its case after security researchers helped them bypass Apple’s security.

The FBI sees no problem with Wray’s shifting allegiance to encryption. Its statement to the New York Times says the agency supports Wray, no matter how inconsistent his stance. Apparently, it’s fine that he’s willing to change his views to match his employer’s.

“Like all other lawyers, his duty of loyalty was to his client, and he did not put his personal views ahead of his clients’ interests or allow them to affect the legal work he did for clients. Today, as director of the FBI, his duty is to act in the best interests of the American people.”

If that’s his new duty, he’s falling short. He’s acting in the best interest of the FBI and federal prosecutors — the same FBI that also used to recommend people secure their devices with encryption. Strong encryption is in the best interests of the American people. Wray isn’t serving the nation with nearly as much fervor as he apparently defended encryption back when he was getting paid to defend it. WhatsApp’s encryption remains unbroken, despite the DOJ’s efforts. If he didn’t feel it was worth defending then, he probably shouldn’t have defended it. This change of heart doesn’t necessarily make him a hypocrite but it is just one more reason he needs to shut the fuck up about the subject.

Filed Under: backdoors, chris wray, encryption, fbi
Companies: facebook, nso, whatsapp

Hard Pass: Clearview Offers To Help Out With COVID-19 Contact Tracing

(Mis)Uses of Technology

from the [incoherent-screaming-into-the-void] dept

Clearview AI is inserting itself into a discussion no one invited it to participate in. The discussion around contact tracing to manage and (hopefully) impede the spread of the coronavirus involves multiple governments around the world. It also includes Google and Apple, who are partnering to create a platform for contact tracing apps.

At least in the case of Google and Apple’s offerings, there appears to have been a serious discussion about protecting users’ privacy as much as possible while still offering a valuable service to government health agencies and people concerned about contracting the virus.

Now, Clearview has blundered into the discussion — a company that has shown utter disdain for the millions of people it has force-fed to its multi-billion image database via social media site scraping. There is no opting in or out of this collection — one that Clearview is selling to law enforcement agencies in the US and to government agencies around the world. If it’s on the web, it’s likely already in Clearview’s database.

In a brief discussion with NBC News, CEO Hoan Ton-That pitched his idea for a Clearview-based contact tracing program. What Ton-That wants to do is tie his app and its database to thousands of CCTV cameras located in stores, parking lots, gyms, and other locations where, as he puts it, “there’s no expectation of privacy.” Ton-That doesn’t explain how his system will be notified of a person’s COVID status, but he’s pretty sure his software will be able to recognize faces accurately. Clearview’s facial recognition AI remains unproven, but it’s supposedly capable of making guesses about faces using images as small as 110×110.

Ton-That also seems unconcerned about the privacy implications of adding people’s health status to his enormous database of scraped personal information. He says any limitations on gathering/storage of this info would be up to whoever decides to take him up on his unsolicited offer.

Obviously, no one should do this. The AI is unproven and Clearview is far from trustworthy. Activist group Fight For The Future has issued its official statement on Clearview’s contact tracing pitch. It’s short but punchy.

“Absolutely the fuck not,” said Evan Greer (she/her), the groups Deputy Director.

As FFTF points out, adding Clearview to the mix just adds more potential privacy violations to the mix by dumping people’s health info into a database that’s already being accessed by a number of private companies and government agencies around the world. Ton-That appears to assume that anyone in a “public” area is fair game for his company. Adding thousands of cameras operated by hundreds of private companies would provide a steady flow of facial images (some tied to very personal information) into his database, making his product even more enticing to government agencies.

Hopefully, no one will let Clearview near any of this. Facial recognition adds nothing to contact tracing — something that can be done almost anonymously using the platform developed by Google and Apple. Hoovering up facial images — along with location data and health info — is a privacy nightmare. And there’s probably no company that should be trusted less with your personal info than Clearview, which has repeatedly demonstrated it cares nothing about the millions of people it has turned into fodder for its unproven tech.

Filed Under: artificial intelligence, contact tracing, facial recognition, hoan ton-that, privacy, trade-offs
Companies: clearview, clearview ai