Clearview Was A Toy For Billionaires Before It Became A Toy For Cops

(Mis)Uses of Technology

from the searching-billions-of-images-for-fun-and-profit dept

Clearview’s claims that its controversial facial recognition program is only for use by law enforcement agencies continues to be exposed as a lie. Documents obtained by BuzzFeed showed the company has sold its tech to a variety of private companies, including major retailers like Kohl’s and Walmart.

It’s also expanding its reach across the globe, pitching its products to dozens of countries, including those known mostly for their human rights violations. Even when it limits itself to law enforcement agencies, it still can’t help lying — exaggerating its success and assistance in criminal investigations.

Before Clearview became a plaything for government agencies and private corporations, it was a toy for the rich and powerful. Kashmir Hill — who broke the first story about Clearview’s problematic image-scraping operation — has a followup in the New York Times detailing the company’s unpleasant origin story.

One Tuesday night in October 2018, John Catsimatidis, the billionaire owner of the Gristedes grocery store chain, was having dinner at Cipriani, an upscale Italian restaurant in Manhattan’s SoHo neighborhood, when his daughter, Andrea, walked in. She was on a date with a man Mr. Catsimatidis didn’t recognize. After the couple sat down at another table, Mr. Catsimatidis asked a waiter to go over and take a photo.

Mr. Catsimatidis then uploaded the picture to a facial recognition app, Clearview AI, on his phone. The start-up behind the app has a database of billions of photos, scraped from sites such as Facebook, Twitter and LinkedIn. Within seconds, Mr. Catsimatidis was viewing a collection of photos of the mystery man, along with the web addresses where they appeared: His daughter’s date was a venture capitalist from San Francisco.

“I wanted to make sure he wasn’t a charlatan,” said Mr. Catsimatidis, who then texted the man’s bio to his daughter.

That’s just one anecdote. There are others. Investors approached by Clearview, like venture capitalist Hal Lambert, explored the power of Clearview’s app in pretty irresponsible ways. Lambert allowed his school-aged daughters access to the app. And it appears actor/investor Ashton Kutcher was given access to the app. He described an app that sounds exactly like Clearview when he appeared on the YouTube series “Hot Ones” last September.

“I have an app in my phone in my pocket right now. It’s like a beta app,” Mr. Kutcher said. “It’s a facial recognition app. I can hold it up to anybody’s face here and, like, find exactly who you are, what internet accounts you’re on, what they look like. It’s terrifying.”

It is terrifying. And far more people have had access to it than Clearview has admitted. Plenty of potential investors were given access to the app. It’s not clear how many still have access, but it appears their use of the app went unmonitored/uncontrolled by Clearview. Understandably, investors want to know if the thing they’re looking to invest in works, but Clearview did nothing to ensure this access was limited or used responsibly. That same attitude has carried over to its pitches to law enforcement, which encourages cops to use friends and family members as guinea pigs for tech it claims should only be used for legitimate law enforcement efforts.

Power and responsibility are supposed to go hand-in-hand. There’s none of that happening here. Clearview compiled a database by scraping images from hundreds of websites and is now selling this access to pretty much anyone willing to buy it.

Filed Under: billionaires, facial recognition, john catsimatidis
Companies: clearview, clearview ai

Cybersecurity Firm Hired By Voatz To Audit Its System Finds Voatz Is Full Of Vulnerabilities

News

from the bringing-new-attack-vectors-to-previously-excluded-voters dept

Mobile voting app Voatz is still a mess. Two years ago, West Virginia decided to give the app a spin to allow some voters to vote from home during the midterm elections. Nobody in the security world thought this was a good idea. The only people who did feel this was a safe, secure way to collect votes were state legislators and Voatz itself. Some early poking and prodding by security researchers immediately found problems with Voatz’s handling of votes, including out-of-date SSH and unproven facial recognition tech that was supposed to verify voters by matching their selfies to their government IDs.

Two-and-a-half years later, not much has improved. Voatz is still courting state governments, trying to talk them into using its app to allow the housebound and those overseas to vote in their elections. An MIT study of the software found multiple issues, including flaws that would allow attackers to intercept votes — and alter or trash them — without anyone on either end realizing they’d been hacked.

Voatz responded badly, insulting the researchers and claiming its server-side software would miraculously prevent the described attack from happening. When the researchers pointed out Voatz was wrong about its own software, it published a blog post attacking the researchers as “publicity hounds” seeking to disrupt the election process.

Another month has passed and it’s more bad news for Voatz. Voatz and Tusk Philanthropies hired cybersecurity firm Trail of Bits to perform a security audit of its software. Guess what? It’s still a mess.

Our security review resulted in seventy-nine (79) findings: forty-eight (48) technical and thirty-one (31) in the threat model. A third of the findings are high severity, another third medium severity, and the remainder a combination of low, undetermined, and informational severity.

More specifically, it’s pretty much everything about the entire system:

Voatz’s code, both in the backend and mobile clients, is written intelligibly and with a clear understanding of software engineering principles. The code is free of almost all the common security foibles like cryptographically insecure random number generation, HTTP GET information leakage, and improper web request sanitization. However, it is clear that the Voatz codebase is the product of years of fast-paced development. It lacks test coverage and documentation. Logical checks for specific elections are hard-coded into both the backend and clients. Infrastructure is provisioned manually, without the aid of infrastructure-as-code tools. The code contains vestigial features that are slated to be deleted but have not yet been (TOB-VOATZ-009). Validation and cryptographic code are duplicated and reimplemented across the codebase, often erroneously (TOB-VOATZ-014). Mobile clients neglect to use recent security features of Android and iOS (TOB-VOATZ-034 and TOB-VOATZ-042). Sensitive API credentials are stored in the git repositories (TOB-VOATZ-001). Many of its cryptographic protocols are nonstandard (TOB-VOATZ-012).

This is software that’s been used by governments to collect more than 80,000 votes in more than 50 elections. This is the software Sen. Ron Wyden has called “snake oil.” When Voatz actually attempts to fix something, it sometimes makes it worse. From Motherboard’s report on the Trail of Bits audit:

In at least one instance, a fix that Voatz put in place to address a vulnerability resulted in a new bug. In this instance, Trail of Bits initially identified an issue where an attacker with knowledge of the target’s phone number could hijack the target’s Voatz account during re-registration process, locking the target out of the account and giving the attacker access. Voatz fixed this issue, but the fix it put in place introduced a new issue that “can allow an attacker to bypass SMS verification during pre- and re-registration.” Voatz said this issue was fixed, but Trail of Bits could not independently confirm because it did not have access to the updated, supposedly fixed code.

Voatz continues to seek shelter in the comforting embrace of denial, even when faced with findings from researchers it hired to audit its software. The company’s CEO, Nimit Sawheny, told Motherboard that while he didn’t dispute any of the technical details, Voatz is still safe to use because the deficiencies highlighted were “theoretical” and that he had not seen any proof yet that Voatz has been hacked.

Even theoretical holes can do real damage, once attackers figure out how to exploit the flaw. Just because Voatz hasn’t been hacked yet doesn’t mean it won’t be. And it won’t get more hack-proof if the company continues to downplay researchers’ findings or — in the case of the MIT study — publicly attack people who are doing everything they can to ensure elections aren’t disrupted (or hijacked) by malicious parties.

Worse, even as Trail of Bits was confirming the findings of the MIT report, the company’s CEO continued to claim MIT’s findings were mere “opinion” and that this report was filled with errors. This led to the following statement from the MIT team:

“It is profoundly troubling to hear that Voatz was aware that the vulnerabilities found in our research were still active at the same time they were misrepresenting and downplaying our findings to the Department of Homeland Security, state elections officials, and the public,” the authors of the MIT report told Motherboard in a statement.

Bringing voting options to people who previously had no choice but to sit out elections is important. But that doesn’t mean the American public should be forced to settle for half-assed solutions just because something better isn’t available at the moment. No parent wants to hear their child is ugly and full of security flaws, but Voatz’s insistence on attacking researchers and their findings does not make the company seem any more trustworthy or capable of providing a secure mobile voting option.

Filed Under: blockchain, cybersecurity, electronic voting, mobile voting, security
Companies: voatz

Police Department Shells Out $50,000 To Man After His Camera Catches Cops Fabricating Criminal Charges Against Him

Legal Issues

from the talking-themselves-into-a-lawsuit dept

The Connecticut State Police have agreed to pay $50,000 to a man its officers subjected to a bunch of Constitutional violations on their way to issuing tickets to him for violations he never committed.

Here’s a brief description of how this whole thing started:

On September 11, 2015, Picard was protesting near a police DUI checkpoint in West Hartford. One of the defendants, John Barone, approached him under the pretext of public complaints and confiscated Picard’s camera and lawfully carried pistol. Unbeknownst to the troopers, the camera was recording when Barone brought it to where co-defendants Patrick Torneo and John Jacobi were talking.

That’s just part of what happened before the recording the officers weren’t aware of captured them colluding to make up crimes to charge Michael Picard with.

There’s more detail in the opinion [PDF] the court handed down last fall, which gave the State Police notice its officers were unlikely to escape Picard’s lawsuit. One officer knocked Picard’s video camera to the ground. When he picked it up to continue recording the officers, one of them did something really stupid.

While defendants discussed plaintiff, plaintiff picked up his video camera off the ground and aimed it at the three defendants.

Barone then walked back to plaintiff. He grabbed plaintiff’s video camera and told him, “It’s illegal to take my picture.” Defendants have admitted that Barone “told plaintiff that it was illegal to take his picture without permission to do so;” and that Barone “secured” plaintiff’s camera.

Once they had it in their possession, the cops ignored the camera. This is important because they later argued they seized it because they thought it might be a gun. If they really thought the camera posed a threat to them, you’d think they would have examined the camera. But they didn’t.

If they had examined the camera, they might have noticed it was still recording. This is what the camera caught as it laid on top of the officers’ vehicle.

Torneo spoke by phone to Lieutenant Allan to determine whether plaintiff had any “grudges;” asked why plaintiff was challenging them at the DUI spot checks; and discussed plaintiff’s past demonstrations.

Defendants Torneo and Barone verified that plaintiff’s pistol permit was valid, that his gun was not stolen, and that there were no warrants for his arrest.

On the video camera recording, Barone can be heard stating, “punch a number on this or do what? Gotta cover our ass.” Torneo can be heard saying, “Let’s give him something,” and “then we claim in backup that we had multiple people stop and complain … but they didn’t want to stay and give a statement.”

Here’s the recording Picard’s camera made — one that captures officers colluding to create bogus criminal charges against a citizen.

Picard was charged with two criminal infractions. Both were dropped by the prosecutor. More importantly, the court refused to extend qualified immunity to these officers on Picard’s Fourth Amendment violation allegations. It also refused QI on Picard’s First Amendment retaliation claim. With three officers facing a jury trial, the State Police has decided to buy its way out of this using taxpayer money.

This incident shows why recording police officers isn’t just important, it’s necessary. While it may be difficult to record officers’ discussions once they’re back in their vehicle, having a recording device visible and present may deter cops from fabricating charges just because they don’t like the legal activity you’re engaged in. Officers are usually pretty careful to ensure their own illegal activity goes unrecorded, but it’s tough for them to control devices operated by citizens.

Filed Under: cameras, civil liberties, connecticut, free speech, police, protests, west hartford

Florida PD's Reverse Warrant Leads To Innocent Man Being Targeted In A Robbery Investigation

(Mis)Uses of Technology

from the let-me-ride-my-bike-through-the-wide-open-country-that-I-love dept

Riding your bike while sending out geolocation data is the hot new crime.

Cops are using reverse warrants with increasing frequency, inverting the usual investigation process by demanding info about everyone in a certain area before trimming down the data haul to a list of suspects. It’s sort of like canvassing a neighborhood, except investigators approach companies like Google, rather than people who might have seen something.

The problem with these dragnets is it makes everyone in the area a suspect. The more heavily-trafficked the area is, the more problematic this process is. Reverse warrants have already resulted in innocent people being jailed. This report by NBC News is another cautionary tale — one that involves a man who became a suspect in a robbery just because he wandered into the geofence set up by cops.

The email arrived on a Tuesday afternoon in January, startling Zachary McCoy as he prepared to leave for his job at a restaurant in Gainesville, Florida.

It was from Google’s legal investigations support team, writing to let him know that local police had demanded information related to his Google account. The company said it would release the data unless he went to court and tried to block it. He had just seven days.

[…]

In the notice from Google was a case number. McCoy searched for it on the Gainesville Police Department’s website, and found a one-page investigation report on the burglary of an elderly woman’s home 10 months earlier. The crime had occurred less than a mile from the home that McCoy, who had recently earned an associate degree in computer programming, shared with two others.

Now McCoy was even more panicked and confused. He knew he had nothing to do with the break-in ? he’d never even been to the victim’s house ? and didn’t know anyone who might have. And he didn’t have much time to prove it.

This put McCoy in the very uncomfortable position of proving his innocence even before he had even been charged with a crime. Realizing there was a good possibility approaching the department directly would result in his immediate arrest, McCoy hired a lawyer using money given to him by his parents from their savings. His lawyer, Caleb Kenyon, went to court to get the warrant killed.

Kenyon argued that the warrant was unconstitutional because it allowed police to conduct sweeping searches of phone data from untold numbers of people in order to find a single suspect.

[…]

“This geofence warrant effectively blindly casts a net backwards in time hoping to ensnare a burglar,” Kenyon wrote. “This concept is akin to the plotline in many a science fiction film featuring a dystopian, fascist government.”

Had McCoy not done this, the Gainesville PD would have continued to view him as the most likely suspect, approaching Google once again to obtain identifying info. McCoy’s daily bike rides took him past the crime scene he never knew was a crime scene. With the warrant being questioned, the Gainesville PD withdrew it, saying statements made in the McCoy’s lawyer’s filings made it clear they were targeting the wrong person.

Imagine how this would have gone for someone without the funds to hire a lawyer… or for any number of people who may feel there’s nothing they can do to prevent cops from obtaining their information from a third party. The novelty of this inverted interpretation of probable cause doesn’t lend itself to simple answers. Clearing your name isn’t as easy as showing up at the cop shop with a reasonable explanation about why your location data is all over the crime scene.

When rounding up the usual suspects means harvesting data on hundreds or thousands of innocent people, the possibility of putting the wrong person in jail increases exponentially. McCoy’s experience may be an outlier, but it won’t be that way for long.

Filed Under: 4th amendment, florida, gainesville, geofence warrant, geolocation, location data, warrants, zachary mccoy
Companies: google

Arrests R Us: Six-Year-Old Cuffed And Tossed Into A Cop Car For 'Throwing A Tantrum' At School

Legal Issues

from the arewethebaddies.gif dept

America’s least valuable renewable resource is school resource officers. At some point, we — as a nation — apparently agreed school disciplinary issues should be turned over to law enforcement officers. To be sure, this decision was made without our input, for the most part. Most people agree it’s ridiculous to turn rote violations of school policy over to men and women trained in the apprehension and investigation of actual, real crimes like homicide, drug distribution, and any number of day-to-day activities carried out while black.

What have we received in return for being forced to part with our souls in exchange for the rare occasions where serious criminal acts occur on school grounds? An endless supply of outrage and disgust, which is the renewable resource no one asked for. What is our take-home from this involuntary exchange?

I don’t know.

Do you love a parade? Because this is one of the most horrible:

• School cop arrests seven middle-school girls “just to prove a point“
• Cops arrest and charge a 12-year-old with a felony for pointing “finger guns” at a classmate
• Seven teens arrested for throwing water balloons — one of which hit a security officer
• Twenty-two sixth grade girls are strip searched to find $50
• Student arrested for writing a story about a pet dinosaur being shot with a gun
• Eight-year-old strip searched because someone found feces on a bathroom floor
• A nine-year-old is handcuffed over an off-campus fight
• A five-year-old with ADHD is handcuffed and hogtied for supposedly “battering” the school resource officer

The saga continues. Schools are giving police the power to arrest students for doing things that used to be handled with in-school suspensions, direct conversations with parents, and other school disciplinary processes.

It’s not getting better/
It’s not getting better, man/
It’s just getting old.

Kaia Rolle was sitting, listening to a school employee read her a story when two officers came in the room to arrest her.

“What are those for?” the 6-year-old girl asked the Orlando police officers.

“They’re for you,” Officer Dennis Turner said about the zip ties, before another officer tightened them around her wrists. Kaia immediately began weeping.

CUT TO: Officer Dennis Turner lifts his “Children’s Tears” mug to the camera, owning every lib in sight. School employees stand by idly, watching this six-year-old criminal being slung into the back seat Officer Turner’s cruiser and into the wheels of justice.

Sickeningly, Officer Turner is pretty OK with arresting kids. It’s all part of the job.

He told them he had arrested 6,000 people in his career — the youngest, to that point, was 7. When school employees told him Kaia was 6, not 8 like he thought, he did not seem concerned.

“Now she has broken the record,” he said.

May God have mercy on his soul. I mean, that’s what someone far more charitable than me would say. I’m more aligned with his fellow officers, who were not at all cool with seeing Officer Turner’s personal record being broken.

Orlando police Officer Sergio Ramos called his supervisor from Lucious & Emma Nixon Academy in September, to express his concerns after placing 6-year-old Kaia Rolle the back of his patrol SUV, where she sat with hands bound behind her back in zip ties.

“Sarge this girl is tiny,” he told Sgt. Douglas Andreacchi. “She looks like a baby.”

Two officers tried to prevent this student from being arrested. The only “crime” alleged was throwing a tantrum and hitting a teacher. For that, Officer Turner cuffed her and booked her. There’s some good news, though. The six-year-old is no longer facing criminal charges. (Dear god, the fact that that sentence even needs to be written…). And Turner is out of a job.

Turner was fired shortly after the arrest for not getting the approval of a watch commander to arrest someone younger than 12.

But that good news is tempered by Turner’s own statements, where he declared he had arrested students as young as seven, which would have broken the same rules that got him fired for this arrest. That means his employer — the Orlando PD — doesn’t act to enforce its own rules unless an arrest generates headlines all over the nation.

Meanwhile, in Dekalb County, Georgia, police “misidentified” an 11-year-old black girl as a grand theft auto suspect. Cops cuffed her and repeatedly ignored her mother’s offer of proof that her daughter had been home all night, rather than out trying to steal cars.

And here’s where home surveillance product purveyor Ring comes in. Cops seem to love Ring cameras and their footage… but apparently only when the footage gives them permission to do the things they wanted to do all along.

[Cynthia] Hendricks not only explained to the officers that her daughter couldn’t have been involved because she’d been home since 4 pm, she even provided the officers with video evidence from her Ring doorbell and other motion cameras from around the house as proof that London had entered the house and hadn’t left at the time of the alleged car theft attempt.For whatever reason, the proof Hendricks provided failed to dissuade the officers from handcuffing and detaining her daughter.

The cops only let her go after finding out she was only 11, instead of 16 like the suspect they were actually looking for.

Why kids?

Counterpoint: why not?

They’re smaller, easier to intimidate, and far less likely to put up resistance. Any statements made by parents and legal guardians are easier to discount because any parent would say anything to save their child.

Cops like these ones are sloppy cowards who can’t be bothered to get facts straight or access any deeply-buried well of common sense/restraint. A criminal is a criminal, even if the criminal is six and is getting arrested for doing things six-year-olds do… like throw tantrums.

When you hand over students to cops, you cannot stand by and pretend to be shocked when they treat every rule violation like a criminal violation. If you don’t want to see six-year-olds cuffed by cops, the solution is simple: DON’T CALL THE COPS. There’s plenty of blame to spread around here, but a lot of it lies with the enablers of our society who feel parents are just co-conspirators in a massive underage criminal conspiracy. As for the second story, it’s only the worst cops who ignore evidence that doesn’t match their preconceptions. And there are far too many “worst cops” working the streets.

Filed Under: 6 year old, arrests, kids, police, temper tantrums

FBI Director Chris Wray Pitches Weakened Encryption At A Cyber Security Conference

(Mis)Uses of Technology

from the piling-on-the-unintended-irony dept

On May 29, 2018, the FBI promised to deliver an updated count of encrypted devices in its possession. As James Comey and his replacement, Chris Wray, continued to advocate for weakened encryption, the number of phones the FBI couldn’t get into swelled from 880 in 2016 to over 7,800 by the time the FBI realized its phone-counting method was broken.

This number still hasn’t been updated. An early internal estimate by the FBI put the real number of locked devices at ~1,200. But the official number still hasn’t been released. This hasn’t stopped Chris Wray from continuing his attacks on encryption, painting pictures of a dark future that isn’t supported by the small number of encrypted devices in the agency’s possession.

The attacks continue. They’re more subtle than Attorney General Bill Barr’s aggressive pitches, but they’re still happening. Chris Wray spent his time at a recent cyber security conference in Boston making the case for strong encryption before (yet again) making a plea for tech companies to give law enforcement the encryption backdoors Wray still refuses to call backdoors.

Today we’re worried about a wider-than-ever range of threat actors, from multi-national cyber syndicates to nation-state adversaries. And we’re concerned about a wider-than-ever gamut of methods continually employed in new ways, like the targeting of managed service providers—MSPs—as a way to access scores of victims by hacking just one provider.

[…]

We’re also battling the increasing sophistication of criminal groups that places many hackers on a level we used to see only among hackers working for governments. The proliferation of malware as a service, where darkweb vendors sell sophistication in exchange for cryptocurrency, increases the difficulty of stopping what would once have been less-dangerous offenders. It can give a ring of unsophisticated criminals the tools to paralyze entire hospitals, police departments, and businesses with ransomware. Often the hackers themselves haven’t actually gotten much more sophisticated—but they’re renting sophisticated capabilities, requiring us to up our game as we work to defeat them, too.

These all sound like arguments for strong encryption. They’re not, I guess. Because the very next thing out of Wray’s mouth is this:

We’re having to fight these increasingly-dangerous threats while contending with providers increasingly shielding indispensable information about those threats from any form of lawful access—through warrant-proof encryption.

“Warrant-proof encryption” is just encryption. It’s protecting all the people Chris Wray says need to be protected from cyber threats. Just because it’s made gathering evidence slightly more difficult is no reason to portray encryption as an evil the nation needs to be saved from.

But Wray’s disingenuousness doesn’t stop there.

We are all for strong encryption—and contrary to what you might hear, we’re not advocating for “back doors.” We’ve been asking for providers to make sure that they themselves maintain some kind of access to the encrypted data we need, so they can still provide it in response to a court order.

It’s still a door — one that wasn’t there previously. Trying to dodge the “backdoor” term by asking service providers to leave themselves a key under the doormat is a weak and transparent effort to pre-distance Wray from any subsequent damage his desires might cause. Wray doesn’t want to be the villain if anti-encryption laws are ever enacted. But he won’t waste any time availing himself of the access it provides, even as it undermines the security of the nation.

Filed Under: chris wray, doj, encryption, fbi

Clearview Sued By Vermont Attorney General For Violating The State's Privacy Laws

News

from the engineering-its-own-downfall dept

For the second time in a little over 30 days, odious facial recognition tech supplier Clearview is being sued. Unlike the first lawsuit, which is a proposed class action over violations of Illinois’ biometric privacy law, this one [PDF] is being filed by a government agency. The Attorney General of Vermont is seeking to permanently ban Clearview from collecting info about state residents or sell access to the info it’s already collected.

The complaint alleges that Clearview AI has been collecting photos of Vermonters available on the internet – called “screen scraping” – and using artificial intelligence to “map” individual’s faces. Private businesses, individuals, and law enforcement use this data via an app that allows a user to identify a person within seconds using only a photograph. No Vermont state or local law enforcement agencies have used the app. Clearview AI collects the facial recognition data of Vermont children, as well as adults, without their notice or consent.

The complaint also alleges that Clearview AI violated Vermont’s new Data Broker Law by fraudulently acquiring data through its use of screen scraping.

The method used to compile Clearview’s database of three billion images is going to make it very difficult for the company to dodge lawsuits like these. Scraping sites may be mostly legal, but Clearview doesn’t provide any way to opt out of this collection. Scraping images from sites where users have granted the platform permission to publish their information doesn’t mean the TOS agreement the user made with the platform magically migrates with the scraped data.

From the lawsuit:

[T]he term “publicly available” does not have any meaning in the manner used by Clearview, as even though a photograph is being displayed on a certain social media website, it is being displayed subject to all of the rights and agreements associated with the website, the law, and reasonable expectations. One of those expectations was not that someone would amass an enormous facial-recognition-fueled surveillance database, as the idea that this would be, permitted in the United States was, until recently, unthinkable.

Thus, when an individual uploads a photograph to Facebook for “public” viewing, they consent to a human being looking at the photograph on Facebook. They are not consenting to the mass collection of those photographs by an automated process that will then put those photographs into a facial recognition database. Such a use violates the terms under which the consumer uploaded the photograph, which the consumer reasonably expects will be enforced.

Clearview’s database compilation relies on its violating website terms of service en masse. Sites have begun pushing back but at this point their legal options are limited to being angry about it. But some state-by-state litigation may actually have an effect, since it seems almost impossible for Clearview to comply with privacy laws governing the collection of biometric data. Selling access to the data makes it even more difficult, since there’s no way for those packaged up in Clearview’s database to request removal or limit access to the scraped data.

It’s too late for Clearview to salvage its reputation by claiming it controls access carefully and sells only to law enforcement agencies to assist in solving crimes. That cat walked right out of the bag and over to BuzzFeed, which reported Clearview is selling its tech to private companies and governments engaged in ongoing human rights abuses. Claiming to serve a higher purpose while behaving like a bottom feeder doesn’t do anything for anyone, least of all a company that hoped it would fly under the radar long enough to capitalize fully on a bunch of free photos it found scattered around the internet.

Filed Under: data broker law, facial recognition, privacy, privacy law, vermont
Companies: clearview, clearview ai

Five Weeks After Being Sued, DEA Agrees To Return $82,000 It Stole From A Retiree

News

from the weird-how-that-works dept

Sometimes all it takes is a lawsuit and little bad press to make the federal government at least temporarily regret its thieving ways.

In January, the DEA was sued by Rebecca West and her father Terry Rolin after the agency lifted Rolin’s life savings — more than $82,000 — from West at the Pittsburgh airport. The supposedly travel safety-focused TSA agents saw the cash in West’s carry-on luggage and decided to notify State Troopers and the DEA. After a few extended conversations with West, the DEA decided to seize the money under the theory that a person with this much cash on their person must have obtained it illegally.

The Institute for Justice — which is representing West in her lawsuit — reports the DEA has suddenly and mysteriously decided the money agents took from West was probably honest money after all.

Terry Rolin’s life savings of $82,373 will finally be returned to him, nearly six months after it was wrongfully seized by the Drug Enforcement Administration (DEA) from his daughter Rebecca Brown as she traveled through Pittsburgh International Airport to her home in Boston. Without offering any apology for the harm caused by confiscating Terry’s life savings for six months, the DEA informed the Institute for Justice (IJ) via letter that: “After further review, a decision has been made to return the property.”

This looks like someone further up the org chart saw the bad press and lawsuit generated by this suspicionless seizure and told someone to get the suddenly tainted money the hell out of the DEA’s coffers. The letter [PDF] is 99% formality, explaining nothing about the original seizure. It simply states that if Rolin owes any money to the government, the government will deduct it from the $82,373 the DEA deducted in whole from West’s luggage six months ago.

The DEA could have done this at any point before being served with a lawsuit. Presumably this return of Rolin’s legally-obtained life savings is being done to moot as much of his lawsuit as possible. It’s not going to work. The lawsuit continues, with the Institute for Justice and its clients hoping to secure a win that might force the TSA to focus on travel safety (rather than cash) and the DEA to actually provide suspicion that’s far more reasonable than whatever excuse agents are currently using to steal money from travelers.

“We are glad that Terry will get his money back, but it is shameful that it takes a lawsuit and an international outcry for the federal government to do the right thing,” said IJ Senior Attorney Dan Alban. “We know that this routinely happens to other travelers at airports across the United States. Terry and Rebecca are going to fight on until TSA and DEA end their unconstitutional and unlawful practices of seizing cash from air travelers without probable cause or reasonable suspicion.”

Hey, DEA: if you don’t like being sued, maybe don’t do stuff that will get you sued. I mean, that’s the kind of logic you law enforcement types understand, right? Don’t break the law, etc. Asset forfeiture is hot, unconstitutional garbage. You can’t cripple drug lords by robbing random people of their life savings. But if the DEA actually went about the business of dismantling the drug trade, it might move resources away from its “taking cash from travelers” outreach program. And that would apparently be unacceptable.

Filed Under: asset forfeiture, civil asset forfeiture, dea, rebecca west, terry rolin, tsa

Michigan State Police Spend The Weekend Getting Ratioed For Bragging About Stealing $40,000 From A Driver

Legal Issues

from the at-least-$40k-in-reputational-damage dept

The Michigan State Police recently informed Twitter users that it’s engaged in stealing money from drivers. I don’t know what it expected from this announcement, but I’m sure spending a few days being ratioed wasn’t what the agency had in mind.

Here’s the first part of the MSP’s “Yes, we steal money” announcement:

If you can’t see the tweet, it says:

Trooper from First District Headquarters conducted a traffic stop for following too close on I-75 in Monroe County on March 3rd. Further investigation resulted in locating and seizing approximately $40,000.00 in cash. The driver was a 33 year old male from out of state and was

Here’s the kicker, picking up where the first tweet left off:

not arrested. The investigation continues.

So, some alleged criminal, originally only suspected of “following too close” was pulled over, hassled into a search, and relieved of his $40,000 by state troopers. No arrest, but I guess the money was guilty of something.

This statement, issued a day after the tweets, doesn’t really clarify anything. What it does show is the MSP enaged in catch-and-release drug enforcement, where suspected criminals are free to go, but not any cash they happen to have on them.

Lt. Brian Oleksyk, MSP public information officer, said the traffic stop and seizure were related to a narcotics investigation.

“We develop probable cause in order to seize money,” he said.

That’s a blanket statement about ideals. That’s not a statement specific to this “investigation,” which began with a pretextual stop and ended in a windfall for the State Police.

But the most instructive thing about this whole experience is the hundreds of replies calling the State Police thieves. It shows people are pretty sick of hearing cops brag about how they took money from people without actually arresting the supposed criminals who were carrying the cash. Agencies engaged in civil asset forfeiture do not have broad support from the public. If they actually believe they do, they’re lying to themselves.

Cash is still a legal way to pay all debts public and private. It says so right on the money. Traveling with cash does not make someone a criminal and the existence of cash isn’t the same thing as actual probable cause. I doubt being ratioed on Twitter will make the MSP rethink its forfeiture programs. But it does make it clear many people see “forfeiture” and “theft” as synonymous.

Then there’s the question of whether the MSP can actually do this. Last year, a law was passed effectively banning forfeitures under $50,000 without a conviction.

Starting in 90 days, the laws will prohibit assets taken in suspected drug crimes from being forfeited unless the defendant is convicted or the value of the money and property is more than $50,000, excluding the value of contraband.

Prosecutors and cops made highly-questionable arguments against the new law, claiming having to prosecute drug dealers would result in fewer drug dealers being prosecuted. Unless there’s a loophole the MSP is planning to use (like the federal option), this set of tweets was the State Police announcing to everyone the agency was planning to break the law. Not a good look.

Filed Under: asset forfeiture, bragging, civil asset forfeiture, legalized theft, michgan state police, michigan

DOJ's First Attempt To Prosecute Accused Vault 7 Leaker Ends In A Mistrial

Failures

from the if-at-first-you-fuck-things-up... dept

The DOJ has taken an open-and-shut espionage case and managed to somehow misplace the back cover. Does this say something about the unintended consequences of charge-stacking? Maybe. Whatever it is, it isn’t pretty.

The case against alleged Vault 7 leaker Joshua Schulte seemed pretty air tight, especially when Schulte continued to leak sensitive documents while behind bars, as well as attempting to rope his family into committing contempt of court violations on his behalf.

He also, as Marcy Wheeler pointed out, gave the government pretty much everything it wanted or needed, but the DOJ’s prosecutors failed to present evidence in a coherent way, resulting in a whole lot of juror confusion.

According to InnerCity Press (virtually the only press covering the Schulte verdict watch), by end of day today the jurors had sent out 25 notes, most questions but also problems with two of the jurors. At the end of the day they told the Court they “aligned” on two of the charges, but were at an impasse on the other. Given that there’s slam dunk evidence that he committed the least serious crimes (false statements and contempt), that suggests at least some members of the jury have reasonable doubt that the guy who wrote a virtual signed confession to committing the most damaging leak in CIA history actually did so.

The verdict is now in, what there is of it. The case initially involved charges ranging from false statements to CFAA violations to copyright infringement (!) to child porn possession (!!!). Barely any of those charges have survived. A mistrial has been declared with jurors only finding Schulte guilty on the two least serious charges: false statements and contempt. Those won’t be enough to keep him in jail since he’ll likely be credited with time served. Schulte has been in jail since December of 2018.

This doesn’t mean it’s over. Marcy Wheeler says the government will very likely take another stab at presenting a coherent case.

The two sides will have a conference on March 26 to decide what to do. The government will certainly push to retry Schulte; Sabrina Shroff [Schulte’s lawyer] asked for an extended deadline to file motions. She may try to do something further about the government’s late notice that Michael, a key witness, got put on paid leave last August (though the government has argued compellingly that Michael’s underlying lack of candor has been noticed to the defense throughout). She also may make yet another bid to get more access to the forensics, something I’ve argued that the government should have permitted in the first place.

The mistrial declaration is a credit to Shroff, who performed the unenviable task of shepherding an extremely unhelpful client through a federal espionage prosecution. Facing espionage charges drastically reduces a defendant’s options. Drawing additional judicial scrutiny by attempting to leak sensitive material while incarcerated and spending your free time openly insulting the FBI and federal prosecutors isn’t a course of action recommended by anyone.

Prosecutors needed to present a case containing a wealth of technical detail to jurors with clarity and conciseness. The twenty questions given to the judge by jurors a few days before the mistrial declaration showed the jury still remained confused about the facts of the case and, in a couple of instances, focused on information that had little to do with the criminal charges they were deliberating.

The government may get more charges to stick the second time around. But this initial failure is an indictment of the prosecution and its apparently misplaced confidence that the evidence spoke for itself. When you have to prove something beyond a reasonable doubt, quantity is no replacement for quality. As for Schulte, he’s still at the DOJ’s mercy until it exhausts its prosecutorial options. This isn’t going to work out well for Schulte who’s shown he’s unable to quietly bide his time and capitalize on the government’s missteps. He seems compelled to make things worse for himself during his unfortunately ample downtime.

Filed Under: doj, espionage, hacking tools, joshua schulte, leaks, mistrial, vault 7