Federal Agents Are Using A Reverse Warrant To Track Down Arson Suspects

Legal Issues

from the starting-with-what-we-don't-know-and-working-our-way-backwards dept

Reverse warrants have been deployed again. And, again, Wisconsin law enforcement agencies are involved. The feds used a reverse warrant to track down robbers who hit a bank at a strip mall just outside of Milwaukee earlier this year.

The feds are at it again. This time it’s the ATF and the targets are two people suspected of arson.

The “reverse” warrant affidavit [PDF] spends a great deal of time letting us know what Special Agent Thomas Greenwich knows: that phones generate a ton of location info using a variety of connections (WiFi, Bluetooth, cell towers) and this information tends to get hoovered up almost immediately by service providers. In this instance the target is Google and the ATF wants any records that fall within two geofenced areas surrounding the sites of two suspicious fires.

If there’s any upside here, it’s that the geofenced locations won’t be sweeping in as many non-suspects as other reverse warrants we’ve seen. And it includes photos depicting the areas targeted by the non-targeted warrant, which helps judges (and interested citizens) see how much potential data the ATF is targeting.

There were two suspected arsons in Milwaukee, located less than 5 miles apart, occurring within three weeks of each other. Both started at the back of the houses and both used accelerants. And both houses had a common denominator: John P. Hunt. Hunt had been evicted from one address (4047 N. 7th) two weeks prior to the first fire, and had been trying to claim tools left behind by a deceased family member, which were stored at the second address (5915 N. 42nd St.). This included one unscheduled visit to reclaim the disputed possessions which had been sorted out by local law enforcement four days before the second suspicious fire.

Here are the geofence coordinates included with the affidavit:

The geofences here are about as limited as they can be, given the nature of the crime. These are much more constrained than others we’ve seen — ones that cover entire blocks in heavily-trafficked areas.

That being said, there are still a few problems. First, coarse location data isn’t precise enough to exclude people living in surrounding houses. The geofenced areas will also capture foot and road traffic that passed through the area during the time frame investigators are looking at.

Finally, there’s the problem that simply does not ever go away, no matter how tightly-constrained the geofence is: these warrants work in reverse, providing law enforcement with location data on people who aren’t suspected of committing criminal acts and allowing investigators to use a pile of non-suspicious data to develop reasonable suspicion.

This data request seems almost extraneous. The ATF already appears to have a couple of suspects — ones well-known to both federal agents and the Milwaukee Police Department. The MPD executed a search warrant at the 4047 N. 7th Street address last summer (following “10-15 visits” to the house by MPD officers during that same summer), recovering “a large amount of narcotics and several firearms.” John Hunt — the person connecting the two torched properties — was charged with several drug and gun-related offenses.

Given this fact, it would seem investigators might want to start with John Hunt and then work their way outward if that doesn’t pan out. Instead, they’re demanding location info on everyone in the area and then hoping to narrow this list of info down to the person (or people) they already suspect. Yes, it’s always useful to have as much evidence in hand as possible before arresting someone, but that law enforcement desire needs to be weighed against the impact it will have on non-suspects just because they happened to connect to cell towers in the wrong place at the wrong time.

Filed Under: arson, atf, reverse warrants
Companies: google

European Law Enforcement Officials Upset Facebook Is Warning Users Their Devices May Have Been Hacked

Legal Issues

from the screw-the-little-people,-we've-got-bad-guys-to-hack dept

Oh boy. Facebook has just added fuel to the anti-encryption fire. And by doing nothing more than something it should be doing: notifying users that their device may have been compromised by malware.

The Wall Street Journal article covering this standard notification is full of quotes from government officials who aren’t happy a suspected terrorist was informed his phone had possibly been infected by targeted malware. [Non-paywalled version here.]

A team of European law-enforcement officials was hot on the trail of a potential terror plot in October, fearing an attack during Christmas season, when their keyhole into a suspect’s phone went dark.

WhatsApp, Facebook Inc. ’s popular messaging tool, had just notified about 1,400 users—among them the suspected terrorist—that their phones had been hacked by an “advanced cyber actor.” An elite surveillance team was using spyware from NSO Group, an Israeli company, to track the suspect, according to a law-enforcement official overseeing the investigation.

Facebook is no fan of NSO Group. In fact, very few people are fans of NSO Group, other than their customers, which have included UN-blacklisted countries and a number of governments that rank pretty high on the Most Human Rights Violated charts. Facebook sued NSO back in November, making very questionable allegations about CFAA violations. Facebook’s servers were never targeted by NSO’s malware. Only end users were, which makes it pretty difficult for Facebook to claim it has been personally (so to speak) injured by NSO’s actions.

Back to the matter at hand, Facebook didn’t just warn suspected terrorists about detected malware.

WhatsApp’s Oct. 29 message to users warned journalists, activists and government officials that their phones had been compromised, Facebook said. But it also had the unintended consequence of potentially jeopardizing multiple national-security investigations in Western Europe about which Facebook hadn’t been alerted—and about which government agencies can’t formally complain, given their secret nature.

Would these government officials rather have not been warned about threats? Were any of these government officials receiving warnings the same ones now complaining the warning allowed a terrorism suspect to vanish? Maybe so. The one quoted in the article seems very short-sighted.

On the day WhatsApp sent its alert, the official overseeing the terror investigation in Western Europe said, he was stuck in traffic on his way to work when a call came in from Israel. “Have you seen the news? We’ve got a problem,” he said he was told. WhatsApp was notifying suspects whom his team was tracking that their phones had been hacked. “No, that can’t be right. Why would they do that?” the official said he asked his contact, thinking it a joke.

“Why would they do that” indeed. Maybe to protect their users from cybercriminals and state-sponsored hackers. It’s not about allowing suspected criminals to dodge law enforcement, even though it will undoubtedly have that effect. It’s about keeping users and their communications protected — users that include journalists, activists, and government officials.

This response indicates the investigators pursuing the suspected terrorist would rather hundreds of innocent people be harmed than someone suspected of terrorism go free. But it really doesn’t matter what unnamed officials think about Facebook’s “you may have been compromised” notifications or the harm these might do to ongoing investigations. Facebook’s voluntary warnings will soon be mandatory in Europe. By the end of 2020, all service providers and telcos will be obligated to warn customers of security threats.

That fact — and the apparent willingness to allow innocent people to be victimized by targeted attacks — makes the article’s closing statement all the more ridiculous.

Gilles de Kerchove, the European Union’s counterterrorism coordinator, says encryption shouldn’t allow criminals to be “less accountable online than in real life.”

I have no idea what that means. I know what the official thinks it’s supposed to mean — that “online” is bad because sometimes criminals get away — but even that interpretation doesn’t make sense. Criminals discover their phones have been tapped and stop using those lines. Criminals talk to each other in person to avoid creating records of conversations. Criminals get tips from other criminals they’re under surveillance. This stuff just happens. Investigations don’t always run smoothly.

A standard warning about possibly-compromised devices and services is just good business — something that protects everyone who uses the service, not just the people governments think are OK to protect. These warnings are essential and they benefit everyone, not just the people governments want to lock up.

Filed Under: disclosure, europe, hacking, law enforcement, malware, terrorists
Companies: facebook, nso group, whatsapp

Florida Appeals Court Asks State's Top Court To Decide Whether Compelled Password Production Violates The Fifth Amendment

Legal Issues

from the restrictions-may-apply dept

The Florida state Supreme Court is being asked to settle the open question as to whether compelled password production violates the Fifth Amendment. (via FourthAmendment.com)

Last October, a state Appeals Court decided that it did. In a case involving an accident caused by a drunk driver, law enforcement sought to compel the suspect to unlock his phone so they could search it for evidence. It’s unclear what evidence of drunk driving the police hoped to find on the phone, but that’s the case that first made its way to one of the state’s appellate courts.

It all worked out, though. The court ruled that compelling a password is a Fifth Amendment issue because it could force the suspect to hand over evidence to be used against him by prosecutors. Another state appellate court came to the same conclusion earlier this year, ruling that compelling password production to unlock a robbery suspect’s encrypted device violated the Constitution.

In both cases, prosecutors didn’t really care about the password. That’s not what they were after. They wanted what was on the phones, which could be evidence.

It’s a big “could,” though. The state didn’t bring much with it but conclusory arguments which are very much not the same thing as establishing the needed “foregone conclusion.” Without it, the state is seeking to violate the Fifth Amendment, and for the lousiest of reasons.

Below and on appeal, the state’s argument has incorrectly focused on the passcode as the target of the foregone conclusion exception rather than the data shielded by the passcode, arguing that “because the State has established the existence of the passcode and iTunes password, evidence on the Petitioner’s cell phone, and that he can access the content of his phone,” the compelled search was acceptable. Similarly, the trial court specifically held that the “existence, custody, and authenticity of the passcodes are a foregone conclusion” in the order appealed. This holding, which focuses on the passcodes rather than the data behind the wall, misses the mark.

[…]

Without reasonable particularity as to the documents sought behind the passcode wall, the facts of this case “plainly fall outside” of the foregone conclusion exception and amount to a mere fishing expedition.

The Appeals Court that reached this same conclusion in the second case has now certified the question for the state Supreme Court to examine. The short cert petition says it’s up to Supreme Court to set the precedent for the state and resolve the supposed conflicts with prior case law the state argues have been raised by the Appeals Court’s decision.

There’s a dissent attached to the cert petition [PDF] that, weirdly, argues the state’s top court shouldn’t take a look at this because the Appeals Court screwed it up the first time. The majority of judges, however, disagrees with the dissent’s rationale. [Emphasis in the original.]

Despite the narrow focus of the State’s motion, our dissenting colleague presents many pages of arguments—old and new—that amount to a second opinion on the merits. Tellingly, our colleague’s almost exclusive focus is on the Fourth Amendment and probable cause despite no party mentioning either of them in their merits briefs and the State advancing no argument on such matters in its motion for rehearing and certification. And whether the probable cause affidavit (which sought to seize broad categories of information from the cellphone—without identifying any specific item—on the basis that criminals use cellphones) was proper or a fishing expedition matters not; we fail to see how the issuance of a subpoena or warrant—whether careful drawn or a fishing expedition—negates the Fifth Amendment’s protections, which are the focus of this case.

The majority says the dissent’s argument is important, but not quite for the reason the dissent thinks it is.

If anything, the relationship that exists between the Fifth Amendment right against compelled personal disclosures and its neighboring and complementary Fourth Amendment right against unreasonable searches and seizures counsels in favor of protection against governmental overreach into individual autonomy in criminal cases.

The dissent’s argument is basically this: it’s not a “fishing expedition” if cops have a warrant. That’s not how fishing expeditions work and the court should know better. The dissent presents an appeal to its own authority (the judicial system at large), which is about the most worthless argument it could make.

The State did not merely issue a subpoena for Pollard’s phone with a hunch that it might provide incriminating information. Rather, the State introduced evidence showing, to a magistrate’s satisfaction, that probable cause existed that Pollard’s phone contained evidence of a crime. This evidence was what they sought, not the passcode that is the subject of this petition.

Ah, the old “magistrates always read warrant applications thoroughly” argument. In this case, there’s a bit more to it: an admission by a co-defendant that the crime was planned via text message. At least that’s something. The case this Appeals Court cited to come to its conclusion dealt with drunk driving — a crime that doesn’t seem to have anything to do with a phone’s contents.

The state’s Supreme Court will have the final say. For now, Florida is (mostly) covered by decisions that say compelling passwords is a Fifth Amendment violation. Whatever the state’s top court decides will be appealed by the losing party, moving it to the federal level. And everything sitting unresolved at the federal level eventually moves to the top court in the land. So, at some point, we’ll probably have a nationwide ruling on compelled password production, for better or worse. For now, the Fifth Amendment protections have an asterisk attached. Successful invocation may only apply locally.

Filed Under: 5th amendment, compelled password, florida, passwords, speech

Because Body Cameras Haven't Made Cops Better, Two Law Enforcement Agencies Are Going To Start Random Inspections Of Footage

(Mis)Uses of Technology

from the will-this-do,-they-inaudibly-asked dept

Body cameras were supposed to bring more transparency and accountability to law enforcement agencies. The change that was promised hasn’t arrived. Body camera footage does little for the public. Every so often, it results in a successful lawsuit and/or prosecution.

What body camera footage does best is what cops do best: lock people up. Prosecutors are making the most of recordings, using them as evidence against criminal suspects.

When the idea of watching the police first started gaining traction, officials and politicians opposed to anything that might make cops more accountable claimed the recordings were nothing but a “gotcha” tactic. In their minds, someone would be reviewing all recorded footage every day, just waiting for a cop to screw up.

This was a stupid stance to take. Not only was this fantasy logistically impossible, but there’s hardly anyone inside law enforcement agencies all that interested in punishing officers, even when they’ve screwed up. What has actually happened is the millions of hours of footage recorded every day is uploaded and forgotten about until someone needs it. It usually takes a lawsuit to get this footage released, or at least the threat of one. Defense attorneys looking for footage to defend their clients must subject themselves to a variety of third-party user agreements before they’re allowed to see anything.

Since the police aren’t going to police themselves — not even with a slew of new self-policing tools — accountability and transparency must be forced on agencies by other government entities. But this has been very slow in developing. And what we’re being given can’t even generously be called a half-measure.

One (ONE!) law enforcement agency in Indiana has agreed to random inspections of body camera footage. The agreement is the result of the shooting of a black man by white police officers. No footage exists of this incident, despite the fact the officer who shot the man had a cruiser equipped with a dash cam and was wearing a body camera.

The new inspection rules are incredibly lax, pretty much ensuring no South Bend cop will ever be the “victim” of this barely-there “gotcha tactic.”

The new requirements call for sergeants to randomly sample at least five videos each month from officers they supervise, and to review at least 15 minutes of footage from each subordinate three or more times per year. The sergeants are to check for discrepancies between the videos and officers’ reports, and to pass positive and negative findings up the chain of command.

Wow, up to 45 minutes a YEAR! Yeah, that’s going to turn things around, restore the public’s trust, etc. Considering how much footage is generated on a yearly basis, the chance of randomly pulling a culpatory needle from this haystack begins to approach zero almost immediately.

This new measure — instituted in the wake of the unrecorded shooting — will do more to increase accountability than the random inspection policy.

Another new provision requires an officer, before stopping a recording, to speak into the device with the reason.

This won’t prevent abuse but it will at least stump officers who can’t come up with a legit excuse in the heat of the moment. There are lots of excuses made about how it’s impossible to turn on a camera when in the middle of police stuff. Now, officers will have to come up with something believable when they decide they don’t want to record an interaction. Unfortunately, it won’t force officers to turn on their cameras first, which is still going to be a problem going forward.

Only one other city has announced a random inspection plan. That would be Los Angeles, home to one of the largest police forces in the nation. The local union actually agreed to this, so the inspection program has been weakened to its satisfaction. The inspection program — first reported by the LA Times — doesn’t provide any details as to how much footage is reviewed or how often. But it does show why the union agreed to it.

Chief Michel Moore told the Board of Police Commissioners on Tuesday that he reached an agreement with the Los Angeles Police Protective League, the union that represents rank-and-file cops, to inspect recordings that don’t involve arrests or the use of force.

The inspections will allow supervisors to determine whether some officers need additional training or counseling to prevent instances of biased policing, Moore said. Supervisors will make sure officers aren’t rude and that they explain their actions when stopping people, he said.

This may help community relations but it won’t stop excessive force deployments or ill-advised shootings. Arrests and use of force incidents are exempted from this random inspection program, which means it’s not all that random and it’s not all that useful.

Despite the limitations, the program has already caught one officer who engaged in an extremely depraved act while responding to a call.

A Los Angeles police officer is under investigation after a random review of body camera footage showed him fondling a dead woman’s breasts, according to a person briefed on the incident.

The Los Angeles Police Department officer and a partner had responded to a report of a body at a residence, the person said. The officer fondled the corpse’s breasts when his partner was not in the room.

The officer has not been named, which is par for the course when it comes to “accountability.” The union has already expressed its displeasure with the officer’s actions, which only means fondling corpses is one of the few misdeeds it won’t publicly support.

The officer shut off his body camera before fondling the dead woman, but the rolling buffer engaged two minutes before the officer turned his camera back on, capturing him in mid-fondle.

These are very minimal efforts that barely deserve to be called “efforts.” This is what we’re being given in exchange for our tax dollars and the vast amount of power we, as a society, have entrusted law enforcement with. Sorry, chief(s), this ain’t it. Do better.

Filed Under: body cameras, police, random inspections

Ring Sued Because 'Taking Customers' Security Seriously' Means Selling Easily-Hijacked Cameras

Legal Issues

from the DUMPSTER-FIRE-2019-???? dept

Amazon’s Ring has been uniformly terrible ever since it decided its primary market (homeowners) should be treated with less care and concern than the market it’s actually courting and subsidizing (law enforcement agencies).

Since it’s not really in the customer service business anymore, the end users who thought they were buying some security and peace of mind have discovered they’ve actually become part of a law enforcement surveillance network run by a company that doesn’t really seem to be in the security business.

A group of forum members found Ring cameras incredibly easy to hijack. Running scripts utilizing lists of credentials harvested from the web’s many security breaches, some sociopathic idiots were able to brute force their way into taking control of devices. Their favorites were the ones equipped with mics, where they could verbally abuse and taunt unsuspecting Ring owners for the enjoyment of their podcast audience. (I really wish I were making that last part up but this is the internet we have.)

When the news cycle of “hacked” Ring cameras began, Ring was quick to point out this wasn’t its fault. To a certain point, Ring is right. Ring says it encourages the use of two-factor authentication and strong passwords. Great. So do lots of IoT device makers. But very few are actually forcing their users to engage two-factor authentication prior to allowing the connected device to go “live” on the web. Ring isn’t doing this either.

It’s even worse in Ring’s case. Ring says it’s the customers that are wrong, but it does absolutely nothing to prevent this sort of hijacking. There’s no lockout after a certain number of failed logins. No warnings are sent to owners about logins from unrecognized devices or IP addresses. Repeated failed login attempts aren’t flagged as suspicious. For a company supposedly in the security business, this is a pretty insecure way to run a business.

It’s this latest insecurity that’s getting the company sued.

Amazon and its home security subsidiary Ring are facing a federal lawsuit in California over allegations that its “lax security standards” led to a series of invasive and frightening hacks over the past year.

The lawsuit, which alleges Ring security cameras have been hacked six times across the U.S., comes as Amazon’s Ring faces a barrage of scrutiny from lawmakers, privacy advocates and the public over its cybersecurity standards and widespread partnerships with local police departments.

The lawsuit [PDF], filed by a victim of just such a “hacking” hopes to become a class action when it’s all grown up and fully-represented. Until then, there’s this incident, which happened to the plaintiff.

Plaintiff John Baker Orange is a resident of Jefferson County Alabama. He purchased a Ring outdoor camera for his house in July 2019 for approximately $249.00. The Ring camera was installed over his garage with a view of the driveway. Mr. Orange purchased the Ring camera to provide additional security for him and his family which include his wife and three children aged 7, 9, and 10. Recently, Mr. Orange’s children were playing basketball when a voice came on through the camera’s two-way speaker system. An unknown person engaged with Mr. Orange’s children commenting on their basketball play and encouraging them to get closer to the camera. Once Mr. Orange learned of the incident, he changed the password on the Ring camera and enabled two-factor authentication. Prior to changing his password, Mr. Orange protected his Ring camera with a medium-strong password.

Orange alleges that Ring did almost nothing to protect its customers while promising its products will protect its customers.

Unfortunately, Ring does not fulfill its core promise of providing privacy and security for its customers, as its camera systems are fatally flawed. The Ring system is Wi-Fi enabled, meaning that it will not work without internet connectivity. Once connected, however, any internet device can be seen by the on-line community, making it incumbent upon its manufacturer to design the device such that it can be properly secured for only intended use. This obligation is even more critical in instances where the device, like the Ring camera, is related to the safety and security of person and property.

Ring failed to meet this most basic obligation by not ensuring its Wi-Fi enabled cameras were protected against cyber-attack. Notably, Ring only required users enter a basic password and did not offer or did not compel two-factor authentication.

He’s not wrong. Security is pretty much an afterthought for this security company. It likes to put its resources into pitching its products to cops, who can then hand the flawed products to citizens in exchange for possible glimpses of camera recordings in the future.

But is it enough to win a lawsuit? The plaintiff alleges negligence and a few other related torts, but he’ll have to prove Ring deliberately sold a product it knew was insecure. Ring is probably aware of the lack of built-in security, but is it more deliberately negligent than any other IoT device maker that decides to dumb down security options to increase adoption and marketshare? And if it’s just as terrible as its competitors, should that be enough to allow it to escape a lawsuit?

Maybe this one will hit Ring hard and force it and its competitors in the IoT marketplace to actually take the security of their customers seriously, rather than just saying that after their customers have already been compromised. Or maybe I just want Ring to get smacked around for pushing an insecure product on consumers with the assistance of over 600 law enforcement agencies. Ring has been an absentee landlord in its market, grabbing all the market share it can while leaving its millions of customers to fend for themselves when it comes to securing their devices properly.

Filed Under: doorbells, iot, lawsuit, ring, security
Companies: amazon, ring

Twitter Blocks Animated PNGs After A Bunch Of Shitbirds Spend National Epilepsy Month Harassing Epileptics

(Mis)Uses of Technology

from the you'll-never-go-broke-underestimating-the-quality-of-humans-on-the-internet dept

Assaulting someone with a tweet can be a criminal act. It takes a whole lot of specifics to make it a crime, but some asshole named John Rivello managed to do just that when he sent strobe gifs to Kurt Eichenwald and apparently sent him into a seizure.

Rivello did all of this under the horrible (and stupid) alias of @jew_goldstein. He also left behind a nice digital paper trial for investigators, which tied the account he used to send the strobe gifs to Eichenwald. Rivello may have used a Tracfone card to set up the accounts he used to harass Eichenwald, but these were all linked to his iPhone and his iCloud account, which helpfully included a photo of Rivello holding up his drivers license.

On top of that, investigators found a bunch of DMs to other Twitter accounts stating his intent to send Eichenwald into a seizure in hopes of killing him. So, it can be a crime to send strobe gifs to epileptics, but it takes a whole lot of work to make it a chargeable offense.

The Epilepsy Foundation is hoping law enforcement can find similar statements of intent elsewhere. During National Epilepsy Month, a bunch of people who are using far more oxygen than they deserve sent out hundreds of tweets containing strobe gifs and videos, utilizing the Foundation’s Twitter handle and related hashtags. The Foundation points out that only a small percentage of epileptics are photosensitive, but any triggered seizure can carry the risk of serious injury or death.

The Foundation’s post doesn’t say where these complaints have been filed or provide any other details. It obviously poses some First Amendment issues in that it’s asking for the prosecution of speech, but if there’s enough evidence indicating some of these dirtbags were actively seeking to harm other people, First Amendment concerns will be minimal.

This brings us to another attack vector, albeit one that wasn’t used in these attacks: animated PNGs. These series of images stitched together to form an animated whole would allow harassers to route around protections photosensitive epileptics used to protect themselves, like preventing autoplay of video or gif content. Twitter may not be able to do much to prevent the uploading of video and gifs containing strobe images, but it can block APNGs, which is what it is now doing.

Twitter is banning animated PNG image files (APNGs) from its platform, after an attack on the Epilepsy Foundation’s Twitter account sent out similar animated images that could potentially cause seizures in photosensitive people.

Twitter discovered a bug that allowed users to bypass its autoplay settings, and allow several animated images in a single tweet using the APNG file format.

The APNG bug has been exploited in the past, mainly to animate avatars. It apparently was not used to target epileptics during this particularly nasty exhibition of human nature, but degenerates who may have considered it a future option no longer have this exploit to work with.

No doubt someone with too much time and not enough moral fiber will find some other way to attempt to provoke seizures using nothing more than 1s and 0s, but for now, the most popular options are either closed off by built-in options or Twitter’s brand new APNG blockade.

Filed Under: animated pngs, epilepsy, harassment, trolling
Companies: twitter

There Is No 'Going Dark:' Always-On Surveillance Posing Risks To US Covert Operations

(Mis)Uses of Technology

from the it's-so-dark-we-can-barely-hide-anyone-in-here dept

The FBI and DOJ like to complain everything is “going dark.” It isn’t. The only thing that’s still dark here is the FBI’s FISA powers and the true number of encrypted devices in the FBI’s possession.

It’s the Golden Age of Surveillance. The FBI knows this. The FBI knows this because the federal government as a whole knows this. There is no “going dark.” And that’s going to hurt the government almost as much as its going to hurt its citizens.

A long report by Jenna McLaughlin and Zach Dorfman details the government’s worries about the seeming impossibility of maintaining its own darkness. Between state-sponsored attacks on government databases and the omnipresence of surveillance equipment around the world, it’s exceedingly difficult to call anything “covert.”

The OPM hack is only the tip of the exposure iceberg. But what a magnificent tip it is.

In one previously unreported incident, around the time of the OPM hack, senior intelligence officials realized that the Kremlin was quickly able to identify new CIA officers in the U.S. Embassy in Moscow — likely based on the differences in pay between diplomats, details on past service in “hardship” posts, speedy promotions and other digital clues, say four former intelligence officials.

Foreign operatives are safer at home and not just for the obvious reason. For all the surveillance creep this country has experienced following the 9/11 attacks in 2001, it still lags far, far behind the efforts deployed elsewhere in the world. The Department of Defense warned against self-inflicted privacy wounds when it sent a letter to service members warning them of the risk of over-the-counter DNA testing kits. But what can the government do to protect the identities of foreign agents who are under constant surveillance the moment they set foot in another country?

Those concerns spread to other places, like London, where CCTV cameras are omnipresent, and the United Arab Emirates, where facial recognition is ubiquitous at the airport. Today there are “about 30 countries” where CIA officers are no longer followed on the way to meetings because local governments no longer see the need, given that surveillance in those countries is so pervasive…

The DHS wants biometric scanning at every airport. Despite recent setbacks, it hasn’t lost its desire to add American citizens and US residents to the list of people facing mandatory biometric collection every time they fly. Maybe it just wants to be on even footing with the rest of the world.

Even with the expansion of biometric surveillance, the CIA has ways of working around this. For years, the CIA has formed partnerships with foreign governments that allow the CIA to access the passport system to track people it wants to track while simultaneously allowing it to manipulate the system to “insert” operatives into countries without being hassled by customs officials or being tracked by airport security surveillance systems.

So ubiquitous are cameras and other surveillance efforts in other countries, spies are bringing back the old ways. If everything leaves a digital footprint, perhaps the solution is to stop leaving footprints.

By the early 2010s, Chinese intelligence operatives started adopting old-school Russian-style tradecraft, like dead drops in the woods or “brush passes,” which involve surreptitiously exchanging objects in a public place, says one former senior intelligence official. “It was unheard of for the Chinese,” says this person. “The conclusion was that they felt the world was too digital and traceable.”

Spies are also taking their business to new countries — formerly seldom-used locations where surveillance isn’t as pervasive. Operations still need to be carried out in the country they’re targeting, but meeting with sources can take place anywhere. Anywhere with fewer cameras, biometric scanners, and government control of travel-related businesses is a plus.

Entire programs meant to make covert operations function in the digital age feasible have been scrapped. One effort died on the vine, starved to death by CIA resistance and chronic under-funding. Another program tasked with giving FBI agents credible backstories suffered the same fate: choked to death by red tape and apparently compromised by the sloppiness of the same agents and sources it was put in place to protect.

But it’s not all bad news — at least not for the government. Citizens have no (legal) access to these amenities, but the government has all kinds of “backdoors” in systems to try to prevent covert operatives from being immediately discovered.

By midway through the Obama administration, the CIA and FBI were creating “extensive digital legends with increasing sophistication,” as one former senior official puts it, with cooperation from key government agencies like the Social Security Administration, Health and Human Services and the IRS.

U.S. intelligence agencies also work with “friendly digital companies,” like commercially available ancestry databases, to alter personally identifying information, say former officials, and also backdate work histories.

This is how spy craft works now. Everything is online, digitized, and likely to be accessed by agents of enemy states. There’s no flying under the digital radar. And if it’s true for government employees, it’s doubly true for US citizens who don’t have the ability to alter/remove collected data or a network of security professionals doing whatever they can to protect them (and their data) from outsiders.

If the FBI (and others) are making this much effort to shield covert personnel from a panopticon constructed by government entities and private companies, it can’t honestly say criminals have the upper hand just because of device encryption.

Filed Under: always on surveillance, covert operators, espionage, going dark, surveillance

Russia Disconnects Itself From The Internet, Asks UN To Let It Have More Control Of Internet Usage Around The World

(Mis)Uses of Technology

from the hey-if-it's-good-enough-for-state-sponsored-cybercriminals... dept

The Russian government has successfully disconnected itself from the world. “Internet sovereignty” is the term the government prefers. That’s what the Russian government actually calls the law signed into effect in May.

The idea is to isolate the Russian internet from the internet the rest of the world uses. It’s not to protect Russia or Russian internet users. It’s to force all Russian internet traffic through Roskomnadzor servers, which will allow the government to surveil its citizens’ internet use, presumably to facilitate censorship efforts and prosecutions.

Lots of experts doubted the plan was feasible. At best, it would subject all Russian internet traffic to government surveillance. At worst, it would cause critical systems to fail. The plan was to pull the plug in April. It didn’t happen until December. According to the Russian government, this extreme Balkanization of the internet went off without a hitch.

“It turned out that, in general, that both authorities and telecom operators are ready to effectively respond to possible risks and threats and ensure the functioning of the Internet and the unified telecommunication network in Russia,” said Alexei Sokolov, deputy head of the Ministry of Digital Development, Communications and Mass Media, as cited by multiple Russian news agencies [1, 2, 3, 4].

That’s the only source we have, so trusting this narrative means trusting the Russian government — a government that is claiming it’s essential to seal off its internet to protect it from threats when all it really wants to do is control narratives, perform mass censorship, and hunt down citizens who color outside the lines.

Russia wants to make its policy an everywhere policy. Its proposal — currently being considered by the United Nations — pushes for more internet sovereignty everywhere. Again, this tool of censorship and control is being portrayed as an anti-cybercrime tool meant to secure nations, rather than censor citizens.

It seems harmless enough in Newspeak:

The representative of the Russian Federation, presenting the draft, said cybercrime threatens entire sectors and is a crucial national security priority. Despite the importance of the issue, there is a lack of an instrument to tackle it, and until last year’s resolution 73/187, the General Assembly had not addressed the need for a unified conceptual framework. While inclusive international dialogue has commenced, its geographic scope is “limited”, and there is a clear need to bolster international cooperation, he said. Stating that the draft complements similar initiatives — including the United Nations Convention against Transnational Organized Crime — he said it must also take on board work done by the Expert Group to Conduct a Comprehensive Study on Cybercrime in Vienna. He pointed out that the draft resolution “does not cost much, at less than $200,000”, and fosters a more just, balanced world order in the digital sphere by ending “club-based” agreements.

A draft of this proposal [PDF] has already been approved by the UN. Maybe the UN should have looked a little closer at the parties behind the proposal — all of which already engage in strict control of internet services and engage in mass censorship.

Belarus, Cambodia, China, Democratic People’s Republic of Korea, Myanmar, Nicaragua, Russian Federation and Venezuela

The proposal says things about “cooperation,” but the only cooperation being asked for is assistance in making it easier to run country-specific versions of the internet.

The resolution — Countering The Use Of Information And Communications Technologies For Criminal Purposes — would create a new cybercrime treaty written by Russia, a country analysts have said is cracking down on Internet freedom at home to stifle opposition to the Kremlin.

“The Russians clearly are interested in pushing their vision of what the Internet should look like in the future, and that’s conflating this idea of cybercrime with cybersecurity and cyber controls,” a State Department official told media on December 19.

Russia wants “a form of lockdown on information” over the Internet and a “curtailment of those freedoms” that the United States stands for, the State Department official said.

There’s also the attendant irony of Russia leading the fight against misinformation and the use of the internet for criminal purposes. The countries in agreement on this proposal routinely engage in state-sponsored attacks on foreign government entities and Russia is internationally infamous for its interference in the last US presidential election. Russia wants all the best foxes to guard the internet hen house. That the draft passed with plenty of support indicates the world is loaded with foxes who see only an upside to taking control of the internet their citizens have access to.

Filed Under: censorship, control, internet, russia, splinternet, surveillance, un

Court (Barely) Allows Class Action Lawsuit Over Google's Location Tracking To Move Forward

Legal Issues

from the tough-to-cry-'foul'-when-you're-opting-in dept

A 2018 lawsuit [PDF] against Google over location tracking survives, but only just. The lawsuit — filed after a report showed Google was still collecting location data even after users shut off location services on Android phones — alleges Google violated California laws and privacy protections by tracking users (including children) after it had been told not to.

The lawsuit has been dismissed [PDF], but the court is giving the plaintiffs a chance to amend the lawsuit and suggesting there are issues the court alone can’t decide. (via FourthAmendment.com)

The plaintiffs allege they were led to believe Google would no longer collect and store location data when “Location History” was shut off. They cite Google’s own support page, which (formerly) stated “With Location History off, the places you go are no longer stored.” The court says this language could have misled users, no matter what Google’s Privacy Policies and Terms of Services actually said about location data.

Drawing all inferences in favor of Plaintiffs, a reasonable user could believe that disabling Location History prevented Defendant from collecting and storing geolocation data. This conclusion is bolstered by the fact that many people were mislead by the effect of disabling Location History. See, e.g., Compl. ¶ 4. Moreover, the support page Defendant points the Court to was created after this litigation had already commenced. At the time Plaintiffs’ original complaints were filed, the page described Web & App Activity as merely a means to “[s]ave your search activity on apps and in browsers to make searches faster.” Id., Ex. 28. The page did not expressly state that geolocation data may be collected.

Google argues that users consent to sending location info to Google when using some of its services. That may be, but the court points out people agreeing to send some data to Google when using products like Google Maps is not the same thing as granting Google permission to store that data indefinitely. No good, says the court.

The Court thus rejects Defendant’s contention that by consenting to transitory use, Plaintiffs consented to geolocation collection. To the contrary, it is plausible that Plaintiffs gave a narrow consent to geolocation tracking, exclusive of data storage.

Either way, it’s probably not going to be settled at this stage of litigation, which is already in its sixteenth month.

It is plausible that Plaintiffs only consented to transitory use tracking and revoked any consent to the storage of their geolocation history. It is also plausible that they did not revoke such consent. The Court cannot conclude either way—factual disputes remain. “This is an issue for the jury.” Opperman, 205 F. Supp.3d at 1073 (holding that the plaintiffs produced sufficient evidence showing they did not consent to the defendants’ actions). For these reasons, the Court holds Plaintiffs have plead sufficient facts to show they did not consent to the storage of their geolocation information

The court does dismiss the plaintiffs’ CIPA (California Invasion of Privacy Act) claims. By conceding they gave Google permission to collect location data when using Maps or checking “showtimes for movies playing nearby,” the litigants have undercut this claim.

Hence, Plaintiffs issue is not with Defendant tracking them during application use, rather their issue is with the storage of that data. See Opp. at 3–4 (“[I]n accepting the transitory use of location information for an immediate, discrete purpose, Plaintiffs in no way consented to indefinite storage of their daily locations and movements . . . .”). For this reason, Plaintiffs’ CIPA claim fails as a matter of law because CIPA, by its plain terms, is not concerned with data storage but focuses on unconsented data tracking, which is not at issue.

That claim is dismissed with prejudice as the court sees no way the plaintiffs can amend this particular claim to make it actionable.

The California-based invasion of privacy claim fails as well, but not as badly. Invasion of privacy claims are Fourth Amendment-related, but the court sees nothing in Google’s actions that could possibly be a Fourth Amendment issue, even with recent Supreme Court decisions expanding citizens’ expectations of privacy.

Plaintiffs contend that Defendant’s surreptitious collection and storage of comprehensive and highly sensitive location data violates their information privacy rights. Opp. at 15. Even if the collection of granular and specific location data establishes an information privacy interest, Plaintiffs’ theory is undercut by the admission that Defendant only tracked and collected data during use of Google services. Accordingly, Defendant’s “profile” of a user is only as specific as their use of Google services. Carpenter v. United States and United States v. Jones do not undercut this conclusion.

What Google collected was far less than what the plaintiffs’ cellphone providers collected, and yet, the lawsuit only alleges a violation by Google.

First, there was no claim that MetroPCS and Sprint, the phone companies holding the cell-site location information, violated the plaintiff’s right of privacy by having such robust geolocation records. Id. at 2212. The case thus does not stand for the proposition that geolocation collection violates the right of privacy.

Second, the cell-site location information discussed in Carpenter was comprehensive—the cell-site location information provided cellular companies with a rough “map” of a customer’s fluid movements. Id. at 2211. Such comprehensive data collection is not at issue here; Plaintiffs’ geolocation information depends on how often they use Google’s services. Defendant’s collection of geolocation data is not automatic; it does not happen by the routine “pinging” of a cell-phone tower.

[…]

Here, unlike the continual GPS tracking in Jones, not all of Plaintiffs movements were being collected, only specific movements or locations. Such “bits and pieces” do not meet the standard of privacy established in Carpenter or Jones.

This allegation is being allowed to move forward, though. But it probably won’t live on for long if the plaintiffs can’t find something more specific to allege than a theoretical “mosaic” of the plaintiffs’ movements, which possibly included visits to “sensitive or confidential locations.”

It’s not that Google is in the right if it misled phone users into thinking they weren’t being tracked when they were being tracked. It’s also not right just because cellphone service providers track location almost continuously. But if the claim is that Google collected users’ location data when users utilized services they knew would send that data to Google, then the lawsuit should fail.

Filed Under: class action, location history, location tracking
Companies: google