Thailand Decides To Make Its Terrible Cybersecurity Law Even Worse

Legal Issues

from the this-baby-can-hold-so-many-domestic-surveillance-programs dept

More censorship and encryption-breaking is on the way, thanks to the Thai government’s broad interpretation of the term “cybersecurity.” The government has been leaning heavily on American social media companies to disappear content critical of… you guessed it, the government. To keep the king from being insulted too often (or for too long), the government is also exploring undermining website encryption and holding service providers directly (and criminally) responsible for the words and deeds of their users.

Another round of amendments has made Thailand’s cybersecurity law worse. It seems almost impossible, given its history. And yet here we are, watching as the government gives itself everything it wants, leaving citizens with the dubious privilege of generating tons of data the government can access at will.

The bill (available in Thai) was amended late last year following criticism over potential data access, but it passed the country’s parliament with 133 positives votes and no rejections, although there were 16 absentees.

There are concerns around a number of clauses, chiefly the potential for the government — which came to power via a military coup in 2014 — to search and seize data and equipment in cases that are deemed issues of national emergency. That could enable internet traffic monitoring and access to private data, including communications, without a court order.

Naturally, everyone but the government is concerned about these amendments. The Asia Internet Coalition has issued a statement expressing these concerns. All of its concerns are valid. And, considering the history of this law and this government, all are likely to be ignored.

The bugs listed in the AIC’s statement are considered features by a government that has a long history of silencing dissent and jailing critics.

Protecting online security is a top priority; however, the Law’s ambiguously defined scope, vague language and lack of safeguards raises serious privacy concerns for both individuals and businesses, especially provisions that allow overreaching authority to search and seize data and electronic equipment without proper legal oversight. This would give the regime sweeping powers to monitor online traffic in the name of an emergency or as a preventive measure, potentially compromising private and corporate data.

Vague language and a lack of safeguards. Overreaching authority and lack of oversight. That’s exactly what the Thai government wants. This is deliberate. This is what’s wanted by governments all over the world. The US government wants this. So does the Australian government. The UK government has spent most of the past decade refining its overreach and scaling back its oversight.

This isn’t just a Thai problem. It’s a government problem. But the Thai problem is made worse by its disturbing (and ancient) lese majeste laws, which add some old school twists to its cyber pretensions. But the script is otherwise identical: the same ideas pushed by other governments, using the same “security” pitch to strip citizens of their protections and privacy.

Filed Under: censorship, cybersecurity, encryption, thailand

Court Says Lawsuit Over Fake Subpoenas Issued By Louisiana DA's Office Can Proceed

Legal Issues

from the fake-it-til-you-break-it dept

There’s a very slim chance some New Orleans prosecutors might have to pay for their threats and lies. But a slim chance is better than none. The Orleans Parish DA’s office was caught using fake subpoenas to coerce cooperation from witnesses and victims of crimes — a practice it had engaged in for decades before being hit with multiple complaints and lawsuits.

Prosecutors sent out bogus subpoenas — all bearing the threats of fines and imprisonment — to hundreds of witnesses over the past several years. None of these were approved by courts overseeing ongoing prosecutions. None of the subpoenas were issued by the Clerk of Courts. The DA’s office was simply cranking out fake subpoenas and hoping recipients would be too intimidated by the threat of jail time to question the veracity of the documents.

Lawsuits followed the public exposure of this underhanded tactic. One of the lawsuits, filed by a number of crime victims who’d been served the bogus subpoenas, has received the green light to proceed from a federal court in Louisiana. (h/t CJ Ciaramella)

Unfortunately, there’s a ton of hurdles that need to be overcome by the plaintiffs. If you think qualified immunity shields too much official wrongdoing, just wait until you run up against absolute immunity, which tends to protect those operating above law enforcement’s pay grade: prosecutors and judges.

Fortunately for the plaintiffs, the crap the DA’s office pulled with its fake subpoenas is shady enough to strip away some of this protective layer. As the court notes in its opinion [PDF], the DA’s office has never had the power to issue its own subpoenas. That it has been doing exactly this is a serious problem.

Allegations that the Individual Defendants purported to subpoena witnesses without court approval, therefore, describe more than a mere procedural error or expansion of authority. Rather, they describe the usurpation of the power of another branch of government.

“Ends justifies the means” is rarely a successful defense. But that’s what the DA’s office has offered. The judge rejects it:

Furthermore, that the alleged activity by the Individual Defendants took place as a means to a prosecutorial end is not dispositive of the issue. Under that logic, virtually all activity engaged in by a prosecutor would be absolutely immune from civil liability.

And with that, one layer of immunity disappears.

This Court finds that granting the Individual Defendants absolute immunity for allegations of systematic fraud that bypassed a court meant to check powerful prosecutors would not protect the proper functioning of a district attorney’s office. It would instead grant prosecutors a license to bypass the most basic legal checks on their authority. The law does not grant prosecutors such a license.

Unfortunately, the prosecutors are covered by absolute immunity for threatening witnesses with arrest to ensure they gave testimony or attended hearings. As screwed up as this sounds, victims of crimes can be thrown in jail to make sure prosecutors can speak to them. Totally legal. All just part of our judicial sympathy for zealous prosecutions. Threatening someone with jail time in person is perfectly fine. It’s only the use of fake paperwork — and bypassing the court system — that’s not protected.

Although the distinction is an admittedly fine one, threatening to imprison a witness to compel cooperation in a criminal prosecution while possessing the lawful means to follow through on that threat is not the same as manufacturing documents in violation of the lawful process for obtaining court-approved subpoenas for witnesses. Threatening witnesses—particularly verbally—with imprisonment to further witness cooperation in an active criminal prosecution seems to this Court to fall into the category of “pursuing a criminal prosecution” as an “advocate for the state.” Holding that such conduct fell outside the protections of absolute immunity would, in fact, potentially subject prosecutors to civil liability for exercising authority they lawfully possess under the law of Louisiana and many other states.

Just as unfortunately, the same behavior the court found couldn’t be protected by absolute immunity can be shielded by qualified immunity, at least as far as the plaintiffs’ violation of due process claims.

Plaintiffs’ allegations that prosecutors manufactured “subpoenas,” deliberately side-stepping judicial oversight of the subpoena process, appears to this Court to represent a breed of official misconduct. Claims that the practice was not only condoned but directed by top prosecutors and the DA himself only make the allegations more disturbing. This Court believes that Plaintiffs’ claims sufficiently shock the conscience such that they allege a constitutional violation.

Nevertheless, the Individual Defendants are entitled to qualified immunity on these claims. Plaintiffs fail to cite to any case law suggesting that the Defendants’ violated a clearly established right of Plaintiffs.

The court clearly thinks the manufacture of subpoenas is reprehensible, but can’t find precedent to make it stick. And since it can’t craft a bright line itself, prosecutors can continue to abuse subpoenas until a higher court decides enough abuse is enough.

A few more claims survive the layers of protective immunity. Four plaintiffs are able to show at this point that the DA’s office also fudged the truth on “material witness” warrant affidavits. A few plaintiffs can also move ahead with First Amendment claims — allegations that the combination of fake subpoenas and actual material witness arrest warrants resulted in compelled speech: testimony extracted by prosecutors using these tools as leverage. Those claims will move forward along with the narrowed allegations of abuse of process the court said can’t be shielded by absolute immunity.

It’s a very limited win for some of the plaintiffs. And it’s not even a real victory yet. This opinion allows certain claims to move forward and removes a little immunity. It gives the plaintiffs a small chance to hold some of the Orleans Parish DA’s Office personally responsible for abusing the court system and the public’s trust for decades.

Filed Under: fake subpoenas, louisiana, new orleans, orleans parish da, prosecutors

California Supreme Court Rejects Second Attempt By Cops To Jump The Judicial Queue Over Police Misconduct Records

Legal Issues

from the back-of-the-line,-buddy dept

California cops hoping to hide their past misdeeds from the public are going to have to get by without the help of the state’s highest court. A new law went into effect January 1st, opening up police misconduct records to the public for the first time in the state’s history.

With few exceptions, law enforcement’s response has been to pretend the law’s reach doesn’t extend retroactively. This runs contrary to the intent of the law as clarified directly to the courts and the state attorney general’s office by the law’s author, Senator Nancy Skinner.

Several lawsuits have been filed — some by records requesters and some by law enforcement agencies. Both are seeking a declaration from the courts that their side is the right side. So far, two state courts have sided with requesters, stating that the law is retroactive.

Just after the law took effect, the Sheriff’s Employees’ Benefit Association petitioned the state supreme court directly, asking for a ruling on the law’s reach. This request was denied by the court without comment, suggesting the state’s top court was happy to let the lower courts handle this determination.

For a second time, the state supreme court has rejected a premature examination of the law. Scott Shackford at Reason has more details:

After a Los Angeles Superior Court judge ruled against unions for the Los Angeles County Sheriff’s Department and the Los Angeles Police Department, one union asked the state Supreme Court to weigh in. On Wednesday, the high court declined, leaving in place the lower court’s decision.

The court rejected this request without comment, wordlessly reiterating its stance on the issue: let the court system do its work and stop trying to jump the turnstile. The next step for disappointed fans of opacity are the states’ appeals courts, not the one at the top of the judicial food chain.

From what we’ve seen so far, it seems unlikely the uniformed anti-transparency activists will prevail. The two courts to return rulings have stated the law affects pre-2019 police misconduct records. The state attorney general’s deliberate obtuseness hasn’t budged the judicial needle. Eventually — but hopefully sooner than later — public records requesters will have a clear answer and complete access to records detailing the impropriety and abuse their tax dollars have paid for.

Filed Under: california, police misconduct, police records, transparency

Clapper Continues To Pretend He Didn't Lie To Congress About Domestic Surveillance Programs

Say That Again

from the six-years-of-deflection dept

James Clapper is going to take his Section 215 lie to his grave. One day after the first Snowden leak exposed the breadth of the NSA’s phone metadata program, Sen. Ron Wyden asked the then-Director of National Intelligence if the agency collected data on Americans. Despite published documents clearly showing otherwise, Clapper went with this answer:

Wyden: Does the NSA collect any type of data at all on millions or hundreds of millions of Americans?

Clapper: No sir.

Wyden: It does not?

Clapper: Not wittingly. There are cases where they could, inadvertently perhaps, collect—but not wittingly.

Since everyone clearly knew he was lying, Clapper spent the next several days claiming he wasn’t. First, he said he meant the NSA wasn’t “voyeurestically” reading everyone’s emails. Good, but not what Wyden asked. Then he said it was the only response he could give to Wyden’s “when did you stop beating your wife” question. Then he claimed he thought Wyden was asking about another collection entirely: the foreign-facing Section 702 program (which does, inadvertently, collect a lot of US person data/communications).

This is the legacy Clapper has secured for himself. He won’t be remembered for his IC leadership or his post-IC career talking headmanship. Nope, it will be his super-weak, super-transparent lie, delivered to a US Senator against a backdrop of leaked documents showing the NSA did “wittingly” collect data on hundreds of millions of Americans.

Nearly six years later, Clapper is telling the same story to anyone who asks him about this hearing, ensuring the word “Clapper” and “lie” will remain inseparable. The Section 215 program Clapper was alluding to — the program exposed in the first Snowden leak — is back in the news, thanks to an unexpected early retirement.

In an interview with CNN about the surprise Section 215 shutdown, Clapper again pretended he didn’t know what program he was being asked about.

“As far as the comment, the allegation about my lying, I didn’t lie, I made a big mistake and I just simply didn’t understand what I was being asked about. I thought of another surveillance program, Section 702 of the Foreign Intelligence Surveillance Act when I was being asked about Section 215 of the Patriot Act at the time, I just didn’t understand that…”

Clapper’s repetition of this excuse hasn’t made it any more believable. None other than Senator Ron Wyden popped up on Twitter to point out Clapper’s lies about his lie.

If you can’t see/read the tweet, it says:

James Clapper needs to stop making excuses for lying to the American people about mass surveillance. To be clear: I sent him the question in advance. I asked him to correct the record afterward. He chose to let the lie stand.

That’s the face of IC leadership, as portrayed by James Clapper. Clapper managed to exit the public sector unscathed, turning over a limping surveillance ship to his successor while stepping into the private sector with no threat of punishment hanging over his head. He lied to Congress and got away with it. And he’s going to spend the rest of his life pretending he didn’t.

Filed Under: james clapper, lies, mass surveillance, nsa, ron wyden, section 215

Trump Administration Rolls Back Obama's Last-Minute Drone Strike Reporting Requirements

(Mis)Uses of Technology

from the public-is-purchasing-civilian-deaths-and-the-gov't-won't-even-give-it-a dept

After years of increasing overseas drone strikes, the Obama administration briefly attempted to salvage its reputation. Having turned countries like Syria and Yemen into the Killingest Places on Earth, Obama drafted a few rules to rein in the use of drones. A charitable take was that he recognized the blowback caused by these strikes, which tended to result in the unintended killing of civilians. A less charitable take is he recognized he might be turning these powers over to the Republicans and wanted to tie them up with restrictions he would have never placed on his own administration.

One of the few positive steps Obama took was mandating periodic reporting on drone strikes to assess the amount of collateral damage caused by these attacks, presumably in hopes of further reducing civilian casualties. Obama’s executive order instituted yearly reporting that would (eventually) be passed on to the public.

Report on Strikes Undertaken by the U.S. Government Against Terrorist Targets Outside Areas of Active Hostilities. (a) The Director of National Intelligence (DNI), or such other official as the President may designate, shall obtain from relevant agencies information about the number of strikes undertaken by the U.S. Government against terrorist targets outside areas of active hostilities from January 1, 2016, through December 31, 2016, as well as assessments of combatant and non-combatant deaths resulting from those strikes, and publicly release an unclassified summary of such information no later than May 1, 2017. By May 1 of each subsequent year, as consistent with the need to protect sources and methods, the DNI shall publicly release a report with the same information for the preceding calendar year.

The problem with instituting policies via executive orders is they can be undone using the same process. It appears the Trump Administration isn’t willing to abide by the rules the previous administration left for it to deal. Trump’s executive order rescinds Obama’s directive, allowing this administration to operate with the same opacity the previous administration enjoyed for its duration.

And we can’t even say Obama’s reporting requirement was great while it lasted. It went into force July 1, 2016. By the time the first reporting period rolled around in 2018, a different president was in office. As Charlie Savage points out for the New York Times, the new order simply codifies this administration’s failure to publish the first required report.

Mr. Trump’s revocation of the disclosure rule amounted to a belated acknowledgment that his administration had already changed the Obama policy in practice: The director of national intelligence never put out a report about bystander casualties in 2017, even though the Obama-era order requiring one remained on the books last year, when the report was due out.

Trump’s order claims the reporting is redundant as there are other drone strike reports already mandated by law. But this revocation gives the CIA — an agency that has “acquired a taste” for deadly drone strikes — complete opacity. The reporting requirements left untouched by Trump’s order only affects Defense Department drone operations. The CIA’s operations — often carried out away from areas declared war zones by the US government — will continue to operate under the radar, safely shielded from the eyes of the public.

We don’t know if the CIA’s use of drone strikes has kept pace with the DoD’s escalation. And we may never find out. But one thing’s for certain: the Trump Administration will be deploying far more drone strikes than the drone-happy Obama Administration. This can be gleaned by the few strike numbers that have been made public by the Defense Department, as collated here by Steve Niva, the editor of the Middle East Report.

Trump promised during the campaign to “bomb the shit” out of ISIS and it appears to be one of the few promises he has kept. Trump inherited from Obama an escalating war against ISIS in Iraq and Syria, but both conventional bombing and drone strikes have significantly increased under Trump as a result of his new ISIS battle plan, whose strategy Defense Secretary James Mattis defines as “annihilation tactics.”

[…]

[I]n the past three years, the number of military drone strikes there has also climbed, from 304 in 2015, to 376 last year, to 362 through the first eight months of Trump’s presidency. At this pace, 2017 will exceed previous yearly tallies.

Increasing deployments while decreasing transparency: that’s the Presidential way. It worked for Obama for all eight years he was in office. On the way out the door, he made a futile gesture in response to an escalation in civilian deaths — one ignored by the CIA and now granted an executive erasure by the new boss. We, as a nation, kill people based on metadata. And no one at the top feels obligated to hand over any data at all on these killings to the public that’s funding these deaths.

Filed Under: barack obama, donald trump, drone strikes, drones, executive orders, transparency

California Attorney General Doubles Down On Threatening Journalists For Possessing Convicted Cops List

Say That Again

from the I-guess-the-Constitution-only-protects-bad-cops dept

California Attorney General Xavier Becerra has decided there’s too much First Amendment in his state. First, he ignored clarification provided directly to him by the author of the state’s new public records law to declare past police misconduct records off limits. Claiming the question of retroactivity was still open, Becerra denied public records requests seeking documents created prior to January 1, 2019.

His next potshot at the First Amendment occurred shortly thereafter. Journalists from UC Berkeley received a list of convicted California police officers in response to a records request. The list covered 10 years of convictions and contained 12,000 names. At this point, the journalists have not published the full list. But they have been vetting the list to prep for publication.

That’s where AG Becerra stepped in. He told the journalists it was illegal for them to possess “confidential information” they obtained lawfully through a public records request. He’s wrong, of course. It is not illegal to possess documents received via public records requests even if the government entity has mistakenly sent you the wrong documents.

As for the “confidential” claim, any convictions would already be public records, seeing as prosecutions are handled by the state’s court system. What the list does is provide one-stop shopping for bad cops, which is what law enforcement agencies are doing when they run applicants against this list.

So far, only three officers’ names have been published. AG Becerra is trying to ensure those three names are the only ones the public will ever see. If the First Amendment needs to be damaged to protect bad cops, that’s a sacrifice he’s willing to make.

In a statement provided to Freedom of the Press Foundation on Wednesday, a spokesman for the California Department of Justice doubled down on the contention that the journalists are breaking the law:

“The UC Berkeley Investigative Reporting Program is not an entity permitted to possess or use this confidential data. The UC Berkeley Investigative Reporting Program chose to publish the confidential information of Californians despite being alerted by the Department of Justice that doing so was prohibited by law.”

The AG’s office is still threatening the reporters with criminal charges simply for possessing the list. But even if the journalists publish the list in full, it’s unlikely any court will support Becerra’s decision to pretend the First Amendment doesn’t exist. Both the act of requesting public records and the publication of obtained records are protected speech. AG Becerra has nothing to work with here, but he’s publicly demonstrating his willingness to do whatever it takes to protect the state’s bad cops.

Worse, he’s doubled down. When AG Becerra was asked for clarification by the Freedom of the Press Foundation, he had this to say:

“We always strive to balance the public’s right to know, the need to be transparent and an individual’s right to privacy. In this case, information from a database that’s required by law to be confidential was released erroneously, jeopardizing personal data of individuals across our state. No one wants to shield criminal behavior; we’re subject to the rule of law.”

If Becerra has a problem with “jeopardizing personal data,” the only action he should be taking is against the government entity that (supposedly) breached the law by releasing it to reporters. Becerra’s nod to “rule of law” is especially rich. The Constitution is part of the “law” Becerra professes allegiance to. But it’s clear he’d rather cover up for his cop buddies than respect the parts of the law that restrain his ability to punish people for protected speech.

Filed Under: 1st amendment, california, foia, journalism, police misconduct, public records, reporting, transparency, xavier becerra

CBP Put A Bunch Of Journalists, Immigration Lawyers, And Activists On A Secret Watchlist

Failures

from the fuck-the-Constitution-I-guess dept

Leaked documents obtained by an NBC affiliate show the government has taken a direct interest in journalists and activists covering the many, many happenings at our southern border. But the government isn’t interested in keeping them safe or giving them the space to do their jobs. Nope, the CBP has been treating journalists like suspected criminals, hauling them in for hours of questioning and examining the contents of their phones and laptops.

Oh well. I guess the First Amendment had a good run.

Documents obtained by NBC 7 Investigates show the U.S. government created a secret database of activists, journalists, and social media influencers tied to the migrant caravan and in some cases, placed alerts on their passports.

[…]

One photojournalist said she was pulled into secondary inspections three times and asked questions about who she saw and photographed in Tijuana shelters. Another photojournalist said she spent 13 hours detained by Mexican authorities when she tried to cross the border into Mexico City. Eventually, she was denied entry into Mexico and sent back to the U.S.

The documents (which appear to be screenshots of the CBP database) show an extensive list of journalists and activists, along with notes stating whether or not the person was interviewed and/or placed on a CBP “alert” list. The surveillance of protected First Amendment activities is apparently part of the DHS’s “Operation Secure Line,” which monitored the caravan travelling through Mexico to the US border.

Here’s who’s on the list, according to NBC 7’s investigation:

The individuals listed include ten journalists, seven of whom are U.S. citizens, a U.S. attorney, and 47 people from the U.S. and other countries, labeled as organizers, instigators or their roles “unknown.” The target list includes advocates from organizations like Border Angels and Pueblo Sin Frontera.

The CBP’s first statement said this all just normal border-protecting stuff. According to its initial deflection, adding journalists and activists to watchlists that targeted them for enhanced screening and other unpleasantness is all part of the government’s plan to address the multiple caravans headed for our borders. The CBP statement does not explain why targeting lawyers, activists, and journalists is considered an appropriate use of government resources. In fact, it doesn’t attempt to address the database and its contents at all.

And it’s not just secondary screenings and hours-long interviews of people engaging in protected speech. The DHS is apparently compiling entire dossiers about this group of targets — none of which is suspected of participating in criminal behavior. According to a DHS source quoted in the article, the agency doesn’t have the authority to compile information on people not suspected of criminal activity. As the unnamed person notes, DHS isn’t an intelligence agency. It’s a law enforcement agency.

CBP now appears to be in panic mode. An update added to the story indicates the agency is throwing any justification it can against the wall in hopes of something sticking.

Minutes after our story published and five days after a Customs and Border Protection spokesperson gave us the agency’s statement above, CBP told our colleagues at NBC News that the names in the database are all people who were present during violence that broke out at the border in November. The agency also said journalists are being tracked so that the agency can learn more about what started that violence. CBP never clarified that point directly to NBC 7 Investigates.

Even this hasty course correction is a spectacular failure of logic. The CBP is investigating a confrontation at the border… by placing journalists, lawyers, and activists under surveillance? That makes no sense. The CBP can speak to these people without placing them on an alert list and subjecting them to enhanced screening and device searches. If the agency needs to interview witnesses, there are processes for that — none of which look like an attempt to chill press freedom and pro-immigrant activism at the border.

Filed Under: activists, cbp, customs and border patrol, immigration, journalists, lawyers, watchlist

FBI Director Chris Wray Needs To Shut The Fuck Up About Encryption

Say That Again

from the SHOW-YOUR-WORK dept

FBI Director Chris Wray is still hoping to sell Americans on trading away their security for a little bit of law enforcement convenience. Wray believes the only way the FBI and other agencies will ever keep up with criminals is to do away with encryption. The “going dark” campaign may have started with Jim Comey, but Wray has proven to be every bit as obtusely tenacious as his predecessor.

Wray’s latest anti-encryption pep talk occurred at the RSA Conference. CNET reports the FBI director delivered another misguided, but impassioned, speech in defense of making everything worse for everyone but the FBI.

Encryption should have limits. That’s the message FBI Director Christopher Wray had for cybersecurity experts Tuesday. The technology that scrambles up information so only intended recipients can read it is useful, he said, but it shouldn’t provide a playground for criminals where law enforcement can’t reach them.

“It can’t be a sustainable end state for there to be an entirely unfettered space that’s utterly beyond law enforcement for criminals to hide,” Wray said during a live interview at the RSA Conference, a major cybersecurity gathering in San Francisco.

Wray can’t honestly define where encryption should stop and law enforcement access begin. All he can do is claim the status quo isn’t working because sometimes the FBI can’t get into a seized device. But how many times is encryption actually bringing an investigation to a halt? That’s something Wray won’t talk about, even though he has access to this information.

What CNET charitably calls a “back and forth” conversation between Chris Wray and tech companies is actually nothing more than Wray complaining about encryption and ignoring everything he hears back from the companies that would be affected.

Wray needs to take his anti-encryption ball and go home. Not because I disagree with him, but because the FBI has handled this “conversation” disingenuously since day one. The “going dark” narrative hasn’t been backed by evidence or facts. The FBI misrepresented the number of uncrackable devices it had in its possession for more than three years. Once legislators started demanding proof, the FBI discovered it had no idea how many devices it had on hand.

No further details have been delivered by the FBI, but it’s safe to assume the original estimate of 8-9,000 devices is actually less than a quarter of that. But we don’t know what the actual count is because the FBI has yet to issue an updated number.

The FBI said it would recount the devices and get back to us. As of March 6th, it has been 281 days since the FBI started replacing statements of 8,000+ locked devices with asterisks and footnotes. This is why Wray needs to shut his mouth. Until his agency delivers the real number of locked devices, we don’t need to entertain his anti-encryption dreams. If he and his agency are unwilling to have a real conversation about device encryption — one containing actual facts about locked devices and their impact on investigations — no one should grant him or his comments any credibility.

Filed Under: chris wray, doj, encryption, facts, fbi, going dark

California Legislators Want To Make It More Difficult For Records Requesters To Get Documents From The Government

Legal Issues

from the mandated-chain-yanking dept

The California legislature handed the public a win by making police misconduct records obtainable through records requests. The transparency very few law enforcement agencies are welcoming is still being litigated, but going forward it seems clear cops will no longer be able to hide their misconduct behind a wall of government-enabled opacity.

I guess California legislators believe some sort of transparency equilibrium must be maintained. They’ve introduced a bill that will make it more difficult for requesters to obtain documents. (via Dave Maass) The bill amends the state’s public records law to create another hoop for requesters to jump through before they can get a hold of documents the law says are rightfully theirs.

Here’s the key amendment:

Before instituting any proceeding for injunctive or declarative relief or writ of mandate in any court or competent jurisdiction, the person shall meet and confer in good faith with the agency in an attempt to informally resolve each issue. The person or their attorney shall file a declaration stating that this meet and confer process has occurred at the time that proceedings are instituted.

This may seem like a minimal imposition, but it really isn’t. Only a small percentage of public records requesters live close to the agencies they’re seeking to obtain documents from. Even if they are nearby, the law allows agencies to set the agenda. Agencies take as long as they want to set up a meeting, pushing rejected requests past the law’s upper limits for responses.

Even if agencies allow these conferences to happen by phone, requesters are still at the mercy of agencies that are in no hurry to return responses. This is just another way for agencies to stonewall requesters in hopes of deterring them from following through on their requests.

The litigation option is being delayed for no discernible purpose. Few things motivate recalcitrant government agencies like lawsuits. This is a gift to uncooperative agencies, presented as a common sense solution to the costs of litigation. Sure, in a perfect world, these discussions could head off pricey lawsuits. But the world we actually live in requires litigation a great deal of the time because few government agencies are truly responsive to records requesters.

And it’s all going to end up in court anyway. The court will now have to rule first on whether a good faith effort was made prior to the filing, which will result in more expenses incurred by both parties as they attempt to persuade a judge an attempt was or wasn’t made by one party. There’s nothing in the law that punishes agencies for screwing around with requesters and no time limit is placed on the mandated meetings.

Hopefully, this new requirement will never make its way into law. If it does, it should be challenged immediately on the grounds that it violates rights guaranteed by the state. If state legislators are truly concerned about the ever-escalating cost of public records litigation, they should focus their time and energy cracking down on agencies with track records of unresponsiveness, rather than just make it more difficult to force records out of these agencies’ hands.

Filed Under: california, public records, transparency

The NSA Appears To Have Shut Down Its Bulk Collection Of Phone Records

Privacy

from the program-so-valuable-no-one-could-find-a-use-for-it dept

The program considered so “essential” NSA defenders said it couldn’t even be slightly modified is apparently no longer in use. During a recent Lawfare podcast, national security advisor Luke Murry dropped a bit of a bombshell. Charlie Savage summarizes Murry’s comments:

The National Security Agency has quietly shut down a system that analyzes logs of Americans’ domestic calls and texts, according to a senior Republican congressional aide, halting a program that has touched off disputes about privacy and the rule of law since the Sept. 11 attacks.

[…]

Mr. Murry brought up the pending expiration of the Freedom Act, but then disclosed that the Trump administration “hasn’t actually been using it for the past six months.”

“I’m actually not certain that the administration will want to start that back up,” Mr. Murry said.

Murry is referring to the Section 215 bulk data collection. Exposed by the Snowden leaks, Section 215 was modified by the USA Freedom Act, which went into effect June 2015. The biggest modification was where the records were stored. The NSA could no longer collect all phone records from providers and search through the data at its leisure. Instead, it had to provide telcos with lists of targeted numbers. The data remained in the hands of service providers, with the NSA only having access to suspicion-supported phone records.

The alterations to the Section 215 program resulted in the NSA purging a bunch of records that didn’t fit the new parameters. The NSA finally let go of a few of its haystacks, conveniently destroying records integral to multiple lawsuits against the agency. The USA Freedom Act modifications — combined with the NSA’s long history of abusing its collection authorities — seem to have made it impossible for the NSA to continue utilizing its phone records collection program.

The bulk records collection is now in the hands of telcos, resulting in a slimmed-down dataset the NSA didn’t seem particularly enthused to have. Apparently the program is as useless as critics have said it is. The NSA has gone at least six months without asking for data via this authority. This program is due for renewal at the end of this year, but the comments made to Lawfare suggest the NSA may be content to let it expire.

Marcy Wheeler suggests a few underlying motivations for the NSA’s abandonment of the Section 215 collection — and one might be the Supreme Court’s extension of Fourth Amendment protections to cell site location info.

[This] suggests that the problem with the records may not be the volume or the content turned over, but some problem created either by the specific language of the law or (more likely) the House Report on it or by the Carpenter decision. Carpenter came out on June 22, so technically after the NSA claims to have started deleting records on May 23. It also may be that the the NSA realized something was non-compliant with its collection just as it was submitting the 6th set of 180-day applications, and didn’t want to admit to the FISC that it had been breaking the law (which is precisely what happened in 2011 when the government deleted all its PRTT records).

Wheeler says the NSA may have been asking for location data as well to better track the phones it targeted. The IC may have seen the writing on the third-party wall following the Supreme Court’s oral arguments in November 2017. This may account for its plug-pulling a month ahead of the decision’s release.

Or it may be something far less respectful of the Constitution. It could be the NSA has found another way to collect this same data without having to run it by the newly-adversarial FISA court. As Wheeler points out, Section 215 may have been restricted but the powers granted by Executive Order 12333 continue to expand.

Whatever the real motivation, it appears the domestic surveillance program that never prevented a terrorist attack will continue to never prevent terrorist attacks. The upside is we may not be throwing any more tax dollars at a national security program that adds nothing to our nation’s security.

Filed Under: bulk surveillance, ed snowden, mass surveillance, metadata, nsa, phone records, section 215