WatchGuard Plays The Ostrich, Patches Exploit Without Informing Customers

(Mis)Uses of Technology

from the heads-in-the-sand dept

Firewalls. You know, boring old IT stuff. So why are we talking about them at Techdirt? Well, one thing we regularly talk about is how companies tend to respond to exploits and breaches that are uncovered and, far too often, how horrifically bad they are in those responses. Often times, breaches and exploits end up being far more severe than originally reported, and there are some companies that actually try to go after those reporting on breaches and exploits legally.

And then there’s WatchGuard, which was informed in February of 2021 by the FBI that an exploit in one of its firewall lines was being used by Russian hackers to build a botnet, yet the company only patched the exploit out in May of 2021. Oh, and the company didn’t bother to alert its customers of the specifcs in any of this until court documents were unsealed in the past few days revealing the entire issue.

In court documents unsealed on Wednesday, an FBI agent wrote that the WatchGuard firewalls hacked by Sandworm were “vulnerable to an exploit that allows unauthorized remote access to the management panels of those devices.” It wasn’t until after the court document was public that WatchGuard published this FAQ, which for the first time made reference to CVE-2022-23176, a vulnerability with a severity rating of 8.8 out of a possible 10.

The WatchGuard FAQ said that CVE-2022-23176 had been “fully addressed by security fixes that started rolling out in software updates in May 2021.” The FAQ went on to say that investigations by WatchGuard and outside security firm Mandiant “did not find evidence the threat actor exploited a different vulnerability.”

Note that there was an initial response from WatchGuard almost immediately after the advisement from US/UK LEOs, with a tool to let customers identify if they were at risk and instructions for mitigation. Which is all well and good, but customers weren’t given any real specifics as to what the exploit was or how it might be used. That’s the sort of thing IT administrators dig into. The company also basically suggested it was not providing those details to keep the exploit from being more widely used.

When WatchGuard released the May 2021 software updates, the company made only the most oblique of references to the vulnerability.

“These releases also include fixes to resolve internally detected security issues,” a company post stated. “These issues were found by our engineers and not actively found in the wild. For the sake of not guiding potential threat actors toward finding and exploiting these internally discovered issues, we are not sharing technical details about these flaws that they contained.”

Unfortunately, there doesn’t seem to be much that is true in that statement. Law enforcement uncovered the security issue, not some internal WatchGuard team. The exploit was found in the wild, with the FBI assessing that roughly 1% of the firewalls the company sold were compromised with malware called Cyclops Blink, another specific that doesn’t appear to have been communicated to clients.

“As it turns out, threat actors *DID* find and exploit the issues,” Will Dormann, a vulnerability analyst at CERT, said in a private message. He was referring to the WatchGuard explanation from May that the company was withholding technical details to prevent the security issues from being exploited. “And without a CVE issued, more of their customers were exposed than needed to be.

WatchGuard should have assigned a CVE when they released an update that fixed the vulnerability. They also had a second chance to assign a CVE when they were contacted by the FBI in November. But they waited for nearly 3 full months after the FBI notification (about 8 months total) before assigning a CVE. This behavior is harmful, and it put their customers at unnecessary risk.”

And it’s not the kind of thing you can get away with when your business is literally threat detection and prevention in IT. This stinks of a coverup, which is always worse than the crime, cliché though that might be.

Filed Under: botnet, disclosure, fbi, firewall, hackers, security, vulnerability disclosure
Companies: watchguard

New Washington Law Requires Home Sellers Disclose Lack Of Broadband Access

Broadband

from the it's-a-utility,-stupid dept

For decades the U.S. newswires have been peppered with stories where somebody bought a house after being told by their ISP it had broadband access, only to realize the ISP didn’t actually serve that address. Generally, the homeowner then realizes they have to spend a stupid amount of money to pay the local telecom monopoly to extend service.. or move again. Time after time, local ISPs are found to be flat out lying when they claim they can offer an essential utility (broadband), and the home buyer has little recourse thanks to the slow, steady erosion of U.S. state and federal telecom regulatory oversight.

So yeah, one problem is that we continue to lobotomize our state and federal telecom regulators under the bullshit claim that this results in some kind of free market Utopia (you’d think everyday reality would have cured folks of this belief by now, but nope). The other underlying culprit has generally been America’s notoriously shitty broadband maps, which let regional monopolies obscure the patchy coverage, slow speeds, and high prices created by regional monopolization so American policymakers can more easily pretend none of this is a problem.

State telecom consumer protection is generally feckless, with the entirety of telecom policy in most corrupt state legislatures directly dictated by AT&T or Comcast. Washington State continues to be one of just a few exceptions. In the last few years the state has killed a protectionist law designed to hamstring community broadband, passed its own net neutrality laws in the wake of federal apathy, and has actually stood up to the longstanding telecom industry practice of ripping off consumers with bullshit fees. Now, the state is also passing a new law requiring that home sales disclose whether the home actually has broadband:

“Starting in the new year, home sellers in Washington will be required to share their internet provider on signed disclosure forms that include information about plumbing, insulation and structural defects…”Does the property currently have internet service?” the disclosure form will now ask, along with a space to say who the provider is. The law doesn’t require sellers to detail access speeds, quality or alternative providers.

In short, the law now gives potential buyers three days after receiving the disclosure to back out of the deal if they are concerned over any of the details indicated on the form. It basically just requires the seller to confirm whether or not they currently have access, and keeps the buyer from having to confirm service availability from a regional monopoly with a vested interest in lying about their footprint reach.

It’s a small shift, but it reflects the growing COVID-era understanding that broadband is more of an essential utility than a luxury. For years telecom monopolies (and the consultants, think tankers, and proxy policy wonks paid to love them) fought tooth and nail against the idea of broadband as a utility because it would require being regulated like one. That means stricter safeguards on things like metered usage (which would be a problem given most broadband usage caps are bullshit), sneaky and completely bogus fees, predatory pricing, and other bad practices the industry has engaged in for a generation.

Telecom monopoly lobbyists and policy folks for decades were allowed to get away with the argument that broadband isn’t an essential utility and therefore should not be subject to functional, meaningful oversight. That helped build the monopolies like Comcast we all know and love. But that rhetoric was thrown immediately in the dumpster courtesy of the harsh reality of the COVID home telecommuting and home education boom (apparently the visual of kids huddled in the dirt outside of taco bell just to attend class in the richest country in history had a motivating impact, who knew?).

The problem continues to be that reform like this remains hard to come by. Federal policymakers are intentionally hamstrung and gridlocked by a Congress awash in telecom campaign contributions, and for every state like Washington there are five states that simply couldn’t care less about the laundry list of predatory behaviors regional telecom monopolies engage in on a daily basis. Like, say, falsely claiming for thirty straight years they offer broadband to areas they don’t, in part due to incompetence, and in part to help mask a widespread lack of actual coverage and competition.

Filed Under: broadband, disclosure, washington

Journalists In St. Louis Discover State Agency Is Revealing Teacher Social Security Numbers; Governors Vows To Prosecute Journalists As Hackers

Say That Again

from the wtf-missouri? dept

Last Friday, Missouri’s Chief Information Security Officer Stephen Meyer stepped down after 21 years working for the state to go into the private sector. His timing is noteworthy because it seems like Missouri really could use someone in their government who understands basic cybersecurity right now.

We’ve seen plenty of stupid stories over the years about people who alert authorities to security vulnerabilities then being threatened for hacking, but this story may be the most ridiculous one we’ve seen. Journalists for the St. Louis Post-Dispatch discovered a pretty embarrassing leak of private information for teachers and school administrators. The state’s Department of Elementary and Secondary Education (DESE) website included a flaw that allowed the journalists to find social security numbers of the teachers and administrators:

Though no private information was clearly visible nor searchable on any of the web pages, the newspaper found that teachers? Social Security numbers were contained in the HTML source code of the pages involved.

The newspaper asked Shaji Khan, a cybersecurity professor at the University of Missouri-St. Louis, to confirm the findings. He called the vulnerability ?a serious flaw.?

?We have known about this type of flaw for at least 10-12 years, if not more,? Khan wrote in an email. ?The fact that this type of vulnerability is still present in the DESE web application is mind boggling!?

In the HTML source code means that it sent that information to the computers/browsers of those who knew what pages to go to. It also appears that the journalists used proper disclosure procedures, alerting the state and waiting until it had been patched before publishing their article:

The Post-Dispatch discovered the vulnerability in a web application that allowed the public to search teacher certifications and credentials. The department removed the affected pages from its website Tuesday after being notified of the problem by the Post-Dispatch.

Based on state pay records and other data, more than 100,000 Social Security numbers were vulnerable.

The newspaper delayed publishing this report to give the department time to take steps to protect teachers? private information, and to allow the state to ensure no other agencies? web applications contained similar vulnerabilities.

Also, it appears that the problems here go back a long ways, and the state should have been well aware that this problem existed:

The state auditor?s office has previously sounded warning bells about education-related data collection practices, with audits of DESE in 2015 and of school districts in 2016.

The 2015 audit found that DESE was unnecessarily storing students? Social Security numbers and other personally identifiable information in its Missouri Student Information System. The audit urged the department to stop that practice and to create a comprehensive policy for responding to data breaches, among other recommendations. The department complied, but clearly at least one other system contained an undetected vulnerability.

This is where a competent and responsible government would thank the journalists for finding the vulnerability and disclosing it in an ethical manner designed to protect the info of the people the state failed to properly protect.

But that’s not what happened.

Instead, first the Education Commissioner tried to make viewing the HTML source code nefarious:

In the letter to teachers, Education Commissioner Margie Vandeven said ?an individual took the records of at least three educators, unencrypted the source code from the webpage, and viewed the social security number (SSN) of those specific educators.?

It was never “encrypted,” Commissioner, if the journalists could simply look at the source code and get the info.

Then DESE took it up a notch and referred to the journalists as “hackers.”

But in the press release, DESE called the person who discovered the vulnerability a ?hacker? and said that individual ?took the records of at least three educators? ? instead of acknowledging that more than 100,000 numbers had been at risk, and that they had been available to anyone through DESE?s own search engine.

And then, it got even worse. Missouri Governor Mike Parson called a press conference in which he again called the journalists hackers and said he had notified prosecutors and the Highway Patrol’s Digital Forensic Unit to investigate. Highway Patrol? He also claimed (again) that they had “decoded the HTML source code.” That’s… not difficult. It’s called “view source” and it’s built into every damn browser, Governor. It’s not hacking. It’s not unauthorized.

It gets worse. Governor Parson claims that this “hack” could cost $50 million. I only wish I was joking.

This incident alone may cost Missouri taxpayers up to $50 million and divert workers and resources from other state agencies. This matter is serious.

The state is committing to bring to justice anyone who hacked our system and anyone who aided or encouraged them ? In accordance with what Missouri law allows AND requires.

A hacker is someone who gains unauthorized access to information or content. This individual did not have permission to do what they did. They had no authorization to convert and decode the code. This was clearly a hack.

We must address any wrongdoing committed by bad actors.

If it costs $50 million to properly secure the data on your website that previous audits had already alerted you as a problem, then that’s on the incompetent government who failed to properly secure the data in the first place. Not on journalists ethically alerting you to fix the vulnerability. And, there’s no “unauthorized access.” Your system put that info into people’s browsers. There’s no “decoding” to view the source. That’s not how any of this works.

As people started loudly mocking Governor Parson, he decided to double down, insisting that it was more than a simple “right click” and repeating that journalists had to “convert and decode the data.”

Again, even if it took a few steps, that’s still not hacking. It’s still a case where the state agency made that info available. That’s not on the journalists who responsibly disclosed it. It’s on the state for failing to protect the data properly (and for collecting and storing too much data in the first place).

Indeed, in doing this ridiculous show of calling them hackers and threatening prosecution, all the state of Missouri has done is make damn sure that the next responsible/ethical journalists and/or security researchers will not alert the state to their stupidly bad security. Why take the risk?

Filed Under: blame the messenger, dese, disclosure, ethical disclosure, hacking, mike parson, private information, schools, social security numbers, st. louis, teachers, vulnerabilities
Companies: st. louis post dispatch

European Law Enforcement Officials Upset Facebook Is Warning Users Their Devices May Have Been Hacked

Legal Issues

from the screw-the-little-people,-we've-got-bad-guys-to-hack dept

Oh boy. Facebook has just added fuel to the anti-encryption fire. And by doing nothing more than something it should be doing: notifying users that their device may have been compromised by malware.

The Wall Street Journal article covering this standard notification is full of quotes from government officials who aren’t happy a suspected terrorist was informed his phone had possibly been infected by targeted malware. [Non-paywalled version here.]

A team of European law-enforcement officials was hot on the trail of a potential terror plot in October, fearing an attack during Christmas season, when their keyhole into a suspect’s phone went dark.

WhatsApp, Facebook Inc. ’s popular messaging tool, had just notified about 1,400 users—among them the suspected terrorist—that their phones had been hacked by an “advanced cyber actor.” An elite surveillance team was using spyware from NSO Group, an Israeli company, to track the suspect, according to a law-enforcement official overseeing the investigation.

Facebook is no fan of NSO Group. In fact, very few people are fans of NSO Group, other than their customers, which have included UN-blacklisted countries and a number of governments that rank pretty high on the Most Human Rights Violated charts. Facebook sued NSO back in November, making very questionable allegations about CFAA violations. Facebook’s servers were never targeted by NSO’s malware. Only end users were, which makes it pretty difficult for Facebook to claim it has been personally (so to speak) injured by NSO’s actions.

Back to the matter at hand, Facebook didn’t just warn suspected terrorists about detected malware.

WhatsApp’s Oct. 29 message to users warned journalists, activists and government officials that their phones had been compromised, Facebook said. But it also had the unintended consequence of potentially jeopardizing multiple national-security investigations in Western Europe about which Facebook hadn’t been alerted—and about which government agencies can’t formally complain, given their secret nature.

Would these government officials rather have not been warned about threats? Were any of these government officials receiving warnings the same ones now complaining the warning allowed a terrorism suspect to vanish? Maybe so. The one quoted in the article seems very short-sighted.

On the day WhatsApp sent its alert, the official overseeing the terror investigation in Western Europe said, he was stuck in traffic on his way to work when a call came in from Israel. “Have you seen the news? We’ve got a problem,” he said he was told. WhatsApp was notifying suspects whom his team was tracking that their phones had been hacked. “No, that can’t be right. Why would they do that?” the official said he asked his contact, thinking it a joke.

“Why would they do that” indeed. Maybe to protect their users from cybercriminals and state-sponsored hackers. It’s not about allowing suspected criminals to dodge law enforcement, even though it will undoubtedly have that effect. It’s about keeping users and their communications protected — users that include journalists, activists, and government officials.

This response indicates the investigators pursuing the suspected terrorist would rather hundreds of innocent people be harmed than someone suspected of terrorism go free. But it really doesn’t matter what unnamed officials think about Facebook’s “you may have been compromised” notifications or the harm these might do to ongoing investigations. Facebook’s voluntary warnings will soon be mandatory in Europe. By the end of 2020, all service providers and telcos will be obligated to warn customers of security threats.

That fact — and the apparent willingness to allow innocent people to be victimized by targeted attacks — makes the article’s closing statement all the more ridiculous.

Gilles de Kerchove, the European Union’s counterterrorism coordinator, says encryption shouldn’t allow criminals to be “less accountable online than in real life.”

I have no idea what that means. I know what the official thinks it’s supposed to mean — that “online” is bad because sometimes criminals get away — but even that interpretation doesn’t make sense. Criminals discover their phones have been tapped and stop using those lines. Criminals talk to each other in person to avoid creating records of conversations. Criminals get tips from other criminals they’re under surveillance. This stuff just happens. Investigations don’t always run smoothly.

A standard warning about possibly-compromised devices and services is just good business — something that protects everyone who uses the service, not just the people governments think are OK to protect. These warnings are essential and they benefit everyone, not just the people governments want to lock up.

Filed Under: disclosure, europe, hacking, law enforcement, malware, terrorists
Companies: facebook, nso group, whatsapp

China Actively Collecting Zero-Days For Use By Its Intelligence Agencies — Just Like The West

Privacy

from the no-moral-high-ground-there,-then dept

It all seems so far away now, but in 2013, during the early days of the Snowden revelations, a story about the NSA’s activities emerged that apparently came from a different source. Bloomberg reported (behind a paywall, summarized by Ars Technica) that Microsoft was providing the NSA with information about newly-discovered bugs in the company’s software before it patched them. It gave the NSA a window of opportunity during which it could take advantage of those flaws in order to gain access to computer systems of interest. Later that year, the Washington Post reported that the NSA was spending millions of dollars per year to acquire other zero-days from malware vendors.

A stockpile of vulnerabilities and hacking tools is great — until they leak out, which is precisely what seems to have happened several times with the NSA’s collection. The harm that lapse can cause was vividly demonstrated by the WannaCry ransomware. It was built on a Microsoft zero-day that was part of the NSA’s toolkit, and caused very serious problems to companies — and hospitals — around the world.

The other big problem with the NSA — or the UK’s GCHQ, or Germany’s BND — taking advantage of zero-days in this way is that it makes it inevitable that other actors will do the same. An article on the Access Now site confirms that China is indeed seeking out software flaws that it can use for attacking other systems:

In November 2017, Recorded Future published research on the publication speed for China’s National Vulnerability Database (with the memorable acronym CNNVD). When they initially conducted this research, they concluded that China actually evaluates and reports vulnerabilities faster than the U.S. However, when they revisited their findings at a later date, they discovered that a majority of the figures had been altered to hide a much longer processing period during which the Chinese government could assess whether a vulnerability would be useful in intelligence operations.

As the Access Now article explains, the Chinese authorities have gone beyond simply keeping zero-days quiet for as long as possible. They are actively discouraging Chinese white hats from participating in international hacking competitions because this would help Western companies learn about bugs that might otherwise be exploitable by China’s intelligence services. This is really bad news for the rest of us. It means that China’s huge and growing pool of expert coders are no longer likely to report bugs to software companies when they find them. Instead, they will be passed to the CNNVD for assessment. Not only will bug fixes take longer to appear, exposing users to security risks, but the Chinese may even weaponize the zero-days in order to break into other systems.

Another regrettable aspect of this development is that Western countries like the US and UK can hardly point fingers here, since they have been using zero-days in precisely this way for years. The fact that China — and presumably Russia, North Korea and Iran amongst others — have joined the club underlines what a stupid move this was. It may have provided a short-term advantage for the West, but now that it’s become the norm for intelligence agencies, the long-term effect is to reduce the security of computer systems everywhere by leaving known vulnerabilities unpatched. It’s an unwinnable digital arms race that will be hard to stop now. It also underlines why adding any kind of weakness to cryptographic systems would be an incredibly reckless escalation of an approach that has already put lives at risk.

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Filed Under: china, cybersecurity, disclosure, intelligence, nsa, security, surveillance, vulnerabilities, zero days

Security Researcher At The Center Of Emoji-Gate Heading Home After Feds Drop Five Felony Charges

Legal Issues

from the good-news-for-one-of-the-actual-good-guys dept

The security researcher who was at the center of an audacious and disturbing government demand to unmask several Twitter accounts on the basis of an apparently menacing smiley emoji contained in one of them is now facing zero prison time for his supposed harassment of an FBI agent. Justin Shafer, who was originally facing five felony charges, has agreed to plead guilty to a single misdemeanor charge. Shafer, who spent eight months in jail for blogging about the FBI raiding his residence repeatedly, is finally going home.

Here are the details of plea agreement [PDF] Shafer has agreed to. (h/t DissentDoe]

Mr. Shafer is pleading to a single misdemeanor of simple assault, based on his sending a Facebook direct message to an FBI Agent’s immediate relative’s public Facebook account. There is no allegation of any physical contact.

The government agrees to recommend a sentence of time served. Mr. Shafer already served 8 months in jail before trial for criticizing the government’s prosecution in a blog post. He was released after the defense filed a motion arguing his pre-trial detention violated First Amendment free speech rights and the statute governing pre-trial detention.

The government is not seeking for any restitution.

The United States Attorney’s Office has agreed not to prosecute Mr. Shafer for the events leading to the initial armed FBI raid of his family’s home.

Mr. Shafer has agreed to a no contact order with the FBI agent, the agent’s family, and the company involved in the initial investigation.

What started out as normal security research soon became a nightmare for Shafer. His uncovering of poor security practices in the dental industry — particularly the lack of attention paid to keeping HIPAA information secured — led to his house being raided by FBI agents. The FBI raided his house again after he blogged about the first raid. The FBI justified its harassment of Shafer with vague theories about his connection to infamous black hat hacker TheDarkOverlord. To do this, the FBI had to gloss over — if not outright omit — the warnings Shafer had sent to victims of TheDarkOverlord, as well as the information on the hacker Shafer had sent to law enforcement agencies including the FBI.

Blogging about his interactions with the FBI led to the judge presiding over his criminal trial to revoke his release and jail him for exercising his First Amendment rights. This was ultimately reversed by a federal judge who agreed Shafer was allowed to call FBI agents “stupid” and blog about his treatment by the federal agency. (He was not to reveal personal info about FBI agents, however.)

This trial has come to a swift end because the presiding judge sees zero merit in the government’s case.

[T]he case probably would have gone to trial had it not been for Judge Janis Graham Jack letting the prosecution know that she saw no evidence of any threat to support the felony charges and that she might rule on the defense’s motion to dismiss if the prosecution didn’t come up with some reasonable plea deal.

This case comes to an end, but it does not absolve the government of its abusive behavior. Here’s what Shafer’s defense team (Tor Ekeland, Fred Jennings, and Jay Cohen) had to say about their client’s treatment by federal law enforcement.

Mr. Shafer first contacted us after he [was] raided by armed federal law enforcement for alleged computer crimes the government has never charged him for. When he complained to the government about it, he was arrested and thrown in jail for his criticism. He was freed after the defense filed a motion arguing his pre-trial detention violated the First Amendment. Fortunately, when presented with the facts of this case, the Court understood the magnitude of the issues here and helped us resolve this case without the hassle, expense, and stress of a jury trial. We are grateful to the Northern District of Texas for recognizing this case for what it was: an attack on internet free speech and a citizen’s right to criticize the government.

And what can we learn from this debacle? Here’s what Shafer has learned: never help anybody.

I think the next time someone finds social security numbers that is considered protected health information under HIPAA they should just turn a blind eye. Nobody is going to call you a hero (except the enlightened), and you run the risk of being harassed by the FBI. Doctors responsible for alerting patients will now have yet another reason not to. Already, only about 10% of doctors notified patients that their patient information was publicly available. Law enforcement or the Office of Civil Rights won’t care, and will most likely ignore it. Punishing health information researchers for reporting these issues only puts patients at greater risk. I think it would benefit society greatly if people who find publicly accessible data were not threatened by the people who put it there.

Thank god the FBI was there to help ensure public safety no one publicly badmouthed one of its agents. Shooting the messenger is the expected response when security breaches are discovered. If it’s not those leaving personal info exposed threatening researchers with lawsuits or criminal charges, it’s the government itself stepping in to “protect” entities that can’t even protect the data of paying customers.

Filed Under: disclosure, fbi, hacking, justin shafer, security, security research

Harris Stingray Nondisclosure Agreement Forbids Cops From Telling Legislators About Surveillance Tech

Legal Issues

from the lying-about-the-law-to-ensure-silence dept

The FBI set the first (and second!) rules of Stingray Club: DO NOT TALK ABOUT STINGRAY CLUB. Law enforcement agencies seeking to acquire cell tower spoofing tech were forced to sign a nondisclosure agreement forbidding them from disclosing details on the devices to defendants, judges, the general public… sometimes even prosecutors.

A new wave of parallel construction washed over the land, distancing defendants from the source of evidence used against them. Pen register orders — used to cover the tracks of Stingray searches — started appearing en masse, as though it was 1979 all over again. If curious lawyers and/or judges started sniffing around, agencies were instructed to let accused criminals roam free rather than expose details about Stingray devices. According to the FBI, public safety would be irreparably damaged if Stingray details were exposed. Apparently the return of dangerous criminals to the street poses no harm to the public.

Another NDA has been uncovered, thanks to a lengthy public records lawsuit. The document finally handed over by Delaware State Police to the ACLU was once referred to as “mythical” by the DSP in court. Yes, the State Police once claimed this NDA never existed. It did so while claiming it had zero communications with Harris while acquiring its Stingray. The ACLU obviously found this hard to believe and the court sent the DSP back to search harder. The Harris NDA is real. And it’s spectacular.

The agreement, signed by a state police detective in 2010, stated that officers could not “discuss, publish, release or disclose any information pertaining to the (cell phone tracking) products” to the general public, to companies, to other governmental agencies, or even to other officers who do not have a “need to know.”

A letter attached to the agreement, and signed by Harris Corp.’s account manager, said police are not permitted to talk about the devices with “elected officials.”

“Stealth, quiet approach and skilled execution are the glue that transforms weapons and technology investments into capabilities and results,” Harris Corp.’s Michael E. Dillon said in the letter. “Only officers with arrest authority are permitted to use them (Stingrays) or have knowledge of how they work.”

Harris cited federal law for the conditions in the agreement, which it stated is similar to other “intelligence oriented aspects of your operations.”

Yes, Harris is deliberately misconstruing federal law to ban law enforcement agencies from discussing its devices with anyone, including those who oversee departments and their spending. This means the public has zero chance of knowing what surveillance tech local officers are deploying. The part of the law cited by Harris — 18 USC 2512 — simply forbids entities who are not (a) wireless service providers or (b) government contractors from advertising or selling tools that intercept wireless communications. It has absolutely nothing to say about discussing these devices with other government entities (or the general public for that matter).

But as we all are painfully aware, ignorance of the law is the bread-and-butter of law enforcement. Detective Dennis Smith signed the “mythical” document [PDF] all the way back in 2010, “binding” his agency to an agreement it could have walked away from at any time with zero consequences. (Well, maybe the loss of future business deals with Harris, but no violations of state or federal laws.)

Disappointingly, state legislators seem pretty cool about being kept in the dark by a government contractor’s bogus NDA.

[L]awmakers are some of the “worst at keeping secrets,” said [Greg] Lavelle, the Senate minority whip.

“I’m not offended that they threw public officials in there (the non-disclosure agreement),” he said.

Lavelle may not speak for the rest of the Delaware legislature, but at this point he has to. All other legislators refused to answer questions about the Harris NDA that allowed the State Police to hide information about surveillance equipment from them. Finding out agencies they oversee have been effectively lying to them should have triggered more of a response. Instead, Delaware residents get a single shrug from a state rep and silence from the rest.

Filed Under: disclosure, due process, evidence, fbi, imsi catchers, nda, stingrays, surveillance
Companies: harris

Vulnerability Equities Process Gets A Facelift From The New Administration

Legal Issues

from the more-things-change-the-more-they-improve-incrementally dept

The Trump Administration has released a new version of the Vulnerabilities Equities Process — one nominally slanted towards greater transparency and outside participation. The previous process was broken in multiple ways, not the least of which was intelligence oversight’s general belief everything was fine even though the NSA didn’t follow the previous rules, despite statements to the contrary.

It’s unclear why this new VEP is appearing now. The new administration doesn’t seem particularly concerned about surveillance overreach or the legality of tactics deployed by the Intelligence Community. On the other hand, the up-cycling of undisclosed NSA exploits by malicious hackers has probably forced the government’s hand. It’s impossible to get ahead of criticism, especially when so many of the exploited exploits dated back several years. But perhaps it’s possible to head off future criticism with a diplomatic gesture, which is what this appears to be.

The new process does add more transparency, at least theoretically. White House Cybersecurity Coordinator Rob Joyce had this to say in his post announcing the remodeled VEP:

Improved transparency is critical. The American people should have confidence in the integrity of the process that underpins decision making about discovered vulnerabilities. Since I took my post as Cybersecurity Coordinator, improving the VEP and ensuring its transparency have been key priorities, and we have spent the last few months reviewing our existing policy in order to improve the process and make key details about the VEP available to the public. Through these efforts, we have validated much of the existing process and ensured a rigorous standard that considers many potential equities.

But there’s not much in the underlying documents that indicates how the new process will lend itself to more transparency. The mere existence of these documents is certainly more transparency than we’ve seen previously, which give outsiders a better view of the process. But beyond saying the vulnerabilities review process “may” result in additional reporting to Congress, nothing states definitively that more transparency will result from the new VEP’s implementation.

There are other concerns as well. As Bruce Schneier sees it, the VEP has been improved, but still allows the government to act as it pleases with minimal outside interference.

The devil is in the details, and we don’t know the details — and it has giant loopholes that pretty much anything can fall through…

[…]

This is me from last June:

There’s a lot we don’t know about the VEP. The Washington Post says that the NSA used EternalBlue “for more than five years,” which implies that it was discovered after the 2010 process was put in place. It’s not clear if all vulnerabilities are given such consideration, or if bugs are periodically reviewed to determine if they should be disclosed. That said, any VEP that allows something as dangerous as EternalBlue — or the Ciscovulnerabilities that the Shadow Brokers leaked last August — to remain unpatched for years isn’t serving national security very well. As a former NSA employee said, the quality of intelligence that could be gathered was “unreal.” But so was the potential damage. The NSA must avoid hoarding vulnerabilities.

I stand by that, and am not sure the new policy changes anything.

That the NSA and others must make use of software/hardware exploits to gather intelligence is inarguable. The problem isn’t the use of exploits, but rather that the government, almost without exception, sided with itself when balancing intelligence gathering against potential harm to innocent computer users. While the NSA insisted it turned over 90% of everything it found, personnel involved with the NSA’s Tailored Access Operations claimed they’d gone years without seeing a disclosure.

Joyce’s post also takes a swing at those opposed to the current implementation of the VEP. But his blow only hits strawmen.

There are advocates on both sides of the vulnerability equity issue who make impassioned arguments. Some argue that every vulnerability should be immediately disclosed to the vendor and patched. In my view, this is tantamount to unilateral disarmament. Our adversaries, both criminal and nation state, are unencumbered by concerns about transparency and responsible disclosure and will certainly not end their own programs to discover and exploit vulnerabilities.

While it’s true our nation’s enemies don’t participate in vulnerability disclosure, to claim we should act as irresponsibly is basically like saying it should be acceptable for US military forces to use children’s hospitals as operations headquarters just because our opponents have resorted to these tactics.

Vulnerability disclosure isn’t zero sum, no matter what Rob Joyce may imagine. The problems are nuanced. Discussions about solutions should be similarly refined.

Katie Moussouris, CEO of Luta Security Inc., said Joyce’s statement “is a false dichotomy between 100% disclosure versus the current process that puts zero-day vulnerabilities at the heart of the matter.”

“My assertion has always been to err on the side of disclosure to the vendor and seek a mission-focused alternative to using zero-day vulnerabilities in broadly deployed software,” Moussouris told SearchSecurity. “In some cases, not all, the objective of the mission could be completed via other means, such as exploiting misconfigurations or well-crafted phishing attacks, or even via zero-day exploits in localized, country-specific software instead. Exploitation of vulnerabilities for which a patch exists, but hasn’t been applied on the target system yet, is one such alternative.”

Is the new VEP better than the old one? Tough to say. We won’t know until it’s implemented, unfortunately. But the simple fact that there’s more information about the process brings it a step or two ahead of its predecessor.

Filed Under: disclosure, nsa, vep, vulnerabilities, vulnerabilities equities process

DOJ Still Demanding Identity Of Twitter Users Because Someone They Shouldn't Have Arrested Tweeted A Smiley Emoji

Legal Issues

from the this-case-remains-fucked-up dept

Last month, I had two blog posts about a particularly insane lawsuit being pushed by the Justice Department against a computer security researcher, Justin Shafer. As we explained, the arrest and prosecution of Shafer appeared to be the result of a truly ridiculous vendetta against Shafer by the FBI because Shafer got angry over a previous (and totally misguided) decision to raid his home, after he properly disclosed security problems involving some dental practice software. It seems clear that Shafer never should have been arrested (and never should have had the FBI raid his house three times over just a few months). Of course, what first brought the case to my attention was an even more ridiculous part of the story, in which the DOJ had sent a subpoena to Twitter demanding basically all info on five Twitter users — even though two of them don’t hide their identity — because Shafer tweeted a smiley emoji at them.

That story is even more insane than it sounds, but I’m not going to repeat the details here — I’ll just repeat: the case involved the DOJ demanding the identity (and more) of five Twitter users because someone else (who they’re railroading over bogus charges) sent a smiley emoji to them on Twitter where they were discussing a different lawsuit altogether.

We now have two updates on that story: (1) Shafer is appealing the fact that he’s still in jail, months later and (2) the DOJ has refused to withdraw the emoji subpoena. Yes. You read that right. The DOJ is doubling down, demanding the identity (and more) of Twitter users because someone they never should have arrested, sent a smiley emoji to them. We can cover that second point first because there’s not much more to say beyond “What the fuck is wrong with the DOJ?” As you may recall, the five Twitter users whose info was sought by the subpoena included @dawg8u (“Mike Honcho”), @abtnatural (“Virgil”), @Popehat (Ken White), @associatesmind (Keith Lee) and @PogoWasRight (Dissent Doe). Ken White and Keith Lee are both known (and each has blogged about the situation). The rest are at least partially pseudonymous. Dissent Doe, for one, has strong reasons for retaining anonymity, given her focus on data breaches and privacy issues. She revealed the DOJ’s stunning decision to keep going over the weekend, noting that she now needs to fight the subpoena in court.

Dissent Doe explained to me later that her lawyers have tried, repeatedly, to contact the DOJ about this ridiculous subpoena, and the DOJ has ignored all attempts to communicate. Twitter has told her that any motion to quash the subpoena needs to be filed this week. She also notes, appropriately, that she’s “really really ticked off” about all of this. We all should be.

And, just to be clear, there is no way the subpoena is even remotely Constitutional. Not even armchair lawyers could possibly think so. Over and over again, courts have said that anonymity is protected under the First Amendment, and you need to have very strong reasons to pierce the anonymity. The key case here is McIntyre v. Ohio Elections Commission, but plenty of others have weighed in since then. As we pointed out, the recent Awtry v. Glassdoor case nicely summarizes the history of cases protecting anonymity under the First Amendment:

The Supreme Court has recognized that ?an author?s decision to remain anonymous, like other decisions concerning omissions or additions to the content of a publication, is an aspect of the freedom of speech protected by the First Amendment.? McIntyre v. Ohio Elections Comm?n, 514 U.S. 334, 342 (1995). Indeed, ?[t]he right to speak anonymously was of fundamental importance to the establishment of our Constitution.? Doe v. 2TheMart.com Inc., 140 F. Supp. 2d 1088, 1092 (W.D. Wash. 2001) (citing McIntyre, 514 U.S. at 341-42). In particular, ?Justice Black . . . reminded us that even the arguments favoring the ratification of the Constitution advanced in the Federalist Papers were published under fictitious names.? McIntyre, 514 U.S. at 342 (citing Talley v. California, 362 U.S. 60, 64 (1960)). So too were the responses of the anti-federalists, which were published by authors who used such fictitious names as ?Centinel,? ?Brutus? and ?The Federal Farmer.? In re Anonymous Online Speakers, 661 F.3d 1168, 1172-73 (9th Cir. 2011).

Further, it is well-established that anonymous speech on the Internet, like other types of anonymous speech, enjoys First Amendment protection. In re Anonymous Online Speakers, 661 F.3d 1168, 1173 (9th Cir. 2011)(?online speech stands on the same footing as other speech?there is `no basis for qualifying the level of First Amendment scrutiny that should be applied? to online speech?) (quoting Reno v. Am. Civil Liberties Union, 521 U.S. 844, 870 (1997)). As the Ninth Circuit has explained, ?the ability to speak anonymously on the Internet promotes the robust exchange of ideas and allows individuals to express themselves freely without `fear of economic or official retaliation . . . [or] concern about social ostracism.’? Id.(quoting McIntyre, 514 U.S. at 341-42).

First Amendment protection of anonymous speech ?is not unlimited, however, and the degree of scrutiny varies depending on the circumstances and the type of speech at issue.? Id. Political speech is considered to be ?core? speech and is afforded the highest level of First Amendment protection. McIntyre, 514 U.S. at 346. Online messages such as the ones at issue here are also entitled to some level of First Amendment protection, even if the hurdle for overcoming that protection is less stringent than it is for political speech. See In re Anonymous Online Speakers, 661 F.3d 1168 at 1177; see also Highfields Capital Mgmt., L.P. v. Doe, 385 F. Supp. 2d 969 (N.D. Cal. 2005) (finding that identity of individual who anonymously posted derogatory comments about a company on an online message board was protected from disclosure under the First Amendment); Art of Living Foundation v. Does 1-10, No. 10-cv-5022 LHK, 2011 WL 5444622, at *5 (N.D. Cal. Nov. 9, 2011) (finding the standard articulated in Highfields applied to anonymously posted online commentary criticizing the plaintiff?s organization).

Given that tons of people are pointing this out publicly, what possible reason could the DOJ have for continuing to push Twitter to cough up this info other than to just be assholes?

As for the second update: Shafer has appealed the decision of a magistrate just revoking his pretrial release. The filing, by lawyers Tor Ekeland and Frederic Jennings, is… quite a read (and even cites my articles). It certainly doesn’t hold back:

The government accuses Justin Mark Shafer of putting an FBI agent and his wife in substantial emotional distress and publishing restricted information about that FBI agent with the intent to incite violence against him. But nowhere in the record, or in the discovery in this case, is there any true threat of violence against anyone. There is no explicit language articulating any kind of threat. The ?restricted? information in question was a prior home address for the FBI agent, publicly available on the internet. This entire case is built on innuendo and speculation that withstands neither constitutional nor statutory scrutiny. It is a chilling example of federal law enforcement overreach, and has serious ramifications for constitutional free speech and due process in relation to the internet and computer law. If the government?s accusations in this case are a crime, then millions of social media using Americans are subject to the prosecutorial whim of the Department of Justice.

The factual bases of the government?s bare bones indictment are a handful of public tweets; a Facebook friend request and message sent to a public Facebook account; the following of a public Twitter account;1 and two emails to an FBI Agent ? one with a ? emoji and another inquiring about the status of a report of a patient privacy violation. The Defendant made no attempt to mask his identity, and the FBI never contacted the Defendant to express any concern or to ask him to stop his communications. Instead they arrested him. And any claim that he engaged in a sustained course of conduct with a continuity of purpose to cyberstalk or threaten are ludicrous when compared to facts embodied in the case law regarding these statutes.

These accusations led to a pretrial release order so broad it functioned as a prior restraint on Mr. Shafer?s constitutional right to speak about the accusations made against him. When he sought to do so ? through a post on his work-related blog ? the magistrate judge revoked release, broadly interpreting the release condition terms and finding a violation of those conditions.

An innocent man?who the government has not charged, and cannot charge, with any violent crime, nor with any history of violent crime? is now in jail on the basis of protected speech.

I recommend people read the entire document, as it goes into great detail (even beyond my original posts) about the vindictive nature of the FBI’s vendetta against Shafer — not for doing anything wrong, mind you — but for being upset that the FBI raided his house and took all his electronics twice for completely bogus reasons. And it’s not just Shafer, but Shafers three kids who are now traumatized over the mutliple FBI raids, in which agents pointed weapons at the children, or denied their parents the ability to get the children out of their rooms for extended periods of time.

The children now suffer currently from trauma and substantial emotional distress as a result of the repeated armed FBI raids. The Shafers? three-year old is now unable to sleep alone in her room. Their (now) six-year old is struggling and withdrawn in school, where he previously excelled. Their ten-year old is now afraid to be near open shades, for fear of being surveilled…. Their father has not come home since April 18, 2017, because he is in jail awaiting trial.

As for why Shafer has been in jail all this time? Apparently it’s because he wrote a blog post about the case. You can read that blog post here. I wouldn’t necessarily say that the blog post was a good idea, because he’s clearly venting his anger about the arrest and the treatment by the FBI and Special Agent Nathan Hopp in particular. But it hardly meets the criteria of threatening Hopp or “contacting” him via social media. And yet, since Shafer was barred from either of those things as condition for pretrial release, he was brought back in and has been in jail ever since. That raises a whole new set of First Amendment questions. Shafer is in jail for blogging.

During the period of Mr. Shafer?s pretrial release, he committed no crimes. He used no illegal or prohibited substances. He neither fled nor attempted to flee. He did nothing that posed a threat to the safety of any person or the community. He simply wrote a blog post comprised of constitutionally protected speech criticizing his prosecution. (See Ex. C, April 14, 2017 Blog Post) For this he has been taken away from his wife and children.

Shortly after the blog post was published, Mr. Shafer received a notice of potential violation of his pretrial conditions of release.

On April 18, 2017, a revocation hearing was held before Magistrate Judge Toliver. The government referenced vague concerns regarding flight risk, and claimed that the blog post Mr. Shafer had written was evidence of danger to the community or violation of the no-contact order between Mr. Shafer and SA Hopp. The government argued at the revocation hearing that merely ?criticizing? SA Hopp in the ?blog site? [sic] was indirect contact. (Tr. 5:8-6:10 (Apr. 18, 2017).) At the close of the revocation hearing, Magistrate Judge Toliver revoked Mr. Shafer?s pretrial release order. He has been detained since.

More specifically, Shafer’s lawyers point out:

The original terms of his supervised release violated his free speech rights under the First Amendment. Imprisoning him pre-trial based on his speech is unconstitutional. This current, unconstitutional incarceration before an adjudication by a jury of his peers hampers Mr. Shafer?s ability to put on an effective defense, as he is not free to diligently prepare for his defense with his attorneys due to constant monitoring and harassment in jail. This violates his Fifth Amendment Due Process rights and his Sixth Amendment right to mount an effective defense. Moreover, none of Congress?s narrowly prescribed exceptions to an innocent defendant’s presumption of liberty apply here. Mr. Shafer should be released pre-trial under appropriate conditions because his current incarceration violates the Constitution and federal law.

Everything about this case is crazy. We’ve certainly seen overreach by the DOJ in the past, but this case seems like a pretty blatant example not just of overreach, and not just of the DOJ doing whatever the fuck it wants, but of it doubling down to violate the rights of people just because it doesn’t like being called out about it.

Filed Under: anonymity, cfaa, disclosure, dissent doe, doj, fbi, first amendment, identity, justin shafer, keith lee, ken white, nathan hopp, popehat, subpoena, vendetta
Companies: twitter

Police Camera Study Shows New Tech Having Little Effect On Misconduct And Excessive Force

Studies

from the can't-fix-a-broken-culture dept

The results of another police camera study are in and there’s not much good news in them. While cautiously hailed as tools of accountability, body worn cameras so far have proven to be anything but. In the early days of body camera adoption, a study of a pilot program in Rialto, California produced very positive results.

When cops in a Rialto, California were forced to wear cameras, their use of force dropped by over two-thirds. Additionally, the officers who were not made to wear the cameras used force twice as much as those who did. This strongly suggests the majority of the time police use force is unnecessary. In other words, the majority of the time these officers used force they were simply committing acts of violence which they don’t feel comfortable committing if it’s captured on film…

The Rialto study began in February 2012 and will run until this July. The results from the first 12 months are striking. Even with only half of the 54 uniformed patrol officers wearing cameras at any given time, the department over all had an 88 percent decline in the number of complaints filed against officers, compared with the 12 months before the study, to 3 from 24.

The study’s length suggested positive long-term results but the small sample size may have skewed the results. Another contributing factor could have been the “newness” of the devices themselves — something that may have led officers to act with more restraint than usual.

But as more and more police departments have deployed body cameras, the results have been less and less positive. A study published last year suggested body worn cameras actually led to an increase in violence — a 3.64% uptick in fatal shootings by officers. Of course, this increase may have been nothing more than a deviation from the mean. But it still pointed towards cameras being anything but a cheap, scalable fix for officer misconduct.

The latest report covers the Washington DC Metropolitan Police Department’s body camera pilot program. The data is drawn from 2,000 MPD officers over a period of 18 months. Again, the results suggest body cameras aren’t going to change policing for the better. From the report [PDF] (via the New York Times):

We learned that BWCs do not have detectable average effects on documented uses of force or civilian complaints.

More scientifically:

We are unable to reject the null hypotheses that BWCs have no effect on police use of force, citizen complaints, policing activity, or judicial outcomes. Because our study has a large enough sample size to detect small effect sizes, these failures to reject the null are unlikely to be due to insufficient statistical power, at least for uses of force and complaints. (Our estimates of average effects in the judicial outcomes category occasionally have much wider confidence intervals.) We consider here a few possible explanations for our null findings.

First and most obviously, it is possible the null finding needs no explanation: the devices, in fact, have no effect on the measured behaviors, and the video footage they produce has no effect on judicial outcomes. Perhaps neither the officer nor citizen involved in an interaction are actually aware of the camera, either due to attention being diverted elsewhere or desensitization over time to the presence of the cameras. Alternately, the officer and citizen may notice the cameras, but other factors in the heat of the moment may override any deterrent effect the cameras may have had.

Cameras do not act as a deterrent for police misconduct, according to these findings. There were case-by-case fluctuations, but the end result remained unchanged.

The report doesn’t discuss any outside factors possibly contributing to this lack of deterrence. But there are several reasons police behavior may remain unmodified after the deployment of cameras. Restrictive public records policies can insulate officers from accountability, leading to little or no change in police behavior. Fortunately, the Metro PD’s BWC footage policy does not automatically exempt it from public records laws, although it does tend to discourage complainants from seeking footage of possible misconduct.

A person alleging non-criminal misconduct related to an interaction with an MPD officer, such as rudeness and unprofessionalism on the part of the officer, shall be able to schedule a time to view unredacted BWC footage of the incident at the police station in the police district where the alleged misconduct occurred…

Another possible contributing factor is the lack of meaningful punishments for officers who fail to activate cameras or tamper with recorded footage. This may not have had much of an effect on this study, as officers knew they were being watched by the group performing the study. The report notes no instances of tampering or questionable camera activation were observed during the 18-month pilot period.

But the biggest contributing factor to zero change in officer behavior is police culture itself. The Metro PD has had its problems with misconduct and excessive force. This is from a 2001 DOJ report on the DC police.

Through analysis of a random sample, the DOJ determined that in approximately 15% of the use of force incidents, the force used by MPD officers was excessive, compared to an expected occurrence rate of 1 to 2%. Other DOJ findings included disproportionate incidents of force used by off-duty officers (14% of incidents); subjects being charged with “assault on a police officer” when force was deployed (1/3 of incidents); incidents of a gun not found on the subject, despite officers reporting that subject appeared to be reaching for a weapon (22% of incidents); and excessive incidents of police dog bites (bites occurring in 70% of canine deployments, compared to an expected bite rate of 10%). The DOJ determined that MPD lacked a comprehensive program to minimize the use of excessive force, had an inadequate system for investigating citizen complaints of officer misconduct, and had significant deficiencies in its training program.

Over the past decade, DC Metro Police has paid out $31.6 million in settlements and fielded nearly 175 civil rights lawsuits. And, in general, use of force by MPD officers has remained constant over the same time period, suggesting it takes a bit more to reach the “excessive force” plateau needed to sustain allegations against officers. While the PD has taken a proactive approach to misconduct and excessive force following the 1999 DOJ investigation, follow-up reports show the PD has narrowed its definition of “force” to exclude many forms of force deployment from its mandatory reporting.

If the consequences for misconduct are minimal, officers won’t change their behavior even if they’ve got cameras pinned to their chests. Cameras are only a small part of police accountability. The largest contributor to better behavior by officers is the department itself. If it makes de-escalation and respectful behavior a priority — and follows this up with serious punishments for violations — cameras will be filled with exonerating footage. If not, force deployments and potential misconduct will remain nearly unchanged as officers have little to fear even if the footage they capture shows them violating rights and deploying excessive force.

Filed Under: body cameras, cameras, disclosure, excessive force, misconduct, police, police brutality, transparency