Friday, January 12, 2007

2006 Privacy Year in Review. michaelzimmer.org 2006 Privacy Year in Review. Both CNet and EPIC have released their Privacy Year in Review for 2006. Some highlights from CNet[base ']s 2006: A privacy and surveillance year in review: Gonzales: NSA may tap [OE]ordinary[base '] Americans[base '] e-mail (February 6, 2006): During Senate hearing, attorney general declines to offer reassurances about a secret surveillance program. Judge: Google must give feds limited access to records (March 17, 2006): Privacy-aware ruling says search giant must turn over a swath of indexed URLs[^]but not users[base '] queries. Appeals court upholds Net-wiretapping rules (June 9, 2006): Bush administration[base ']s Net surveillance plans receive boost from appeals court, which refused to overturn rules. Feds appeal loss in NSA wiretap case (July 31, 2006): Bush administration asks the 9th Circuit to halt a lawsuit that accuses AT&T of illegally opening its network to the NSA. AOL[base ']s disturbing glimpse into users[base '] lives (August 7, 2006): Release of three-month search histories of about 650,000 users provides rare glimpse into their private lives. RFID passports arrive for Americans (August 14, 2006): State Department to begin handing out RFID-equipped passports despite lingering security, privacy concerns. FBI director wants ISPs to track users (October 17, 2006): Robert Mueller becomes latest Bush administration official to call for ISPs to store customers[base '] data. FBI taps cell phone mic as eavesdropping tool (December 1, 2006): Agency used novel surveillance technique on alleged Mafioso: activating his cell phone[base ']s microphone and then just listening. And EPIC[base ']s Top 10 Privacy Stories of 2006: Millions of Military Records Go Missing: In 2006, a stolen laptop with the records of 27 million American veterans and active duty military personnel gripped the nation and produced Congressional hearings, new legislation, and new policies for government employees who take their work home with them. Veterans Affairs Secretary Jim Nicholson tried to explain to Congress why it took almost two weeks before he was notified about the missing data which included information on 1.1 million active service members, 430,000 National Guardsmen, 645,000 Reserve members and the names, birth dates and Social Security numbers of about 26 million people, most of them veterans. Identity Theft Keeps Top Spot: The Federal Trade Commission [michaelzimmer.org] 11:31:11 PM  PermaLink   / trackback []

Investigator Charged in HP Scandal Pleads Guilty. Investigator Charged in HP Scandal Pleads Guilty. First federal conviction in HP spying case. [PC World: Latest Technology News] 11:26:33 PM  PermaLink   / trackback []

The Business Travel Coalition on the Automated Targeting System (ATS) By notice published on November 2, 2006 in the Federal Register, the Department of Homeland Security, U.S. Customs and Border Protection, acknowledged the existence of a system-of-records known as the Automated Targeting System (ATS) that will assign risk assessments to millions of U.S. and non-U.S. travelers who enter and exit the U.S. ATS has apparently been in an operational testing mode for 4 years without the knowledge of Congress or the traveling public, American and foreigner alike. The Business Travel Coalition (BTC) submits these comments to raise serious concerns related to said system-of-records and to urge the Department to a) abandon the December 4, 2006 official program implementation date; b) provide substantially more details on the program to the public beyond the Privacy Impact Statement released just one week ago; and c) per the requirements of the Privacy Act of 1974, replace its current truncated comment process via the Federal Register with an official rulemaking with a significant public comment period. The Department has stated that the program "will be effective December 4, 2006, unless comments are received that result in a contrary determination." BTC believes that the serious problems raised in its filed comments herein, and those of other individuals and prominent organizations who have filed comments, indisputably require such a "contrary determination." Fundamental Problem The Department characterizes ATS, which originated as a cargo screening program 4 years ago, as "one of the most advanced targeting systems in the world." Indeed, this system represents a historically unparalleled, massive data-mining initiative the parameters of which would: a) allow for the collection of all manner of personal information on innocent citizens without their prior consent; b) forbid citizens from accessing and correcting inaccuracies in their personal government dossiers; c) provide for the sharing of such information with foreign governments and third parties, including prospective employers; and d) retain individuals' information for 40 years. Evolving ATS from a publicly-supported cargo screening program begun 4 years ago to a secretively implemented global traveler screening program represents "Exhibit A" in the case against Mission Creep. 11:23:36 PM  PermaLink   / trackback []

Schneier on Security: Automated Targeting System If you've traveled abroad recently, you've been investigated. You've been assigned a score indicating what kind of terrorist threat you pose. That score is used by the government to determine the treatment you receive when you return to the U.S. and for other purposes as well. Curious about your score? You can't see it. Interested in what information was used? You can't know that. Want to clear your name if you've been wrongly categorized? You can't challenge it. Want to know what kind of rules the computer is using to judge you? That's secret, too. So is when and how the score will be used. U.S. customs agencies have been quietly operating this system for several years. Called Automated Targeting System, it assigns a "risk assessment" score to people entering or leaving the country, or engaging in import or export activity. This score, and the information used to derive it, can be shared with federal, state, local and even foreign governments. It can be used if you apply for a government job, grant, license, contract or other benefit. It can be shared with nongovernmental organizations and individuals in the course of an investigation. In some circumstances private contractors can get it, even those outside the country. And it will be saved for 40 years. Little is known about this program. Its bare outlines were disclosed in the Federal Register in October. We do know that the score is partially based on details of your flight record--where you're from, how you bought your ticket, where you're sitting, any special meal requests--or on motor vehicle records, as well as on information from crime, watch-list and other databases. Civil liberties groups have called the program Kafkaesque. But I have an even bigger problem with it. It's a waste of money. The idea of feeding a limited set of characteristics into a computer, which then somehow divines a person's terrorist leanings, is farcical. Uncovering terrorist plots requires intelligence and investigation, not large-scale processing of everyone. Additionally, any system like this will generate so many false alarms as to be completely unusable. In 2005 Customs & Border Protection processed 431 million people. Assuming an unrealistic model that identifies terrorists (and innocents) with 99.9% accuracy, that's still 431,000 false alarms annually. 11:20:03 PM  PermaLink   / trackback []

Homeland Security's Latest Passenger Screening Program Criticized. Homeland Security's Latest Passenger Screening Program Criticized. The Automated Targeting System (ATS) passenger screening program, formally announced by the Department of Homeland Security (DHS) in November, assigns a risk score to international air travelers bound for the U.S. that is intended to show the degree to which each traveler poses a terrorist risk. The scores can be kept for up to 40 years and DHS may share the information widely among federal, state, and international agencies. Although everyone except terrorists and their supporters wants DHS to stop terrorists from boarding planes bound for the U.S., the ATS has been widely criticized. EPIC's website includes a useful summary and links. The attacks on the ATS fall into three categories. First, security experts say flatly that the ATS won't work. For example, Bruce Schneier says: It's a waste of money. The idea of feeding a limited set of characteristics into a computer, which then somehow divines a person's terrorist leanings, is farcical. Uncovering terrorist plots requires intelligence and investigation, not large-scale processing of everyone. Additionally, any system like this will generate so many false alarms as to be completely unusable. In 2005 Customs & Border Protection processed 431 million people. Assuming an unrealistic model that identifies terrorists (and innocents) with 99.9% accuracy, that's still 431,000 false alarms annually. Second, due to concerns about the utility of data mining programs and their effects on innocent passengers' civil liberties, Congress prohibited DHS from spending funds "to develop or test algorithms assigning risk to passengers whose names are not on Government watch lists." Section 514(e), 2007 DHS Appropriations Act. Similar language was inserted in the last three DHS appropriations acts, according to Representative Martin Sabo of Minnesota, one of the sponsors of the language. "They keep going off on these wild scenarios on a regular basis," Representative Sabo is quoted as saying. "They should concentrate on making their watch lists comprehensive and correctable." Id. Privacy experts Marc Rotenberg at EPIC and James Harper of the Cato Institute argue that section 514(e) of the 2007 DHS Appropriations Act prohibits ATS, though DHS disagrees. DHS's arguments around the spending ban are weak but it's unlikely those arguments will be tested in court. The Appropriation Act does not authorize a private right of action to enforce the spending ban, so there is little chance passengers could successfully bring an action to enforce it. See, e.g., California v. Sierra Club, 451 U.S. 287, 294-98 (1981). Finally, the EFF, the Business Travelers Coalition, and others argue that the ATS violates the Privacy Act. The EFF has asked a federal court in the D.C. to order DHS to expedite an EFF FOIA request that appears intended to gather information for a Privacy Act lawsuit challenging the ATS. The ATS controversy may just be getting underway. [Privacy and Security Law Blog] 11:16:46 PM  PermaLink   / trackback []

AACS: Game Theory of Blacklisting. AACS: Game Theory of Blacklisting. This is the fourth post in our series on AACS, the encryption scheme used for HD-DVD and Blu-Ray discs. (Part 1, part 2, part 3) We've already discussed how it's possible to reverse engineer an AACS-compatible player to extract its secret set of device keys. With these device keys you can extract the title key from any disc the player can play, and the title key allows anyone else with the same disc to decrypt the movie. Yesterday we explained how the AACS central authority has the ability to blacklist compromised device keys so that they can't be used to decrypt any discs produced in the future. This defense is limited in two obvious ways: the central authority needs to know which keys have been compromised in order to put them on the blacklist, and this only protects future discs, not ones that have already been produced. It turns out there's a third way in which blacklisting is limited. Counterintuitively, it is sometimes in the central authority's best interest not to blacklist a compromised device key even when they have the ability to do so. We can model one such scenario as a simple game between the central authority and an attacker. Suppose there is only one attacker who has compromised a single player and extracted its device keys. Initially, he keeps the device keys secret (for fear they will be blacklisted), but he and his friends acquire some number of discs every week and post the title keys on the web. Let's also suppose that the central authority has enough resources to infiltrate this cabal and learn which player has been cracked, so that they can blacklist the device keys if they wish. The authority faces a very interesting dilemma: if it does blacklist the keys, the attacker will have no reason to keep them secret any longer. He will publish them, irrevocably breaking the encryption on all previously released discs. If the authority doesn't blacklist the keys, the attacker will continue to trickle out title keys for certain movies, but the rest will remain secure. In other words, the authority needs to weigh the value of continuing to protect all the old discs for which title keys have not been published against the value of protecting the new releases that will be cracked if it doesn't blacklist the keys. The result is that the central authority will need to exercise more restraint than we would naively expect when it comes to blacklisting. Once attackers realize this, they will adjust how quickly they release title keys until they are just below the threshold where the authority would resort to blacklisting. Things get even more interesting if we consider a more realistic scenario where different players are gradually cracked over time. We'll write more about that next week. Share This [Freedom to Tinker] 11:13:31 PM  PermaLink   / trackback []

Civil rights groups slam San Francisco surveillance expansion. Civil rights groups slam San Francisco surveillance expansion. Urge opposition at next week's police commission hearing The Electronic Frontier Foundation, the Northern California chapter of the American Civil Liberties Union and other groups are spearheading opposition to a plan by the San Francisco Police Department to install 25 new surveillance cameras throughout the city. [The Register - Internet and Law: Digital Rights/Digital Wrongs] 11:08:58 PM  PermaLink   / trackback []

Spocko, KSFO, and the Blogosphere's Allergy to Copyright Thuggery. Spocko, KSFO, and the Blogosphere's Allergy to Copyright Thuggery. Over the past year, a self-described "fifth-tier blogger" who publishes under the pseudonym Spocko (www.spockosbrain.com) posted audio clips of what he deemed to be offensive and violent talk radio rhetoric from ABC-owned and San Francisco-based KSFO-AM and apparently succeeded in encouraging several advertisers to pull their ads from the station. ABC-corporate struck back, sending a vague, threatening letter to his hosting company, 1&1 Internet, who promptly shut him down instead of standing up for his rights. (Spocko, now back online, subsequently moved his business to Computer Tyme, a host with more backbone.) EFF has agreed to defend Spocko if he is sued by ABC and/or KSFO over their allegations of copyright infringement, but it more than likely won't come to that. As ABC's lawyers know, the brief audio clips posted on Spocko[base ']s blog are classic examples of protected fair use, the right to use copyrighted materials for purposes of commentary, parody, education, or artistic expression. That important detail -- and the fact that KSFO's corporate counsel misrepresented Spocko's legal position in a briefly successful attempt to snuff out his blog -- are conspicuously absent from KSFO's discourse these days, at least so far. A far better response than the embarrassing legal posturing we've see thus far is what KSFO apparently has on tap for later today (Friday, January 12th). Melanie Morgan, co-host of KSFO's Morning Show, one of the targets of Spocko's criticism, yesterday announced that at least three hours of special programming will be dedicated to addressing the Spocko controversy, beginning at 12:00 pm PT today. Responding to critical speech with more speech is almost always the right response. Better late than never in this case. Unfortunately, the station has begun arguing (ironically enough) that criticism of their content amounts to censorship. Morgan yesterday blasted Spocko and his "stalker friends on the Internet" who, according to Morgan, are trying to "take away our free speech rights." Sorry, KSFO. Not quite. While such radio personalities certainly have a right to air their views, the First Amendment says nothing about a right to advertiser-subsidized speech. Even if advertisers choose to pull their ads because Spocko has a more convincing argument -- even if advertiser revenue dries up completely and shows are cancelled -- it doesn't necessarily follow that anyone's free speech rights have being violated. Rough and tumble speech is often protected speech nonetheless, as KSFO well knows, and the "marketplace of ideas" promoted and protected by the First Amendment frequently results in definite winners and losers. KSFO, quick to call out the attack lawyers yet slow to respond to the concerns of advertisers, is rapidly embracing that loser mantle. [EFF: Deep Links] 11:06:52 PM  PermaLink   / trackback []

Take Action: Defend Your Right to Record Off the Radio! Take Action: Defend Your Right to Record Off the Radio!  The new Congress has barely begun, but the major record labels are already up to their old tricks. Sen. Dianne Feinstein has re-introduced the PERFORM Act, a backdoor assault on your right to record off the radio. Satellite and digital radio stations as well as Internet webcasters would have to adopt digital rights management (DRM) restrictions or lose the statutory license for broadcasting music. Letters from constituents like you helped beat this dangerous proposal last year -- take action now to block it again. This bill aims to hobble TiVo-like devices for satellite and digital radio. Such devices would be able to include "reasonable recording" features, but that excludes choosing and playing back selections based on song title, artist, or genre. Want to freely move recordings around your home network or copy them to the portable player of your choice? You'll be out of luck if PERFORM passes. This bill would also mess with Internet radio. Today, Live365, Shoutcast, streaming radio stations included in iTunes, and myriad other smaller webcasters rely on MP3 streaming. PERFORM would in effect force them to use DRM-laden, proprietary formats, so you can say goodbye to software tools like Streamripper that let you record programming to listen to it later. Tell your representatives to reject this bill now. [EFF: Deep Links] 11:04:06 PM  PermaLink   / trackback []

EFF's Sweet 16 Party a Success. EFF's Sweet 16 Party a Success. Thanks to everyone that attended our party Thursday night! The event at the 111 Minna Gallery to celebrate our 16th year was packed with hundreds of civil libertarians and digital luminaries. In addition to having fun and mingling with our many beloved supporters, EFF raised several thousand dollars in cash donations. As an added bonus, we had the pleasure of receiving a check in the amount of $3561 from Laughing Squid founder Scott Beale, raised through an online auction. Thanks, Scott! The outpouring of support proves we'll be here for another 16 years, fighting to defend your digital rights. [EFF: Deep Links] 11:01:42 PM  PermaLink   / trackback []

Public Knowledge Disappointed with PERFORM Act. Public Knowledge Disappointed with PERFORM Act. For Immediate Release Contact: Art Brodsky, 202-518-0020 (o), 301-908-7715 (c), abrodsky@publicknowledge.org Background: Senators Dianne Feinstein, Lindsey Graham, Joe Biden and Lamar Alexander yesterday introduced the PERFORM Act (S 256), legislation identical to that introduced last year. The following statement is attributable to Gigi B. Sohn, president of Public Knowledge: read more [Public Knowledge - Press Releases] 10:56:48 PM  PermaLink   / trackback []

The Spammer-as-Hit Man Scam. The Spammer-as-Hit Man Scam. The FBI is warning people not to be alarmed if they receive the latest e-mail scam going around, which purports to have been sent by a hit man who was hired to rub out the recipient. The message claims that the assassin will cancel the contract if the recipient agrees to pay a large sum of money. According to the FBI advisory, the message warns that an individual was recently arrested for the murders of several U.S and British citizens who declined to pay up. The scam also says the recipient's name and other information was found on the last person targeted by the hit man, identifying the e-mail recipient as the next victim on the hit list. As the feds appropriately caution, replying to any type of mass e-mail (for all its supposed specificity, this scam does not appear to address the recipient by name) is a bad idea that can only lead to bad things. Here's a great rule of thumb for all unsolicited e-mail: When in doubt -- toss it out. Still, the FBI warns, "Due to the threat of violence inherent in these extortion e-mails, if you receive an e-mail that contains personally identifiable information that might differentiate your e-mail from the general e-mail spam campaign, we encourage you to contact the police." [Security Fix] 10:54:49 PM  PermaLink   / trackback []