The FBI has a new proposal afoot to require communications companies doing business in the US to make their communications technologies “wiretap-ready”, to avoid the “going-dark problem”. From Charlie Savage at the New York Times, six hours ago:
The Obama administration, resolving years of internal debate, is on the verge of backing a Federal Bureau of Investigation plan for a sweeping overhaul of surveillance laws that would make it easier to wiretap people who communicate using the Internet rather than by traditional phone services, according to officials familiar with the deliberations. […]
Currently, such orders instruct recipients to provide technical assistance to law enforcement agencies, leaving wiggle room for companies to say they tried but could not make the technology work. Under the new proposal, providers could be ordered to comply, and judges could impose fines if they did not.
Under the proposal, officials said, for a company to be eligible for the strictest deadlines and fines — starting at $25,000 a day — it must first have been put on notice that it needed surveillance capabilities, triggering a 30-day period to consult with the government on any technical problems.
Lord forbid that private companies should offer services that can’t be wiretapped by the government. If the FBI finds itself unable to routinely spy on the communications of people not yet suspected of any crime, that’s a feature, not a bug, and is in fact what the Fourth Amendment requires.
In America, this manic need to collect every iota of data is “helping defeat the terrorists” and “protecting the homeland”. When other countries do it, though, it’s a whole different story. Read on!
The NSA has just vigorously denied that their new Utah Data Center, intended for storing and processing intelligence data, will be used to spy on US citizens. The center will have a capacity of at least one yottabyte, and will provide employment for 100-200 people. With the most generous assumptions [200 employees, all employed only on reviewing the data, only one yottabyte of data, ten years to collect the yottabyte, 5GB per movie], each employee would be responsible on average for reviewing 4500 billion terabytes, or approximately 23 million years’ worth of Blu-ray quality movies, every year.
Must…keep…watching…my…country…needs…me
This astounding and continually increasing mismatch shows that we are well beyond the point where law enforcement is able to have a human review a manageable amount of the data in its possession potentially relating to terrorist threats. Computer processing power doubles every two years, but law enforcement employment is rising at a rate of about 7% every ten years, and nobody’s going to pay for it to double every two years instead. Purely machine-based review inevitably carries with it a far higher probability that important things will be missed, even if we were to suppose that the data was entirely accurate to begin with – which it certainly is not.
So why is anybody surprised that Tamerlan Tsarnaev, the elder of the Boston Marathon bombing suspects and one of around 750,000 people in the TIDE database, was not stopped at the border? That facial recognition software wasn’t able to flag him as a match for a suspect? That the fusion centers, intended to synthesize data into actionable “suspicious activity reports”, flag things too late for them to be of any use? That the Air Force is panicking a little at not having enough people to process the data provided by our drone fleet?
It’s in this context, then, that we should understand the calls for more surveillance after the Boston Marathon attacks for what they are. More cameras, more surveillance drones and more wiretapping, without many more humans to process the data, will make this problem worse, not better. These calls are being driven not by a realistic assessment that surveillance will help prevent the next attack, but by the internal incentives of the players in this market. Neither the drone manufacturers, nor law enforcement, nor elected officials, have an interest in being the ones to call a halt. So instead they’re promoting automation – automated drones, automated surveillance, and email scanning software techniques.
They are missing something very simple. We don’t need a terrorism database with 750,000 names on it. There are not 750,000 people out there who pose any sort of realistic threat to America. If the “terrorism watch list” were limited by law to a thousand records, then law enforcement would have to focus only on the thousand most serious threats. Given the real and likely manpower of the federal government, and the rarity of actual terrorism, that’s more than enough. If law enforcement used the power of the Fourth Amendment, instead of trying to find ways round it, it could focus more on the highest-probability threats.
Yes, they would miss stuff. That’s inevitable under both a tight and a loose system. But a tight system has the added advantages that it protects more people’s liberties, and costs a lot less.
UPDATE: With the help of a New Yorker fact-checker, the figure of “400 billion terabytes” above has been corrected to “500 billion terabytes”.
The Boston Marathon attacks have brought to the surface some of the best and the worst in Massachusetts.
On the one side, many news sources reported responsibly and refused to speculate too quickly and without foundation about who the bombers were or why they might have done what they did. There seems at this stage good evidence on which to base the arrest of Dzhokhar Tsarnaev. Above all, he was taken into custody quickly and alive, and Bostonians will be able to learn more about the motivations behind the attacks.
This is the blog for the Campaign for Digital Fourth Amendment Rights, so unsurprisingly I’m going to focus on some of the Fourth Amendment issues arising out of the attacks; principally, the stop of the Saudi marathoner and the search of his apartment in Revere, and the constitutional issues raised when a householder refuses entry to law enforcement during house-to-house searches for a fugitive.
Previously, we reported on the existence of stingrays, also known as `IMSI catchers’, which are used by law enforcement as mobile cellphone towers. Stingrays intercept location and other data from all cellphones in the area, redirecting the traffic from regular cellphone towers. They can be used to get cellphone data without having even to go through phone companies to get it.
Thanks to the case US v. Rigmaiden and terrific reporting from Kim Zetter on the Threat Level blog at Wired, we now have a much more comprehensive picture of how they work and what they can do. It turns out that Stingrays have been around for longer, can do much more and are much more widespread than we might have supposed, and that how much they are really used may well be unknown to the courts.
The newly formed Massachusetts chapter of PANDA is bringing forward legislation on Beacon Hill to prevent the indefinite detention of American citizens under the National Defense Authorization Act, or NDAA.
The notion that the President should be allowed to detain US citizens without trial and without limit in time of war is a horrifying idea, but not a new one. President Lincoln suspended the writ of habeas corpus during the Civil War. President Roosevelt interned Americans of Japanese descent during the Second World War. It had seemed by the early 1990s that we were recognizing that shameful past and leaving it behind. Then came 9/11.
In the aftermath of the attack, 1,200 Muslim Americans were detained on `material witness warrants’ and interrogated, often without any evidence beyond their religion. American citizen and civilian Jose Padilla was arrested in 2002, committed to a military brig for three and a half years, tortured and possibly driven insane, before being transferred to civilian court and sentenced to 17 years in prison in 2008, for conspiracy to conspire to commit terrorist acts abroad.
The US government in these cases was exceptionally anxious to preserve authority to detain anyone for any length of time, provided they could be vaguely associated with al-Qaeda. Many people expected that President Obama would abandon such arguments and restore the rule of law. In reality, he has allowed the power of indefinite detention to pass into law. In 2012, he issued a signing statement to that year’s NDAA (it’s an annual thing), claiming that he would never use the power of indefinite detention. That’s not even legally binding on him, let alone on his successors. In 2013’s bill, even that signing statement has disappeared from view. Hence, people in many states have been proposing bills like the Liberty Preservation Act.
Over the fold, for the details of what the Liberty Preservation Act would do!
One Catch-22 of criminal justice reform is that law enforcement will always ask for more powers, whether crime is down or crime is up. If crime is up, they need more powers to deal with criminals who have “gotten the upper hand.” If crime is down, they need more powers to keep it from rising again.
Mayor Menino attributes the drop to community policing and neighborhood watch groups, assisted by the more severe winter. It’s almost as if militaristic and confrontational policing is actually less effective at reducing crime than people like to think.
So, we have a simple challenge for Attorney-General Martha Coakley. How far does crime have to fall, before you back off on your biennial demand for vastly expanded powers to take out electronic wiretaps when investigating minor crimes? Lazy, “one crime is too many” thinking is not enough when our Fourth Amendment rights are on the line. We don’t just need better community policing; we need an AG’s office that is willing to look at criminalization as a problem rather than looking at every person drawn into the criminal justice system as a victory for them.
Shepard Fairey’s artwork for Internet anti-censorship campaign
Americans are used to thinking of ourselves as “rights pioneers.” But the American constitution is particularly difficult to amend, and is therefore slower than most to respond to a rapidly changing technological and cultural landscape. Justice Brandeis’s 1890 law review article on “The Right to Privacy” conceived of the Constitution as embodying a central, unarticulated “right to be let alone”, expressed as the “right to an inviolate personality.” Such a right was eventually recognized in the context of marriage by the US Supreme Court in Griswold v. Connecticut (1965), famously arguing in much-mocked language that “specific guarantees in the Bill of Rights have penumbras, formed by emanations from those guarantees that help give them life and substance.” The difficulty with embodying privacy as a right consists in the fact that nobody can define it clearly in a way that is not highly contingent on time-specific cultural and generational norms; we cannot say now, in 2013 and after the passage of (to name only two) marital rape laws and gay marriage laws, that the norms governing marital privacy are the same now as when Griswold was decided. Thus, culture and technology continually gallop ahead, while the law is still getting saddled up. In this post, we explore some innovative efforts to help the law catch up.
It’s not usually our dealio here at Digital Fourth to weigh in on federal digital rights, because terrific organizations like EFF, Fight for the Future, Demand Progress and the ACLU generally do that heavy lifting for us. But so much has happened regarding prosecutions under the Computer Fraud and Abuse Act that it’s worth focusing on what this law is, why it’s in such a mess, and what can usefully be done about it.
When originally passed way back in 1986, the intent of the CFAA was to ban hacking. This kind of hacking:
Wait, Ally Sheedy was in this?
In other words, what they were concerned about was access to “Federal interest computers”, namely computers belonging to the government, or at certain designated utilities like nuclear power stations or financial institutions. Now, however, the law covers pretty much any computer held by anyone.
Have you ever wondered why your Mondays have become an unending bliss of delight, falling upon you like Zeus visiting Danae in a shower of gold? It must surely be because of Microscope Monday, your weekly look at notable surveillance-related bills on Beacon Hill.
This week’s bill, tying in with our new Campaign to Close the Fusion Centers, is “An Act to protect freedom of speech and association”, more conveniently referred to as the “Free Speech Act”. The bill updates last legislative session’s “Act to protect privacy and personal data”, covered in October 2012 on this blog here. It was proposed by Assistant Majority Leader Sen. Harriette Chandler (D-Worcester) and Rep. Jason Lewis (D-Winchester). Its basic purpose is to deal with the fallout from the Policing Dissent scandal, where the Boston Police Department, in concert with the Boston Regional Intelligence Center, was found to have been spying on peaceful groups like Veterans for Peace and defining them as “extremists.” Protesters, including one person I knew, were hauled in and interrogated about their associates, without any actual crime having been committed.
We’re glad to see some action being taken to deal with these problems. But, what does the bill actually say?
[Artwork adapted slightly from Leo Reynolds on Flickr]
After the 9/11 attacks, a traumatized nation considered whether the attacks could have been thwarted by coordinating intelligence-gathering better between the FBI and CIA. From that impulse grew the fusion centers, of which there are now at least 7277 86 across the country. Us lucky SOBs here in Massachusetts get two, the Boston Regional Intelligence Center at One Schroeder Plaza, Roxbury, MA 02120 and the Commonwealth Fusion Center at 124 Acton Street, Maynard, MA 01754. The idea was that they would be able to thwart terrorist attacks before they occur, by gathering representatives from different agencies, and in some cases the military and the private sector, together to report on “suspicious activity”. In practice, it has not worked.
Thing is, actual terrorists are relatively thin on the ground. A network of 7277 86 fusion centers might handle three genuine cases of terrorism between them in any given year. That’s not enough to enable each fusion center to show that it’s doing anything at all. What’s a good bureaucrat to do?
