Jun 072013
 

President Obama’s Dragnet

The New York Times
by The Editorial Board
June 6, 2013

 

President Obama’s Dragnet

President Obama’s Dragnet

 

Within hours of the disclosure that federal authorities routinely collect data on phone calls Americans make, regardless of whether they have any bearing on a counterterrorism investigation, the Obama administration issued the same platitude it has offered every time President Obama has been caught overreaching in the use of his powers: Terrorists are a real menace and you should just trust us to deal with them because we have internal mechanisms (that we are not going to tell you about) to make sure we do not violate your rights.

Those reassurances have never been persuasive — whether on secret warrants to scoop up a news agency’s phone records or secret orders to kill an American suspected of terrorism — especially coming from a president who once promised transparency and accountability.

The administration has now lost all credibility on this issue. Mr. Obama is proving the truism that the executive branch will use any power it is given and very likely abuse it. That is one reason we have long argued that the Patriot Act, enacted in the heat of fear after the Sept. 11, 2001, attacks by members of Congress who mostly had not even read it, was reckless in its assignment of unnecessary and overbroad surveillance powers.

Based on an article in The Guardian published Wednesday night, we now know that the Federal Bureau of Investigation and the National Security Agency used the Patriot Act to obtain a secret warrant to compel Verizon’s business services division to turn over data on every single call that went through its system. We know that this particular order was a routine extension of surveillance that has been going on for years, and it seems very likely that it extends beyond Verizon’s business division. There is every reason to believe the federal government has been collecting every bit of information about every American’s phone calls except the words actually exchanged in those calls.

Articles in The Washington Post and The Guardian described a process by which the N.S.A. is also able to capture Internet communications directly from the servers of nine leading American companies. The articles raised questions about whether the N.S.A. separated foreign communications from domestic ones.

A senior administration official quoted in The Times online Thursday afternoon about the Verizon order offered the lame observation that the information does not include the name of any caller, as though there would be the slightest difficulty in matching numbers to names. He said the information “has been a critical tool in protecting the nation from terrorist threats,” because it allows the government “to discover whether known or suspected terrorists have been in contact with other persons who may be engaged in terrorist activities, particularly people located inside the United States.”

That is a vital goal, but how is it served by collecting everyone’s call data? The government can easily collect phone records (including the actual content of those calls) on “known or suspected terrorists” without logging every call made. In fact, the Foreign Intelligence Surveillance Act was expanded in 2008 for that very purpose.

Essentially, the administration is saying that without any individual suspicion of wrongdoing, the government is allowed to know whom Americans are calling every time they make a phone call, for how long they talk and from where.

This sort of tracking can reveal a lot of personal and intimate information about an individual. To casually permit this surveillance — with the American public having no idea that the executive branch is now exercising this power — fundamentally shifts power between the individual and the state, and it repudiates constitutional principles governing search, seizure and privacy.

The defense of this practice offered by Senator Dianne Feinstein of California, who as chairwoman of the Senate Intelligence Committee is supposed to be preventing this sort of overreaching, was absurd. She said on Thursday that the authorities need this information in case someone might become a terrorist in the future. Senator Saxby Chambliss of Georgia, the vice chairman of the committee, said the surveillance has “proved meritorious, because we have gathered significant information on bad guys and only on bad guys over the years.”

But what assurance do we have of that, especially since Ms. Feinstein went on to say that she actually did not know how the data being collected was used?

The senior administration official quoted in The Times said the executive branch internally reviews surveillance programs to ensure that they “comply with the Constitution and laws of the United States and appropriately protect privacy and civil liberties.”

That’s no longer good enough. Mr. Obama clearly had no intention of revealing this eavesdropping, just as he would not have acknowledged the killing of Anwar al-Awlaki, an American citizen, had it not been reported in the press. Even then, it took him more than a year and a half to acknowledge the killing, and he is still keeping secret the protocol by which he makes such decisions.

We are not questioning the legality under the Patriot Act of the court order disclosed by The Guardian. But we strongly object to using that power in this manner. It is the very sort of thing against which Mr. Obama once railed, when he said in 2007 that the surveillance policy of the George W. Bush administration “puts forward a false choice between the liberties we cherish and the security we provide.”

Two Democrats on the Senate Intelligence Committee, Ron Wyden of Oregon and Mark Udall of Colorado, have raised warnings about the government’s overbroad interpretation of its surveillance powers. “We believe most Americans would be stunned to learn the details of how these secret court opinions have interpreted Section 215 of the Patriot Act,” they wrote last year in a letter to Attorney General Eric Holder Jr. “As we see it, there is now a significant gap between what most Americans think the law allows and what the government secretly claims the law allows. This is a problem, because it is impossible to have an informed public debate about what the law should say when the public doesn’t know what its government thinks the law says.”

On Thursday, Representative Jim Sensenbrenner, Republican of Wisconsin, who introduced the Patriot Act in 2001, said that the National Security Agency overstepped its bounds by obtaining a secret order to collect phone log records from millions of Americans.

“As the author of the Patriot Act, I am extremely troubled by the F.B.I.’s interpretation of this legislation,” he said in a statement. “While I believe the Patriot Act appropriately balanced national security concerns and civil rights, I have always worried about potential abuses.” He added: “Seizing phone records of millions of innocent people is excessive and un-American.”

Stunning use of the act shows, once again, why it needs to be sharply curtailed if not repealed.

 

Mar 312013
 

FBI Phone Snooping Tactic Ruled Unconstitutional

Security Week
by AFP
March 15, 2013

FBI Phone Snooping Tactic Ruled Unconstitutional

FBI Phone Snooping Tactic Ruled Unconstitutional

 

SAN FRANCISCO –

A US judge has ordered the FBI to stop its “pervasive” use of National Security letters to secretly snoop on phone and email records, ruling Friday that the heavily used tactic was unconstitutional.

The order issued by US District Court Judge Susan Illston in San Francisco came as a surprising blow to a measure heavily used by the administration of President Barack Obama in the name of battling terrorism.

The Patriot Act passed after the devastating September 11 attacks gave the Federal Bureau of Investigation strong authority to order that people’s telecom records be handed over, without such requests having to be disclosed.

But in her ruling, Illston said evidence indicated that tens of thousands of NSLs are sent out every year, and that 97 percent of them are fettered with the provision that recipients never mention the requests.

“This pervasive use of nondisclosure orders, coupled with the government’s failure to demonstrate that a blanket prohibition on recipients’ ability to disclose the mere fact of receipt of an NSL is necessary to serve the compelling need of national security, creates too large a danger that speech is being unnecessarily restricted,” Illston said in her written decision.

Illston set her ban on NSLs to take effect in 90 days to allow US lawyers to appeal the decision given “the significant constitutional and national security issues at stake.”

The judge’s ruling came in a lawsuit filed in 2011 by Internet rights law group Electronic Frontier Foundation on behalf of an unnamed telecom company.

“We are very pleased that the court recognized the fatal constitutional shortcomings of the NSL statute,” said EFF Senior Staff Attorney Matt Zimmerman.

“The government’s gags have truncated the public debate on these controversial surveillance tools.”

It was the potential for gag orders accompanying NSLs to violate the First Amendment right of free speech that prompted the ruling, according to Zimmerman.

Direct Link:  http://www.securityweek.com/fbi-phone-snooping-tactic-ruled-unconstitutional

Mar 062013
 

FBI ‘secretly spying’ on Google users, company reveals

FOX News
March 6, 2013

Electronic Communications Privacy Act

Electronic Communications Privacy Act

  • Google National Security Letters 1.jpg

     


    Mar. 5, 2013: Google has revealed some information about the FBI’s use of National Security Letters to seek information — an unprecedented win for privacy, experts said. (Google)

The FBI used National Security Letters — a form of surveillance that privacy watchdogs call “frightening and invasive” — to surreptitiously seek information on Google users, the web giant has just revealed.

Google’s disclosure is “an unprecedented win for transparency,” privacy experts said Wednesday. But it’s just one small step forward.

“Serious concerns and questions remain about the use of NSLs,” the Electronic Frontier Foundation’s Dan Auerbach and Eva Galperin wrote. For one thing, the agency issued 16,511 National Security Letters in 2011, the last year for which data was available. But Google was gagged from saying just how many letters it received — leaving key questions unanswered.

“The terrorists apparently would win if Google told you the exact number of times the Federal Bureau of Investigation invoked a secret process to extract data about the media giant’s customers,” Wired’s David Kravets wrote. He described the FBI’s use of NSLs as a way of “secretly spying” on Google’s customers.

National Security Letters are a means for the FBI to obtain information on people from telecommunications companies, authorized by the Electronic Communications Privacy Act (ECPA) and expanded under the Patriot Act. It lets the agency seek information on a subscriber to a wire or electronic communications service, although not things like the content of their emails or search queries, Google said.

And thanks to secrecy constraints built into NSLs, companies that receive them usually aren’t even allowed to acknowledge the request for information. Citing such extreme secrecy, privacy experts have decried the use of these letters in the past.

“Of all the dangerous government surveillance powers that were expanded by the USA PATRIOT Act, the National Security Letter (NSL) power … is one of the most frightening and invasive,” the EFF wrote. “These letters … allow the FBI to secretly demand data about ordinary American citizens’ private communications and Internet activity without any meaningful oversight or prior judicial review.”

Thanks to negotiations with the government, Google finally opened the smallest chink in the armor, allowing the search giant to reveal the fact that it had received these requests for data, as well as some general information about them.

“Visit our page on user data requests in the U.S. and you’ll see, in broad strokes, how many NSLs for user data Google receives, as well as the number of accounts in question,” Richard Salgado, Google’s legal director of law enforcement and information security, wrote in a Tuesday blog post.

A new table posted to Google’s Transparency Report site outlines the details; it tabulates how many requests for information the company has received over each of the past four years: some undisclosed number between 0 and 999. With those NSLs, the FBI sought information on somewhere between 1,000 and 1,999 users/accounts.

“People don’t always use our services for good, and it’s important that law enforcement be able to investigate illegal activity,” Salgado wrote.

No other technology company presently disclose such basic information about government requests, experts noted.

Jul 112012
 

DNS Changer Malware may have affected 47,000 Americans

 

Los Angeles Times

By Salvador Rodriguez

July 9, 2012

 

 

As many as 47,000 Americans may have lost Internet access Monday after the FBI shut down servers supporting computers that were infected by malware. (Karen Bleier/AFP/Getty Images)

 

The FBI finally shut off servers Monday morning that at one point supported millions of users infected by the DNS Changer Malware, leaving as many as 47,000 Americans disconnected from the Internet.

Though the FBI with the help of various organizations and companies was able to reduce the number of infected computers from 4 million to less than 250,000 in the last few months, several hundred thousand users were still affected by the 12:01 a.m. Eastern time cut off Monday morning.

The U.S. was left with the most affected users after the cutoff, according to security firm F-Secure, which put up a blog with stats Monday.

The U.S. had as many as 47,054 users still infected over the weekend. That was followed by Italy in second place with 21,508 users, and India came in the third spot, with 19,991 infected users.

The DNS Changer problem began as a result of an online advertising scam that ended up infecting 4 million computers worldwide. The FBI put an end to the scheme, but the government agency realized that turning off the servers running the malware would have taken down all those computers from the Internet.

As a solution, the FBI set up two servers to continue providing access for the infected users, set a date for when they would be shut down and began raising awareness.

If your computer or the computer of someone you know has been affected, there are steps that can be taken to remedy the problem.

For a list of what to do from an expert organization, head here. Essentially, what you may need to do is back up your computer, have an expert wipe it clean of the malware, reformat your hard drive and reinstall everything.

For future reference, make sure to browse the Web more securely. Don’t click links or open documents from untrusted email addresses, and when you enter logins and passwords, make sure you are entering them to trustworthy organizations and in their actual websites — not lookalikes built to take your information.

 

ALSO:

Apple removes malware app that made its way into App Store

Don’t want to lose the Internet on Monday? Check for malware now

Malware may knock 64,000 Americans off Internet on Monday morning

 

Direct Link:  http://www.latimes.com/business/technology/la-fi-tn-dns-changer-47000-20120709,0,777095.story

Jul 092012
 

The FBI’s Secret Surveillance Letters to Tech Companies

 

The Wall Street Journal

Digits

By Jennifer Valentino-DeVries

June 27, 2012

 

 

 

 

Just what kind of information can the government get with a so-called “national security letter” – the tool that allows investigators to seek financial, phone and Internet data without a judge’s approval?

It’s a secret.

 

Information requested on phone records

The letters let the Federal Bureau of Investigation get information without going before a judge or grand jury if it’s relevant to a national security investigation. The letters have been around since the 1980s, but their use grew after the Sept. 11, 2001 terrorist attacks and passage of the USA Patriot Act. Tens of thousands of the requests are sent each year, but they are generally subject to strict secrecy orders.

In response to a Freedom of Information Act request by the American Civil Liberties Union, the Justice Department has revealed for the first time templates for each of the types of national security letters it sends – nine in all. Among other things, the letters show that the FBI is now informing people who receive the letters how they can challenge the documents in court.

But some key elements of the letters remain blocked from view – including lists of material the FBI says companies can send in response to the letter.

The most basic requests outlined in the templates are for name, address and length of service for either phone or Internet accounts. The broadest requests seek things such as entire credit reports, Internet activity logs, phone “billing records,” “financial records” or “electronic communications transactional records.”

What exactly do those terms mean? Well, there’s the rub.

A 2008 opinion from the Justice Department’s legal counsel found that the letters could request “only those categories of information parallel to subscriber information and toll billing records for ordinary telephone service.” What exactly counts as “parallel” could be debated.

In several of the templates, the FBI includes a list of specific items that “may be considered” by the companies to be responsive to the requests. The list for phone billing records includes 15 bullet points; there are 13 points on the list for electronic data. The items associated with financial records appear to stretch on for two pages. But we can’t know for sure what is there because it has been redacted.

Some broad outlines are available: Financial records include “any record held by a financial institution pertaining to a customer’s relationship with the financial institution.”

Electronic records involve “transaction/activity logs” and email “header information,” which includes things such as the “to” and “from” lines of a message.

The letters point out that companies aren’t supposed to tell investigators about the content of their customers’ messages; courts have long held that phone conversations and the texts of recent emails are available only with search warrants. The template to get electronic records specifically warns companies not to provide the subject lines of emails for this reason.

Beyond that, it’s unclear.

“There is a growing divide between the government’s and the public’s understanding of the government’s surveillance authority,” said Alexander Abdo, a staff attorney with the ACLU. “To this day, the government refuses to specify what certain surveillance laws—including ‘national security letters’—allow it to collect.”

The government says it seeks only the information it’s allowed to get and must maintain the secrecy of national security letters to avoid tipping off potential terrorists.

“NSLs are integral to determining whether, how, and by whom our nation is being put at risk,” then Acting Assistant Attorney General for National Security Todd Hinnen told a House Judiciary subcommittee last year in written remarks.

The templates disclosed in the ACLU files show how the FBI has changed the letters in response to court rulings and new laws. The gag order that accompanies most of the letters is no longer an “automatic feature,” the FBI says in instructions to agents. To get a secrecy order, the agent must certify that disclosure “may endanger the national security of the United States, interfere with a criminal, counterterrorism, or counterintelligence investigation, interfere with diplomatic relations, or endanger the life of physical safety of a person.”

In all of the letters, the FBI tells the recipient that it can challenge the letter “if compliance would be unreasonable, oppressive, or otherwise unlawful.” It also outlines a process for fighting the nondisclosure order: The company has 10 days to tell the FBI it wants to challenge the gag order, and the FBI says it will then “initiate judicial proceedings” to get a court order to enforce the gag.

In the first two years after the FBI began including this notice in its letters, only a handful of companies challenged the gag orders, the FBI has said.

Many major technology companies have guidelines for handling national security letters, although they cannot confirm or deny ever having received the letters, under the strict secrecy order that accompanies most of the requests. Mr. Hinnen told the subcommittee last year that a “small number of providers” had concluded that the FBI wasn’t entitled to electronic communications transactional records, because the law wasn’t clear.

Companies are reluctant to disclose their specific policies, though. In responses to questions from The Wall Street Journal, Facebook was the only company to say specifically what data it would give out.

“We interpret the national security letter provision as applied to Facebook to require the production of only two categories of information: name and length of service,” said Fred Wolens, a public policy spokesman for the social networking giant.

Other companies were more vague. Google and Twitter both said their companies comply with “valid legal process” and seek to notify users of requests whenever possible. Verizon and AT&T both said they do not comment on national security matters.

 

Direct Link:  http://blogs.wsj.com/digits/2012/06/27/the-fbis-secret-surveillance-letters-to-tech-companies/