Skating on Stilts

Don't Change the Channel! We left Fox News out of the Privacy Assessment!

With his usual nudge-and-wink, Matt Drudge invites us to be dismayed that "BIG SIS" -- his moniker for Janet Napolitano -- is "Monitoring Web Sites for Terror and Disaster Info." Drudge links to a story saying that DHS will be monitoring social media like Twitter, as well as websites like Drudge, to keep abreast of events during the Winter Olympics. The source of the story is a twelve-page "Privacy Impact Assessment" issued by DHS.

This isn’t the first Privacy Impact Assessment (PIA) on DHS's use of social media. A few weeks earlier, DHS wrote a similar assessment of using social media during Haitian rescue operations.

I am indeed dismayed, but not for Drudge's reasons. True, it's disappointing that neither the Volokh Conspiracy nor www.skatingonstilts.com is deemed worthy of government monitoring. But what’s really dismaying is that DHS and its Privacy Office felt obliged to labor over two separate and painfully obvious privacy assessments just to do things that you and I would do by simply firing up our browsers.

The Olympics PIA says in the first paragraph that DHS “is only monitoring publicly available online forums, blogs, public websites, and message boards.” Which should pretty much end the discussion.

The government ought to be able to read the papers or watch TV or look at blogs just like anyone else. Or so you’d think. But no, the PIA drones on and on, offering thirty variations of “Hey, this stuff is public” as it assesses the “privacy impact” of, uh, surfing the web.

And so we get painfully obvious applications of irrelevant privacy principle like this:

“7.1 What are the procedures that allow individuals to gain access to their information?

Social media are public websites. All users have access to their information through their user accounts. Individuals should consult the privacy policies of the services they subscribe to for more information.”

Did we really need the federal government to tell us that?

The biggest problem with this policy, though, isn't the "well, duh" response it inspires. DHS apparently went into a defensive crouch about the whole program. The PIA is full of unnecessary and risky effort to appease privacy zealots.

First, the PIAs expire quickly (the Olympics PIA expires after thirty days, Haiti after ninety), which suggests that DHS is planning on issuing a new PIA every time it wants to look at social media for a new event or disaster. The problem with that policy isn’t just that the waste of time and electrons. The policy is also likely to slow the use of social media in the first hours of an event, when they’d be most useful. For example, the PIA for Haiti social media monitoring was issued on January 21 – nine days after the earthquake struck. Tweets from the rubble were probably getting a little stale by then (though we can hope that DHS did the monitoring first and the PIA later).

Worse, DHS says it won’t collect or share any personally identifiable data (PII), even if the information is included in the tweets. It reassures us that “any PII related to the posting will be redacted.” Does that mean that a tweet saying, “Henri Rideau is buried alive under the rubble at his home, 124 Rue Cayenne” will only be distributed after someone takes the time to bowdlerize it to read, “--- is buried alive under the rubble at ---”?

I’m sure Henri will thank DHS for protecting his personally identifiable information.

If someone else digs him out.

The PIA also assures us that DHS won’t read posts on sites that require a user name and login. This is also a wildly overbroad "protection" for privacy. It applies even if the site is entirely open to the public, apparently, since Facebook is not listed. In fact, the last time I looked, the Washington Post required a login, too, and it too is left off the list. But maybe DHS can wait for the dead tree edition before it gets any disaster news broken by the Post.

Is there really a difference between public posts and Facebook updates that are shared with everyone on Facebook? If your mobile phone is set to send messages as Facebook updates rather than tweets, the government will never know you’re in trouble, thanks to this incoherent effort to appease the privacists.

DHS deserves some credit for actually understanding the value of social media in a crisis, but its self-inflicted limitations will either prevent imaginative use of social media or will guarantee violations when these unnecessary limits are set aside as a sensible response to some breaking crisis.

And that will predictably lead to new Drudge headlines: “Developing ... BIG SIS violated privacy rules hundreds of times in ‘emergency’ monitoring of Americans ...”

In the long run, I guess, dumb privacy policy is its own punishment.

The Book is Done, Has a Publisher, and is Coming Out This Spring.

The title says it all.  Hoover Press has accepted "Skating on Stilts" for publication this spring, assuming I get it out of my computer and to the proofreaders by the end of the month. 

Of course, I could tinker with it for months, but Judge Lamberth gave me a candid and helpful interview on the sources of the wall on Friday, and I've incorporated it this weekend.  So this is a great time to quit tinkering and ship the damn thing.  Which I am doing.

I've added a new chapter on TSA and the privacy machine.  It tracks my article on the Christmas Day attack for National Review, which never put the piece on line.  So I'll post the chapter in installments over the next couple of weeks.  

One last thing:  I need a subtitle, since "Skating on Stilts" is memorable but not informative.  Working subtitle is the rather bland "Terror, Technology, and Privacy."  That sort of misses the memoir element of the book, and frankly I'm not sure I'd read a book with that subtitle. 

So, other candidates are still in the mix.  How about "My Three Years at DHS, Trying to Keep Terrorists, Technology, and the Privacy Lobby from Killing You"?  Other suggestions welcome.

Air and Navel

Secretary Napolitano is doing a lightning tour of Europe, trying to build on the sense of urgency about air screening since the Christmas attack.  Her tour has already produced one of the few DHS blog entries with a human touch, as DAS Koumans conveys a sense of the glamour and leisure that come with DHS international travel:

So, we took off at 6 PM from Washington, D.C., got two or three hours of sleep on the flight as the Secretary spent most of her time preparing for the next day’s meetings, and landed at 6:45 AM local time in Spain. ... We had only had 10 minutes before we began our first event. Here's hoping no one noticed we went to our first two bilateral meetings in the clothes we slept in!

The Secretary seems to have focused European attention by asking for wider deployment of whole body imaging machines, which has made Europeans realize that there may be more serious privacy issues than letting government officials see travel reservation data -- information that is already shown to airline workers on two continents:

 "A good PNR system may be, at least, as efficient" as the scanners, said the Secretay's EU counterpart.  So the EU, US, and European interior ministers agreed on a work program that would consider "what and how operational cooperation sharing [of PNR] could be further improved and compatible approaches could be developed among partners committed to aviation security, the rule of law, and international humans rights."

Of course putting this in a US-EU context is fraught with opportunities for delay and mischief.  The EU still has no serious responsibility for actually stopping terrorists.  At best, it grades the work of the member state agencies that actually look for terrorists.  At worst, it finds reasons to get in their way. (Hints of that can be seen at the end of the statement above, which translates as, "Oh my goodness.  We can't say anything nice about aviation security -- especially in a statement adopted with the United States -- unless we give more than equal time to the rule of law and international human rights!")  

 So, whether the EU can overcome its genes and actually improve security cooperation remains to be seen.  If the European Parliament follows past practice, you wouldn't give high odds:

"It will be very difficult for the European Council to get a majority in parliament for this proposal," Manfred Weber, deputy head of the Christian Democratic faction of the European Parliament, was quoted as saying.
 
Justice spokesman for the Green party faction, Jan Philipp Albrecht, accused EU domestic commissioner Jacques Barrot and the European Council of creating facts for their own purposes. Albrecht said that the Lisbon Treaty, which came into force at the beginning of December, empowered the European Parliament to full participation in decision-making on internal affairs, with the power to block legislation.

Actually, though, I'm betting the other way.  I think MEPs like Weber and Albrecht are going to eat their words. 

The Lisbon Treaty means the Parliament can't sit on the sidelines carping any more.  They actually have the power to kill new security measures.  But that means they'll have to take responsibility for killing them.  

Carping while the security measures took effect without Parliament's approval was good politics.  But actually killing security measures in Parliament will turn out to be very bad politics.  After all, a lot of Europeans would have died on flight 253 if the bomber had succeeded.  Do Weber and Albrecht expect to be bragging after the next attack that they blocked measures that might have stopped it?

No, my guess is that in the end this could turn out to be a useful exercise in sobering up the European Parliament. 

Arrived in India

I'm in New Delhi, talking to the Indian government about terrorism, technology, encryption, and regulation.  Just the ride in from the airport was enough to remind me I wasn't in the U.S. any more.  Don't expect much blogging -- or responding to pointed comments -- this week.

Is Truth a Privacy Victim?

Michael Yon's claim that he was handcuffed for refusing to answer unreasonable questions at Seattle's airport is, of course, just his side of the story.  I've offered some reasons in earlier posts to think that his story is a bit odd, since he seems at first to have blamed TSA for the actions of the customs and border authorities, whose justification for asking the questions is a lot easier to imagine.

But why do we have to imagine CBP's justification for the questions? Commenters here and elsewhere have complained that border officials haven't been allowed to tell their side of the story.  Declan McCullagh, a journalist who wears his libertarian sympathies on his sleeve, has disclosed that one border official may have posted comments revealing that Yon has a longstanding beef with CBP .  With Declan's parentheticals, here's the post by the apparent border official:

"Just refusing to answer a question about yourself and your travel does not get you handcuffed during a secondary inspection in customs. You have to do alot (sic) more. And Yon was lying in his post where he claims that the airport police rescued him. CBP does not answer to the airport police and the airport police has no authority to interfere with CBP actions. Conservatives should get their facts straight before they go off. Yon actually has a history with CBP. His Thai girlfriend got stopped and questioned by CBP and he has a hissy fit afterward." (This may be a reference to Aew, Yon's Thai friend, who he said a year ago was unreasonably hassled by Minneapolis CBP agents.)

There's a lot to chew on in that short comment, which can apparently be traced to a dhs.gov domain.  It calls into question Yon's impartiality about CBP.  And it raises questions about why Yon left so much doubt about which agency asked him questions and handcuffed him; after the Minneapolis event, surely Yon is quite familiar with CBP officers and what authorities they have.  In fact, it's easy, after reading his account of his friend's experience, to suspect that he was eager for a confrontation over border questioning.

But most interesting is Yon's threat to sue the government for this post.  McCullagh reports that " Yon is saying he's "going to ask" his attorney "to examine a lawsuit for libel against the federal government for the post on BlackFive.""  That would be a Privacy Act lawsuit for disclosing facts about an individual without statutory justification.

I am not comfortable with the leaking of private data, even in these circumstances. But neither can I justify Yon's tactic of trying to punish the government employees who contradicted his tale of oppression.  Think what we all would say about a mainstream journalist who tried to use lawsuits to prevent the disclosure of bias in a story he had written.  In equity, if not in law, when Yon published his account of the encounter, he should have waived any privacy right in keeping the  event out of the public record. All the Privacy Act is doing now is suppressing speech about an event that has attracted lots of public attention.

I don't agree with Declan often, but he's got this dead right.  He challenged Yon to authorize the release of the CBP records about the event, so we can all evaluate what happened ourselves. 

One possibility, if Yon is interested and CBP is willing, might be an authorized disclosure. The CBP cited the Privacy Act; if you read the text of it, you'll see that the law allows disclosure "pursuant to a written request by, or with the prior written consent of, the individual to whom the record pertains." So if the Privacy Act is the sole obstacle to setting the record straight, a mere written request might do the trick.

Until that happens, it looks as though the truth is a privacy victim too.

Sorry, TSA-haters. Michael Yon Isn't a TSA Victim, Just an Unreliable Reporter

According to recent coverage, Michael Yon is very quietly recanting his original claim that TSA handcuffed him for refusing to answer questions about his income.  A blog in the American Thinker is a classic.  The author is so determined to trash TSA that he begins his article this way:

Give me one good reason to buy a ticket on any domestic airline in the United States. Death in the family? I'll walk. Business trip? Let's try video conferencing. Vacation? Go Amtrak!

Michael Yon - a guy I've dubbed this generation's Ernie Pyle - was placed in handcuffs at the Seattle airport, not because he showed up on a terrorist's watch list but because he refused to divulge to the TSA bullies how much money he made.

With that off his chest, the author admits that the only problem with the rant is that TSA had nothing to do with Yon's experience, after which the author returns immediately to trashing TSA for something it didn't do.

Michael discovered later that it was not TSA but rather Customs that was asking questions no American should have to answer. You have to wonder how bad things would have been if the underwear bomber had succeeded.

And, Michael, for your information, Customs and Border Protection officers have been asking people about their money for, oh, a century or two.  Carrying $10,000 across the border without declaring it is a crime, to give one example of why they might be interested.  And all that time you spent in Afghanistan?  I for one would like to know that people who say they spent months in Afghanistan reporting on the conflict were actually doing that, not participating in fight on the wrong side.  And I would hope they'd ask those questions no matter what last name the traveler has and no matter how Anglo the traveler looks. 

After all, a chip that big probably has to be declared.

But the incident also raises questions about Michael Yon's reporting.  CBP's uniforms are black, not blue, and they don't say TSA anywhere.  CBP meets you when your plane lands, not before it takes off, and it doesn't put everyone's bags through an x-ray or step you through a magnetometer.  Instead, the officer asks you for your passport, and says "Welcome home."  It's not that hard to tell the difference between CBP and TSA officers, especially if you get close enough to them to, you know, refuse to answer their questions and get handcuffed. 

I've been assuming that Yon's reportage from Aghanistan is (a) great stuff and (b) a harbinger of what journalism will become.  Now I doubt (a) and fear (b).  Really, this is the Internet at its worst -- recursive broadcasts of a story that gets everyone's juices flowing and turns out to be utterly bogus.

Come on, Michael, the main stream media would have published a very clear correction by now.  That's the least you can do. 

 

"Actually, a Chip That Big Will Have to Come Off Your Shoulder and Go Through the X-Ray."

A well-known war blogger, Michael Yon, is complaining that he was detained and handcuffed when he refused to answer TSA's questions. Yon took the position that he could decide what questions it was proper for TSA to ask, and if he didn't think the questions were proper, he refused to answer.  Said Yon, “If I am the guy on that passport and I don’t have any contraband in my luggage, it is a matter for the FBI, not the TSA.”

Really? So if Abdulmutallab had a valid passport in his own name -- he did -- and no contraband in his luggage -- he didn't -- then TSA's job is done?  Wow, this will be a relief to Janet Napolitano.  It turns out the system did work, at least as Michael Yon defines it. 

This is precisely the kind of attitude that will have to change if we're ever going to have real air security.  If we want TSA to look for terrorists, not just weapons, and after Christmas, it's obvious that we do, then we'll have to expect TSA to ask questions, including questions whose relevance isn't immediately obvious to the traveler. 

Of course a long war against terrorism means sacrifices.  Yon's seen a lot of them up close.  Apparently the one sacrifice he isn't willing to make is the right to relive his adolescence.

Are You A Privacy Victim? Part 8

Canadian airlines have disclosed that under Canadian privacy law the US is not allowed to vet the names of passengers in planes overflying US territory. This is sort of a problem, since US law requires that we know who is flying over our territory.  And not for nothing.  How close does a Vancouver-to-Mexico-City flight come to Seattle or San Francisco?  How close does a Montreal-to-Havana flight come to New York?  Close enough for the 9/11s hijackers, that's for sure.

Now, I think I know how this would be handled if the shoe were on the other foot, if US law prohibited airlines from giving names to the Canadians while overflying their territory. 

We'd be shamed and hectored for our unilateralism.  We'd be reminded that the restriction was a direct violation of international law, that the 1944 Chicago Convention says in article 1 that "every state has complete and exclusive sovereignty over airspace above its territory."

Then the lawsuits would fly, arguing that the US restriction had to be squared with international law by, well, eliminating the restriction.  And the judges, fresh from seminars in Innsbruck, would nod sagely and dump the restriction.

But of course the shoe isn't on the other foot.  We're talking about US security weighed against the right of Canadians to fly over the remains of the World Trade Center without letting a nosy US government learn their (gasp!) name, gender, and birthdate. 

So naturally the US requirement has been suspended while some other solution is found.  Not the flights, of course, just the security requirement. Well it shouldn't take long to find a simple solution for airlines that want to protect Canadian privacy while observing the US right to control US airspace. 

Here's one:  Honor Canadian law.  Keep the data.  And take the long way 'round.

"Sitting down is a role. But shutting up, that's a responsibility."

I recently posted something about the social and personal value of having a home stockpile of antibiotics in case of an anthrax attack.  It makes a lot of sense, but it doesn't do much for the amour propre of public health professionals, who slow-rolled the idea for years in the Bush Administration.  (More on that in the book.)

I wondered aloud if the Obama Administration had sided with the HHS career staff and decided not to encourage home stockpiles.  Now I've found more evidence that that's exactly where things stand.

In an otherwise unsurprising National Strategy for Countering Biological Threats
released by the White House in early December, there's an inevitable section, beloved of bureaucrats, setting out "Roles and Responsibilities."  Beloved because that's where all the turf wars are fought.

Now, you and your family probably didn't hire anyone to participate in those turf wars on your behalf. 

Believe me, it shows.

Because there's a section on the roles and responsibilities of "Individuals and Families."  Here's the whole thing:

"There is a critical role for families and individuals in reducing the risks from biological threats. Individual contributions to community resilience can undermine motivations for biological threats by reducing their effectiveness. We will encourage individuals and families to undertake the following:

• Following general guidance for disaster preparedness, such as keeping supplies of food and other materials at home—as recommended by authorities—to support essential needs of the household for several days if necessary;
• Being prepared to follow public health guidance that may include limiting their mobility throughout the community for several days or weeks, or utilizing designated evacuation routes; and
• Informing appropriate authorities when they encounter or observe suspicious or unusual activities."

I think the verbs tell the story. (Okay, maybe they're gerunds.).  Anyway, our role as individuals is to --

(1) follow

(2) prepare to follow

(3) inform 

Really, pretty much what you'd expect from any self-governing people.

Do you see any way that those three verbs could possibly lead to approval of home medkits? 

Neither do I.

In fact, I think the document resolves the bureaucratic battle conclusively against DIY preparedness.  It says individuals are supposed to "follow guidance" about keeping food and other materials at home.  But in case you didn't understand the first time that you're only supposed to do what the government tells you, the bit about keeping materials at home gets an added and quite redundant qualifier.  While you're following government guidance about keeping materials at home, remember that you're only to keep materials "as recommended by authorities."

So the bad news would appear to be that the administration isn't going to help you prepare a home medkit.  No standard packaging and labels, no encouragement for doctors to prescribe the kits responsibly, no sober discussion of the risks.

The good news is that I still haven't been threatened with prosecution for promoting off-label use of antibiotics.  So when you're asked why you got a medkit on your own, you can say you're just keeping the material at home "as recommended by an authority" -- Skating on Stilts.

"I'm Sorry, Sir. There's Still Postage Due on Yours."

When was the last time you gave the US Postal Service responsibility for delivering a package that absolutely had to get to the recipient as fast as possible?

Right. I don't remember either. 

The administration, though, has nothing but faith in the Postal Service.  In fact, it's willing to make a big bet on the Postal Service's nimbleness, sense of urgency, and dedication to duty. 

And when I say big, I mean really big; it's willing to bet your life on it.

Literally.  If we suffer an anthrax attack, everyone who's been exposed will need antibiotics within three days of the attack.  That's within two days of our discovery of the attack, if we're lucky.  Every day of delay after that is a death sentence for roughly five or ten percent of those exposed.

How will we get antibiotics in the hands of what could be hundreds of thousands of really worried people?  The Administration's answer is contained in an executive order released quietly last week:  We'll get the Postal Service to do it.  Of course they're already demanding armed protection, so we'll send local law enforcement officers with them.

Stop for a moment to imagine the scene.  Postal workers  will be asked to drive into contaminated neighborhoods even though they can't be sure their countermeasures will work against whatever strain has been spread there.  The neighborhoods are full of people desperate to get antibiotics, so for protection, the postal workers will first have to meet up with guys with guns whom they've never seen before.  They'll collect antibiotics from pickup points that they may or may not have gone to before.  They'll meet the guys with guns there, or someplace else that may have to be made up at the last minute.  Then they'll start out on routes that almost certainly will be new to them.  As they go, they will seamlessly and fairly make decisions about whether to deliver the antibiotics to homes where no one is present, to rural mailboxes that may or may not be easily rifled, to people on the street who claim to live down the way, to the guys with guns who are riding with them and have friends or family at risk, and to men in big cars who offer cash for anything that falls off the truck. 

And all this will put antibiotics in the hands of every single exposed person within 48 hours, from a no-notice standing start.

Yeah, that should work.

I don't mean to be flip.  I talk about this in the book, and the fact is that no delivery method will work really well, and so, as a fallback, the Postal Service may be our best option.

That said, no one but an idiot would bet their children's lives on that option.

So here's what I did -- and what you should do too.  I asked my doctor for an emergency supply of antibiotics that would get me through the first week or so of a crisis.  I promised not to take the antibiotics irresponsibly for colds or other viral infections.  And I was ready to change doctors over the issue. 

I got the prescription.

Some public health officials may try to make you feel guilty about "hoarding" antibiotics or contributing to antibiotic resistance.  Poppycock.  If you buy while supplies are plentiful, you're actually making a bigger market for these products and contributing to the maintenance of production capability.  And if you don't take them irresponsibly, you won't affect resistance. 

In fact, you're even being socially responsible.  If we do suffer an anthrax attack and the Postal Service is having trouble keeping up, a sure bet if ever there was one, you can defer your delivery in favor of someone who has no stash.  You'll take a bit of strain off a system that is going to need all the relief it can get.

(In addition to the glow of virtue, you can feel a bit of that leftover 60s civil disobedience thrill.  When I tried to put this home stockpile advice in a speech toward the tail end of the last administration, I was informed by the lawyers that advocating an unapproved use of prescription medicine is a criminal offense under FDA law.  And, while taking antibiotics for an anthrax attack is an approved use, getting antibiotics in case of an anthrax attack is not an approved use.  I think that may mean that this post is, um, a felony.  If so, well, power to the people and come and get me, coppers!)

What's unfortunate about the executive order is that there's not a hint that the administration is considering the home stockpile as the first and best way to prepare for a possible attack.  If that's really the government's last word on the subject, it's like telling passengers that the best response to an air hijacking is to sit tight and wait for the authorities to arrive. 

It's insufferably paternalistic and it's bad advice. 

The only good part about it is, no one is going to listen.

EPIC Discovers an Orwellian Technology It Likes -- The Memory Hole

Today, in a good NYT article, John Schwartz explores the problem of whole body imaging and privacy after the Detroit bombing.  What I find interesting is the effort of privacy groups to run for cover now that the cost of their campaigns is clear.  Schwartz interviews the head of a particularly aggressive privacy group, Marc Rotenberg of EPIC, asking him about his group's position on whole-body imaging:

Marc Rotenberg, head of the Electronic Privacy Information Center, said his group had not objected to the use of the devices, as long as they were designed not to store and record images.

That sounded very moderate, very nuanced. 

What it didn't sound was, well, true.  I didn't remember that perfectly reasonable position coming out of Rotenberg's mouth before the Detroit bombing. So I went back to the record. 

In May, EPIC signed a letter demanding that use of the machines be suspended until a Privacy Impact Assessment was complete. That sounded pretty reasonable, too. Technically, EPIC's letter just asked for an assessment of the technology. But the history of environmental assessments shows that they are often just the first step in a campaign to stop new technology cold.  And the name of EPIC's campaign was, after all, "Stop Whole Body Imaging."

So, was the May letter a stalling tactic or an honest request for a careful privacy impact study?  If you couldn't tell in May, you surely could by October.  Because by then, giving EPIC and its allies the benefit of the doubt, DHS's Chief Privacy Officer had actually completed the Privacy Impact Assessment that they had asked for.  It came to the conclusion that Rotenberg now says he supports, finding that whole body imaging 

"has the potential to improve threat detection capabilities for both metallic and non-metallic threat objects, while improving the passenger experience for those passengers for whom a physical pat-down is uncomfortable. The operating protocols of remote viewing and no image retention are strong privacy protections that permit security benefits to be achieved.

If all that EPIC wanted was a fair assessment plus safeguards against data storage, that should have been enough. 

Was it? 

Not on your life. It turns out that EPIC didn't want an assessment, or an assurance about storing images.  What EPIC wanted was an assessment that banned use of the machines for primary inspection.  Here's what EPIC and its allies told Congress in October about the Privacy Officer's assessment:

"[I]f the Chief Privacy Officer were satisfying her statutory duty to assure that new technologies do not erode the privacy protections of American citizens, the new policy would not have been implemented in the first place. Due to its extremely invasive nature, the whole body imaging technology is almost by definition a new technology that erodes the privacy protections of American citizens. Implementing such technology for every traveler that passes through an airport security checkpoint regardless of suspicion is exactly the type of action that the Chief Privacy Officer should be preventing in satisfaction of her statutory obligations.

What EPIC is saying here is quite remarkable.  It's claiming that DHS's Chief Privacy Officer had a statutory duty to prohibit deployment of the machines.  The assessment, in other words, could only come out EPIC's way.  Any other outcome is a violation of law. 

And EPIC's preferred outcome isn't exactly nuanced.  If the law were followed, EPIC said, "the new policy would not have been implemented in the first place" because that "is exactly the type of action that the Chief Privacy Officer should be preventing in satisfaction of her statutory obligations."

As far as I can see, everything EPIC did and said up until Christmas Day 2009 was perfectly consistent with the name of its campaign.  It wanted to "stop" whole body imaging, not reform it or guarantee that images weren't stored.

Now? 

Not so much. 

Now, I guess the question is:  Whose image is EPIC protecting -- yours or its own?

Are You A Privacy Victim? Part 7

Jeffrey Goldberg of the Atlantic has figured out who's to blame for the Detroit air bombing.  You might be surprised to hear this, but it turns out that the bombing was all the fault of , yes, …. George W. Bush! 

 

Goldberg’s tired variation on this wheezing theme starts with a true observation: whole-body imaging machines would have made it much harder for a terrorist to hide explosives on his body to get through screening.  But they’re only being used for secondary screening right now; we haven’t bought enough machines to screen everyone.   Says Goldberg:

 

That's right, the Bush Administration managed to equip 40 screening lanes -- 40, across the 50 states -- with body-imaging machines. In other words, there are better scapegoats out there than Janet Napolitano.

 

Goldberg’s not completely wrong.  There are better scapegoats than Janet Napolitano.  (In fact, she deserves credit for something that often goes overlooked.  Despite all the temptations, she hasn’t resorted once to the blame-Bush mantra that others use so often.)

 

But the Bush Administration is not the reason the whole body imagers haven’t been deployed. 

 

Not unless the image to the left is part of some heretofore-unknown Bush Administration propaganda effort.

 

In fact, it's part of a relentless and successful campaign waged by privacy groups against wide deployment of these machines.  The ACLU, with its usual understatement, declared that they were a “virtual strip search.” A couple of dozen groups signed a letter this year demanding that their use be suspended. 

 

As a result of the campaign, just this June, a bipartisan majority of the House of Representatives voted to prohibit TSA from using the machines for primary screening. 

 

So, as Jeffrey Goldberg says, there should be a scapegoat for TSA's failure to roll out whole body imaging more quickly.  A couple of dozen scapegoats, actually. 

 

In fact, if you wanted an example of why it’s almost impossible to implement new security measures until after a disaster, this is a classic. 

 

We all saw that terrorists would be able to beat the system by hiding explosives on their person.  So did al Qaeda.  We obviously needed a new approach.  But over the past five or six years, the privacy groups have basically opposed all new security measures.  And they’ve managed to bring Congress along, often by mobilizing a left-right civil liberties coalition. 

 

Doing anything new in government is damn hard.  Doing something new with that kind of opposition is nearly impossible. 

 

At least until there’s a disaster.

Business Travel Coalition on Air Security: "Look! A Squirrel!"

Lots of people have suddenly discovered the value of intelligence and good data for keeping terrorists off planes.  The latest convert is Kevin Mitchell of the Business Travel Coalition, who says that, since 9/11 "the highest and best use of each incremental security dollar spent should have been on intelligence gathering, risk-management analysis and sharing, and on fundamental police work such that terrorists would never reach an airport, much less board an airplane." 

Thanks, Kevin.  But that would mean a lot more to travelers if you hadn't spent so much time after 9/11 trying to, well, stop the government from spending incremental dollars on intelligence gathering and risk-management analysis and sharing, which at the time you were calling "invasive screening" and "data mining."

Kevin Mitchell's Business Travel Coalition was a leader in opposing Automated Targeting System (ATS), the database that is used by CBP to keep terrorists out of the country.  That's the one that seems to worry al Qaeda so much that it keeps trying to blow up planes before its operatives have to go through US immigration and customs.  It is one of the most effective "intelligence gathering and risk-management analysis" systems the US has.  Yet if Mitchell had his way, the system would have been suspended or killed years ago.  Here's an excerpt from one letter he signed in 2006 about ATS:

"We are deeply concerned that such a far reaching and invasive
screening of millions of business travelers entering and exiting the
U.S. could do significant personal harm to them, and reduce the
productivity of the organizations that field business travelers.

ATS is a truly monolithic and disturbing data-mining program which
allows for the aggregation of personal information on business
travelers; forbids travelers from accessing and correcting
inaccuracies; provides for the sharing of such information with
foreign governments and third parties; and retains travelers’ personal
information in a dossier for 40 years.

Of particular worry is that ATS was widely thought to be strictly for
cargo screening. It was discovered only recently that data on
travelers have been collected for at least four years without the
awareness of the U.S. Congress or foreign governments whose citizens
are being profiled. What's more, a dossier is being maintained on
these travelers without their knowledge or consent.

We Signatories to this letter urge you to suspend the ATS program
immediately; provide substantially more details on the program to us
and our elected representatives; and proceed with ATS only through an
official rulemaking with a significant public comment period, per
requirements of the U.S. Privacy Act of 1974."

I am glad when anyone converts, of course, but Mr. Mitchell ought to admit somewhere that he's been on the other side of this debate for years.

Six Uncomfortable Answers

We've got answers to some of my questions from yesterday.  And they aren't very comforting.  All in all, they remind me of the saying that the small scandals in Washington are what's illegal, but the real scandal is what's legal.  So, there were ways in which our air security system didn't work as intended, and those are a small failure, but the real failure is the way our air security system is intended to work.

Here are six answers to my questions:

1.  According to press reports, Abdulmutallab had a multiple entry visa to the US, and it was issued before Abdulmutallab's father warned US authorities of his growing militance.  It looks as though the warnings went to a US consular office in Nigeria while the visa was issued in London, which might have had some modest impact on whether consular officials took the warnings seriously. (Officials in London might have been more alert to the risk in Abdulmutallab's visa, since they issued it, which might have led them to dig more deeply and report with more clarity on the warning.)

2.  The intelligence/security agencies would like the consular officials in Nigeria to take the fall for this.  The agencies seem to be telling journalists that the father's warning wasn't relayed to them with enough detail to justify putting Abdulmutallab on a no-fly or selectee list, so they just stuck him in the 550-thousand-name catchall database (known as TIDE, the Terrorist Identities Datamart Environment) rather than a more active 400-thousand-name database.  But neither database would have made him a automatic "selectee" for special screening (roughly 14 thousand people are on that list), let alone no-fly status (4 thousand).  And it's hard to imagine that even transmitting a full transcript of the father's warning would have boosted Abdulmutallab onto the selectee or no-fly list.

Why is it so hard to get on the selectee or no-fly lists?  In part because privacy campaigners have made the lists less effective and more controversial by raising phony privacy concerns -- and getting Congress to buy into those concerns.  Here's the problem:  The lists are full of aliases and alternative spellings that the terrorists might use to defeat screening.  As a result, many, many people (kids, Senators, grandmas) end up as selectees because their names resemble the aliases of terrorism suspects.  The resulting hassles and complaints make officials cautious about adding large numbers of names to the selectee list. 

So why doesnt the US use other information, like date of birth, to "disambiguate" the lists -- to separate terrorist suspects from regular folks?  After all, we knew Abdulmutallab's birthdate, along with a lot of other information; there was no need to stop every Abdul Mutallab or Abdul-Mutallab or abu Mutallab from flying to the US.  But DHS hasn't been able to disambiguate the list because privacy campaigners and Congress prohibited DHS from gathering birthdates from passengers.  That information was too sensitive to share with the government, said the privacy groups, and they insisted that Congress prohibit DHS from running the selection process for years while DHS got over a series of privacy hurdles. 

All those infants and grandmas on the selectee list were, I've said before, privacy victims.  Years after the Congressional barriers were put in place, DHS finally got over them, and it has now started running the screening system.  But the result the privacy campaign was years of delay in setting up a more effective selectee database and years of complaints from the privacy victims.  As a result, the agencies got a bit gunshy about putting people on the selectee list, since the larger the list, the more complaints it generated from ordinary folks.

3.  The databases where Abdulmutallab's name was stored, however, were accessible to both FBI and DHS.  So when he made a reservation to come to the US, DHS should have known he was coming.  DHS probably would have flagged him for special scrutiny when he arrived in the US.  That would make it very hard for him to enter the US, visa or not.

Al Qaeda seems to have a lot of respect for US border security screening.  That's why it is trying to commit terrorist attacks on US soil without actually entering the US.  Since border measures were strengthened after 9/11, al Qaeda has tried three separate plots using the same basic technique -- get on a transatlantic flight and blow it up before it lands and before the terrorists are put through our border screening process.  Every plot has failed.  But if this doesn't remind you of the successive World Trade Center attacks, you're not paying attention.  They've got a schtick, and they're going to keep using it until it works. 

4.  Unfortunately, TSA, the part of DHS that screens air travelers, doesn't use the bigger terrorist databases for screening -- unlike DHS's border officials at CBP.  Partly that's because Congress forced DHS to leave traveler screening in the hands of the airlines for the phony privacy reasons described above.  But it's also because airline screening, unlike border screening, is not well designed to vary the level of screening depending on the risk a traveler poses.  In shorthand, it is trying to find dangerous stuff, not dangerous people.  So DHS's access to the data about Abdulmutallab was practically irrelevant to his ability to get on the plane.

5.  Practically but not entirely.  There is one exception.  CBP, which had access to the data, could have decided that it didn't want Abdulmutallab flying to the US, and it could have enforced that decision by telling Delta/NW not to let him board.  Because the visa had already been issued and because of limits on TSA's use of identity in screening, this was the last chance to keep Abdulmutallab off the plane.  We didn't use it.  How come?  Did CBP decide that the derogatory information wasn't enough to block Abdulmutallab without an interview?  Or did Delta/NW take that decision out of CBP's hands by failing to implement the AQQ requirement that was put in place a year ago?  We still don't know.

6.  I asked several questions about how good the screening was in Nigeria and at Schiphol.  I now think that it barely matters how good a job those screeners did.  Without a reason to treat Abdulmutallab differently from other passengers, the current level of screening wasn't likely to find the explosives.  Like 9/11, when the hijackers carried boxcutters because boxcutters were allowed by current screening rules, al Qaeda is adapting to our rules, finding explosives and hiding places that our current procedures can't detect.

The explosives Abdulmutallab was carrying weighed 80 grams.  That's about three ounces -- roughly the weight of a third of a cup of sugar.  So let's role-play al Qaeda at home:  put a third of a cup of sugar in a plastic sandwich bag.  Roll it up.  Can you think of place on your body where you could tape it so that it would be hard for a patdown to find?  Or, if you don't have that kind of imagination, here's one clue:  80  grams happens to be a bit less than the weight of standard lightweight bra inserts for "enhancing cleavage."

OK, now let's roleplay TSA:  What kind of patdown procedures are you going to put in place to find that rolled up plastic baggie?  Those bra inserts?  Remember, you're committed to treating everyone the same way.  Are you really going to pat down every passenger there and there -- and carefully enough to distinguish a baggie from a fashion accessory or an anatomical feature? 

According to the press, that's DHS's plan.  From now on, we'll see more, and more intimate, patdowns.  Less carryon luggage.  Closer looks at everything we do carry.  And on international flights into the US, restrictions on getting items from overhead bins, plus restrictions on what we have on our laps, etc.  In the longer run, we'll use more of the millimeter wave machines that will surely be more appealing to passengers than a patdown that is indistinguishable from getting to third base. 

But al Qaeda has already invented the "booty call" bomb, which makes even the millimeter wave machine ineffective.  So I think we're seeing the endgame for the current, nearly identity-free screening process.  Only a system that looks for terrorists as well as weapons is likely to be able to defeat al Qaeda's transatlantic flight plan.

Actually, al Qaeda's fascination with transatlantic flights -- and its fear of US border procedures -- gives us an obvious way to try out a new approach to screening.  Everyone on transatlantic flights is already carrying a passport.  And we already have good passport-based screening and computer systems for border officials.  Why not hook those systems to computers at the special US-bound screening checkpoints that already exist in European airports?  Then the screeners could perform a graded set of inspections and patdowns that vary depending on whether the traveler is considered risky or not.  Travelers in an intermediate status could be questioned, and US officials could be linked in by videoconference to check the answers against their information.

There is plenty of pain in an approach that looks for terrorists, not just weapons.  For starters, the Obama Administration's recent retreat from REAL ID and good driver's license standards makes it impossible to implement identity-based screening inside the US for the next five to ten years.  And, of course, everyone who ends up on the wrong side of the database will want to litigate about the data that led to their patdown, claiming viewpoint and ethnic discrimination, etc., etc.

Still, I don't see a better alternative.  The current path leads us to more and more obnoxious treatment of all travelers.  And in the end, after all the mass-produced humiliation, it leads in all likelihood to failure.

Update (1):  According to Reuters, KLM used APIS to check Abdulmutallab's admissibility with CBP and got back no objection:  it reports that the head of Nigeria's civil aviation authority "said Abdulmutallab's U.S. visa had been issued in London on June 16, 2008 and was due to expire in June 2010. He said it was scanned without the Advance Passenger Information System (APIS) returning any objection."  If that's so, CBP/DHS has some explaining to do.  It would mean that they knew the guy was coming and they also had access to the most recent intelligence, including the father's report, but did nothing to stop him or get him checked out in Amsterdam.  How come?

Update (2):  A couple of people have taken me to task about blaming privacy activists for the delay in Secure Flight, saying that the privacy flap wasn't just about the government getting date of birth but about the use of the Secure Flight database to catch criminals, not just terrorists.  It's true that the flap was in part about mission creep and some ill-advised statements from DHS on that point.  But the fact is that this system, which uses only DOB and a few other datapoints, has been delayed for years because of the activists and their Congressional allies.  I think there's a whiff of collective punishment in the air:  DHS said some dumb things about how much data it would collect and how widely it would use that data, so it has to be punished by the endless delay of Secure Flight.  Scratch that:  We all have to be punished by more inconvenience and less security.  Reminds me of the exclusionary rule; in order to punish the cops, we all must be exposed to more crime.

Al Qaeda Failed. What About Us? Ten Questions.

Early reports about the failed Christmas bombing of NW 253 raise questions that need answers.  Because, frankly, if the reports are true, al Qaeda never should have gotten this close to a successful attack.

1.  According to early reports, the suspect is 23-year-old Abdul Farouk Abdulmutallab, and his name "appears to be included in the government's records of terrorist suspects, according to a preliminary review."  The first question, then, is how he managed to get a visa to come to the United States. 

2.  One report suggested that the visa was granted to attend a religious meeting. Is there some political correctness problem that makes State reluctant to deny visas for such travel?

3.  A visa might have been granted for a good reason (a chance to interrogate or arrest him) but only in circumstances where he was watched closely.  At a minimum, data about him should have gone to DHS and FBI from State.  Did it?

4.  Even if it didn't, TSA and DHS should have identified him as a possible risk from his travel reservations.  Did they?  If not, why not? 

5.  If they did, was he screened specially at Schiphol?  Did DHS put an air marshal on his flight?

6.  Sometimes travel reservation data is spotty and badly recorded, but that shouldn't be true for the passenger manifests that NW should have sent to DHS.  Those should come straight off the passport.  Did it?  Should airlines be held liable for deaths caused by bad manifest information?

7.  How good was the air travel screening in Nigeria? 

8.  If it wasn't that good, and I suspect it wasn't, in part because the plane was not bound for the US, did Schiphol fall down on the job by not properly rescreening Abdulmutallab? 

9.  Have we let European objections to US screening standards affect the security of flights with connecting passengers?

10.  One passenger is said to have helped thwart the attack by climbing over several less active passengers to grapple with the terrorist, apparently suffering burns to his hands in the process.  How long will it take Secretary Napolitano (at least) or President Obama (my preference) to visit this guy in the hospital if these facts turn out to be true?  Passengers are the last and most effective line of defense in cases like this.  But the incentives to sit tight are still great.  We need to honor the heroes who react quickly to thwart attacks in the air.

Update:  Many thanks to Instapundit, BigGovernment, and Volokh Conspiracy, among others, for the links.  They've spurred some interesting comments, and one by hiscross about AQQ is important enough to generate an 11th question.

AQQ is a program in which passport downloads collected by the airline are supposed to be sent to DHS *before* the plane takes off. Under AQQ, the airline is also supposed to be able to receive a return message from DHS requiring that suspect passengers be removed from the plane. 

(AQQ is also that most dreaded of government innovations, the recursive acronym, in which one acronym nestles comfortably inside another.  Thus, AQQ stands for APIS Quick Query, which tells you nothing unless you know that APIS stands for Advance Passenger Information System.  APIS was the earlier, slower, one-way version of AQQ.)

DHS made the AQQ requirement final more than a year ago, after a long testing period.  But a number of US carriers have been stiffing DHS, refusing to comply with the regulation because, they say, they can't afford to upgrade their computer systems. They say they're waiting to see what upgrades they'll have to make for the TSA Secure Flight program, but I find it astonishing that a private regulated industry would simply declare that it won't comply with US law. When you do that, you have to expect consequences -- or be very lucky.  As a result of airline noncompliance, it is hard for DHS to keep bad guys off planes, even if the bad guys have been identified from their passports. If Delta/NW falls into the carrier-scofflaw category, and that failure contributed to the incident, they are are, and should be, in trouble. In addition, I'm guessing, DHS will immediately begin fining the other carriers who have been rope-a-doping them. 

So call it question 11: Was Delta/NW in compliance with US law when it boarded the Amsterdam flight?

Cooling Summers?

Howard Schmidt, about to be named cybersecurity adviser, is one of the nicest guys in the business.  In Washington, of course, no virtue goes uncriticized, so there are some who'll question whether Howard can survive his swim through the shark tank.  With that in mind, I'd say that the most important line in the early leak is this:  "Mr. Schmidt will report to the National Security Council — not both to the council and to the National Economic Council, as previously planned, an administration official said on Monday."

I'm quoting from the NYT, but other outlets got a similar spin.  That's a very public rebuke for Larry Summers's National Economic Council, which had insisted that the dual reporting structure be included in the "60-day report" issued last spring.  Whether the change resulted from hard-nosed bargaining by Howard, campaigning by the NSC, or the critiques of cybersecurity advocates outside government (me included), or all three, it's an early sign that Howard's job, while certainly not a "cybersecurity czar" position, will at least escape the "cybersecurity serf" moniker suggested by critics.

Does the Vatican read Skating on Stilts?

According to the Catholic News Agency, the Vatican has declared a "unique copyright" on the "name, image and any symbols of the Pope," which are reserved "expressly for official use of the Holy See."  Hmm, where have I heard that idea before?

The first European President?

 
The deal struck at Copenhagen shows that President Obama really is shaking up the old global order.  And in ways that no one expected -- perhaps not even the President.

Even twenty years after the Berlin Wall fell, the old habits of international governance had lingered on.  International diplomacy truly is the most conservative form of politics.  So, even after the disappearance of the Soviet Union, all of the other players kept on performing their old roles.  The United States would take tough international positions grounded in a mix of morality and domestic interests.  It would be reflexively opposed, first by the Soviet Union and later by the professional representatives of the developing world known as the Group of 77, or G77.

Europeans would then take advantage of US inflexibility to advance their own interests by playing honest broker -- first with the Soviet bloc and then with the developing world.  In the process they often shocked Americans with their willingness to compromise principles that the US held dear.  After the end of the Cold War, it even became thinkable for Europe and the G77 to create a consensus that was so far from official US views that the Americans were simply frozen out, forced to choose between international isolation or capitulation to the European-forged consensus.  And, from the convention against land mines to the Kyoto accords and the International Criminal Court, that dynamic actually achieved a kind of success.

What's interesting about Copenhagen is how it differed from this script.  It started out on the usual lines.  The EU had taken a tough position on the need for serious reductions in carbon emissions -- a position that reflected its deeply held moral principles and its self interest as an economy whose carbon emissions had been held down by traditionally high oil prices and a collapse in inefficient Eastern European coal plants after the wall fell.  The EU had also created a rough deal with the developing world, which would do something about emissions in return for large sums of money in aid.  This approach had succeeded in freezing the US out of the diplomatic consensus.  So as Copenhagen opened, Europe occupied the moral high ground and had lots of allies.  It could fairly expect that a chastened US would finally have to come in from the cold at Copenhagen. 

Yet a few

days later, the summit ended with the Europeans sputtering mad, forced to take a disappointing deal that was negotiated without them.  From the early reports, it looks as though the President left them sitting secure in their moral redoubt and went directly to the largest developing countries -- China in particular,

but also India and Brazil -- to craft a compromise that worked for those countries and for him, even as it was condemned as shockingly cynical by Europeans. 

Somehow, the EU had ended up playing the hard-line moralist role in Copenhagen that the US usually assumes, while President Obama had taken the compromising, brokering role usually played by Europeans.  When the deal was done, the EU had a choice of wrecking Copenhagen by standing on principle for something tougher or accepting the fait accompli.  Visibly seething, they took the deal.

Clever press commentators used to call President Clinton the first black President.  Which made it hard to know what to call President Obama, until clever commentators began suggesting that he would be our first European President. 

Indeed he may be, and in ways that the Europeans will sometimes regret.

Obama Administration Gets Its CFIUS Sea Legs -- And Firstgold Gets a Veto Threat

The Obama Administration has issued its first rejection of a transaction under CFIUS.  Well, at least most companies would treat it as a rejection.  Treasury has informed the parties that if they don't withdraw, CFIUS will recommend rejection of the transaction.  Usually that's an opportunity for parties to save a bit of face, so they don't have the stigma of a public veto.  But Firstgold isn't taking the hint.  Instead, in a remarkable move, they've released a detailed, blow-by-blow memo setting out the conversation with the Deputy Treasury Secretary offering withdrawal.  That's not something you do when you're thinking of a quiet exit stage left.  Nor is Treasury going to be thrilled to see a quiet conversation retailed in the New York Times.

So either Firstgold and its lawyers don't understand CFIUS or they're spoiling for a fight.  If the latter, this will be a test -- an opportunity to show the Administration sticking up for DoD's security interests, but at a cost in potential litigation and diplomatic pressure.  That could turn this tiny transaction into a big deal.

Volokh-Baker dialogue on copyright-style damages for security breaches

I've been debating my post about Rihanna and the TSA manual with Eugene Volokh, renowned UCLA Law School professor and progenitor of the Volokh Conspiracy, a great law blog.  Eugene agreed that we could clean up the correspondence and post it.  Here's where it stands.  I'll obviously have to respond soon.  Further comments from Eugene and others are also welcome.

 

Eugene Volokh:  As to the copyright analogy, I’m not sure it quite works:  While the Court has essentially recognized a copyright exception from First Amendment protection, it has stressed (see Harper & Row v. Nation Enterprises) that the exception is constitutional because it leaves people free to convey facts and ideas (as opposed to copyrighted expression), and to make fair uses even of expression.  The objection to publication of the TSA document is precisely that the publication reveals dangerous facts (more a subject for a crime-facilitating speech exception, if there is to be such an exception, see http://www.law.ucla.edu/volokh/facilitating.pdf) and that the law should suppress the distribution of such facts.

      Of course, there are arguments that even publication of certain facts should be punishable; I discuss them in the Stanford article I linked to above.  But I just don’t think the copyright analogy is particularly apt here.  Or am I missing something?  

 

Stewart Baker:  I see your point, and of course the security problem is in the end the facts that are disclosed.  However, there is a difference between disclosing facts from a 30-page document and releasing the entire document.  Especially in a wired world where publishers have little time and energy to devote to disclosure, requiring that publishers limit themselves to paraphrasing or excerpting protected documents would result in far less disclosure.  Retail disclosure takes more effort than wholesale disclosure.  Security is also harmed more when the entire document is made available for mining and processing by hostile interests.  The use of an excerpt or paraphrase would thus be less likely to harm national security. 

 

Thus it seems to me that there is a remaining interest in preventing wholesale reproduction of protected documents.  And if there's justice in the world, it wouldn't take very much of a security interest to match the social value of protecting Snoop Dogg's lyrics.

  

Eugene Volokh:  Hmm – but is any of the value of the document in the supposedly creative expression of the facts, or is all the value (and the harm) in the facts?  If the very objection is that revealing the document will convey dangerous facts, then it seems to me that we’re pretty far from a copyright argument, which is that republishing a song will infringe on the author’s creative expression and that the facts are still freely conveyable.

  

Stewart Baker:  But the presumption of creative expression is wholly artificial in a world that grants copyright to shopping lists.  The USG voluntarily surrendered its own copyright to serve other interests -- such as allowing free transmission of data that Americans have already paid for with their taxes.  Why can't the USG simply reclaim that copyright for classified and sensitive documents, where the interest in free transmission is nonexistent?

 

Eugene:  If I publish a famous person’s shopping list, I don’t think I’d be infringing.  Chances are that it will be seen as not having enough creative expression to be protected, but even if it does, the fact that there’s only a very small amount of creative expression will come back in my favor on the fair use analysis.  Likewise, I would think that noncommercial publication of a manual containing factual information, which is supposedly damaging precisely because it reveals facts, would likely be a fair use.  (I agree that the manual probably does have some creative expression in it, but again a pretty modest amount.)

      Now if the interest in free transmission of the information is nonexistent, that could be an argument for a new First Amendment exception.  I just don’t think it’s much of an argument for an exception by analogy to copyright law.  (I’m not sure, by the way, that the interest in free transmission is nonexistent, because publishing the information does provide law-abiding citizens with an understanding of how the government operates; that’s one thing I discuss in my Crime-Facilitating Speech piece.  Perhaps the harmfulness of the publication still so much exceeds the value that the publication should be punishable.  But I don’t think it’s accurate to say that there’s no interest in free transmission of the information.)

 

 Stewart:  I understand that the "no interest in free transmission" would be controversial if argued to a court against a background that conveyed no protection to any other speech.  But in fact we don't live in that world.  We live in a world where Congress has conveyed presumptive protection from transmission to all written works, no matter how banal, and has then created an exception for US government speech. 

I'm proposing an exception to that exception, on the theory that the first exception is based on a Congressional (not judicial) "free transmission" justification that is patently missing when the very government that encourages transmission of most of its documents has followed a reasonable process to identify documents that should not be freely transmitted.  Having created the exception, I think Congress should be able to decide how far the exception extends. 

The only question is whether the exception to the exception is reasonable, and I submit that it should be a pretty low bar to get over.  If not, the courts will find themselves extending the first exception willy-nilly.  They'll find themselves asking why state and local governments should be able to claim copyright if there's a constitutionally compelled exception from copyright for the US government. 

For that matter, it raises the question whether state employees, such as law professors at state institutions, are also constitutionally compelled to surrender copyright for works produced while on the payroll.  ;-)

 

Eugene:  I might be missing the argument here.  Here’s how Harper & Row justified the constitutionality of copyright, despite its being a speech restriction:  Copyright law is constitutional because “copyright’s idea/expression dichotomy ‘strike[s] a definitional balance between the First Amendment and the Copyright Act by permitting free communication of facts while still protecting an author's expression.’ No author may copyright his ideas or the facts he narrates....  In our haste to disseminate news, it should not be forgotten that the Framers intended copyright itself to be the engine of free expression. By establishing a marketable right to the use of one's expression, copyright supplies the economic incentive to create and disseminate ideas....  Moreover, freedom of thought and expression ‘includes both the right to speak freely and the right to refrain from speaking at all. We do not suggest this right not to speak would sanction abuse of the copyright owner's monopoly as an instrument to suppress facts....  In view of the First Amendment protections already embodied in the Copyright Act's distinction between copyrightable expression and uncopyrightable facts and ideas, and the latitude for scholarship and comment traditionally afforded by fair use, we see no warrant for expanding the doctrine of fair use to create what amounts to a public figure exception to copyright.”
    As I read this, the copyright law – even if Congress repeals sect. 105 – can’t be used to suppress the communication of facts.  Yet as I understand it, the argument for using copyright law to stop the publication of government instruction manuals is not at all that “copyright itself [would] be the engine of free expression,” providing an “economic incentive to create and disseminate ideas.”  Rather, it’s precisely that copyright law would be an effective “instrument to suppress facts,” though of course facts that are dangerous in the wrong hands.  That’s why I don’t see the copyright analogy as helpful here.  If the argument is to be made that publishing certain facts is so dangerous and so valueless that such publication should be suppressed, then that’s the way the argument should be made; but I don’t think it should get any extra force from the copyright analogy.  What am I missing here?

 

Update:  This dialogue is continued at some length in the comments.

 

 

New Music

Recent workout music choices: 

Imelda May has a fine appreciation for retro rockabilly and torch songs, and her band is very strong.  Plus, I'm a sucker for horns.  Only about half the songs on this album come close to being workout music, but when Imelda May rocks, she rocks; see, e.g., "It`s Your Voodoo Working" or "Big Bad Handsome Man."

Gossip's Music for Men has a couple of cuts that combine danceability with Beth Ditto's raw female wail.

And I've renewed my appreciation for Kelly Clarkson now that she's given up her rockstar/singer-songwriter delusion.  God gave her great pop pipes.  When she stops trying to write and just sings, no one is better.  All I Ever Wanted takes her back to her roots.

Shakira's She Wolf?  I'm still listening, but it's disappointing.  Still, she's as charmingly daffy as ever, and you've got to love someone whose reaction to being left home while her lover runs off to Paris with another woman is to curse them with bad room service:

Hope the French fleas eat you both alive!
And your room smells!
And the toilet doesn’t flush!
And the locals treat you mean!
And the service takes too long!

Other singers making recent appearances on the mp3 player:  Beverley Knight, Rihanna, Britt Nicole, The Lovin' Spoonful, Fergie, Christina Aguilera, Britney, Bananarama, and BoA, BoA, BoA (really; she's Britney without the drama -- great pop hooks, slick production, reliable hard-driving upbeat rhythms; the best reason yet for agreeing on VWP with South Korea). 

"No, really. It's no trouble. I've got my password right here, OK?"

EFF has spent years complaining that DHS's policy for searching laptops at the border is uncivilized.  Luckily, the new Administration wasn't too impressed with the complaints. It made some minimal changes and left the rest of the policy in place. 

As for those who think DHS's policies are the scraping the bottom of the civil liberties barrel, well, sometimes you have to leave the country to appreciate it. 

According to Engadget, one American crossing the border at Jerusalem got a laptop search to remember -- and a souvenir to remember it by.  As Engadget reports,

Young American woman travels over to Jerusalem to meet some friends, see the sights, live the life. Overzealous border security officers ask her a bunch of questions, take issue with her answers, and a few well-placed bullets later she is allowed entry into the country with a somewhat altered MacBook in tow.

Photo: Lilly Sussman

Negotiating over cyberattacks

The New York Times reports that the U.S. has begun talks with Russia about limits on cyberwarfare.  The Russians characterize the talks that way because such limits would inevitably end up regulating cyberespionage.  (Speaking broadly, the main difference between cyberwarfare and cyberespionage is what you do once you're inside the system.)  Disarmament is a great framing device for the Russians, because the difference between legal compliance in the two countries' intelligence services would hobble the US while not affecting Russian intelligence gathering.

The US denies that it's talking about cyber disarmament and insists that it's just seeking increased Russian cooperation in fighting cybercrime.  Of course it's hard to keep dangerous topics off the agenda once talks begin.  Whether there are any real benefits to be gained by opening the door to disarmament talks remains to be seen.

Update:  The Russians have been using the NYT for this kind of leak for months.  And I've been skeptical at least as long.

Update:  Ralph Peters agrees.

Cybersecurity and Climategate

I've been saying for a couple of years now that the countries that conduct computer network attacks will begin trying to influence political debates in other countries. I thought they'd graduate from breaking into campaign and government networks to selectively leaking what they find.

Now, the Daily Mail says this has already happened -- on a global scale. Hackers of course have been widely blamed for the release of an email and document trove from the Climate Research Unit in the UK. The ensuing scientific scandal, known as "Climategate," seems to show climate scientists plotting to "hide the decline" in global temperatures from the middle ages to the present. As a result, skeptics have vigorously questioned the need for the drastic measures contemplated by the Copenhagen IPCC negotiators. The Saudis, for example, have claimed that the hacked emails undercut the entire raison d'etre of the Copenhagen talks.

Now the Daily Mail is speculating that the Russian security services were behind the exploit:

"An investigation by The Mail on Sunday has discovered that the explosive hacked emails from the University of East Anglia were leaked via a small web server in the formerly closed city of Tomsk in Siberia."

The evidence is thin but intriguing. First, the emails apparently first showed up on the servers of a Tomsk university that has in the past been used for cyberattacks that coincided with Russian state interests. Says the Mail:

Computer hackers in Tomsk have been used in the past by the Russian secret service (FSB) to shut websites which promote views disliked by Moscow.

Such arrangements provide the Russian government with plausible deniability while using so-called ‘hacker patriots’ to shut down websites.

In 2002, Tomsk students were said to have launched a ‘denial of service’ attack at the Kavkaz-Tsentr portal, a site whose reports about Chechnya angered Russian officials.

The FSB office in Tomsk put out a special Press release saying that what the students had done was a legitimate ‘expression of their position as citizens, one worthy of respect’.

Second, the university claims to have tight computer security, requiring great sophistication to post and then quickly remove the documents.

Third, East Anglia has "gone out of its way to promote itself to students from the former Soviet Union. Its website says that 33 Russian students currently study there."

The Daily Mail's speculation was at least partially encouraged by a high-ranking member of the international climate science body:

Jean-Pascal van Ypersele, a vice-chairman of the Intergovernmental Panel on Climate Change (IPCC), said that the theft from the University of East Anglia’s Climatic Research Unit (CRU) was not the work of amateur climate sceptics, but was a sophisticated and well-funded attempt to destroy public confidence in the science of man-made climate change. He said the fact that the e-mails were first uploaded to a sceptic website from a computer in Russia was an indication that the culprit was paid.

“It’s very common for hackers in Russia to be paid for their services,” he said. “If you look at that mass of e-mails a lot of work was done, not only to download the data, but it’s a carefully made selection of e-mails and documents that’s not random at all. This is 13 years of data and it’s not a job of amateurs.”

None of these reasons is especially compelling. The alleged security of the Tomsk network is a particularly dubious claim. Few universities have genuinely secure networks, and posting the trove on a Russian university server is almost certainly not beyond the capability of anyone who could have broken into the East Anglia university system.

But the claim does open a new avenue of investigation. If the Tomsk network is really all that secure, there should be good logs for the network. These in turn should provide clues about the identity of the person who posted the data. If the Russian authorities refuse to produce the logs, or if they claim the data was overwritten or lost, suspicions will harden.

I'm also troubled by the question of motive. The Russians seem to have more to gain than to lose from the Copenhagen talks.  Why?  Because one of the biggest bits of "creative accounting" in the Kyoto agreement was Kyoto's use of 1990 as a starting point for measuring carbon reductions.

That allowed the former Soviet bloc to paint itself green -- as if the fall of the Berlin Wall was somehow a victory for climate regulation.  Far and away the most wasteful aspect of Communist economies was their use of (often coal-fired) electricity to produce uncompetitive goods. The collapse of Communism forced the closure of many coalburning facilities and dramatically cut carbon dioxide production in the old Soviet bloc. By awarding carbon credits for reductions after 1990, the Kyoto negotiators gave a windfall to the European Union, which absorbed many former Soviet satellite states, and an even bigger windfall to Russia and Ukraine. Call it the "Yeltsin dividend."

By taking credit for economic changes that had nothing to do with climate change, these countries could claim to have massively reduced their carbon footprint. It wasn't just moral currency, either. The windfall could be turned into hard cash under a cap and trade system -- countries with growing economies would buy credits from the countries that had closed inefficient communist factories and power plants.

That last point is what leaves me puzzled about the claim that the Russian government is behind the release of the emails. Why Russia would want to scupper Copenhagen? The Russians' negotiating position in the IPCC is that they want continued credit for carbon reductions after 1990, which they can then sell to the rest of the world.

If so, the Russians can't have a diplomatic interest in undermining the idea that carbon dioxide is causing unprecedented global warming. If skepticism about global warming takes hold, cap and trade proposals will lose their appeal, and the Russians will lose the "Yeltsin dividend."

So the Daily Mail speculation is interesting but hardly conclusive. And any effort to blame hackers for the leak will have to deal with a persuasive analysis by Lance Levsen, whose internal analysis of the computer files leads him to the conclusion that they were assembled by someone with authorized access to the files. Says Levsen:

The hacker would have to crack an Administrative file server to get to the emails and crack numerous workstations, desktops, and servers to get the documents. The hacker would have to map the complete [university] network to find out who was at what station and what services that station offered. S/he would have had to develop or implement exploits for each machine and operating system without knowing beforehand whether there was anything good on the machine worth collecting.

The only reasonable explanation for the archive being in this state is that the FOI Officer at the University was practising due diligence. The [university] was collecting data that couldn't be sheltered and they created FOIA2009.zip.

It is most likely that the FOI Officer at the University put it on an anonymous ftp server or that it resided on a shared folder that many people had access to and some curious individual looked at it.

If as some say, this was a targeted crack, then the cracker would have had to have back-doors and access to every machine at UEA and not just the CRU.

Levsen's analysis is useful, but it doesn't exclude hacking as the source of the data. First, even if assembled by an authorized user, the files could nonetheless have been found and released by a hacker.  Second, the rise of Ghostnet attacks in which hackers use spearphishing combined with privilege escalation to gain network administration privileges undermines Levsen's assumption that no hacker could have broken into all of the relevant machines and assembled all of the relevant data. We have certainly seen reports recently describing attacks in which the hackers showed great discrimination in what documents they took and in which the hackers assembled big zip files (encrypted) of those documents before exfiltrating them.

What does it all mean? Well, the case for nation-state hacking as the source of the documents is still quite speculative. But here at home the documents have clearly begun to undermine support for climate change regulation. So the Obama Administration's effort to salvage agreement in Copenhagen is fraught with new risk. In a very real sense, the Administration has been wounded by whoever released the documents.

I don't know how all this will turn out, but at least there could be one silver lining.

Given all the political fallout from this hacker attack, maybe now we'll get a cyberczar.

Travel Data Is Key to Domestic Terrorism Arrest

The Wall Street Journal has flagged a massively important use of travel data by CBP to catch a serious domestic terror suspect.  Cam Simpson and Siobhan Gorman get a great exclusive showing that David Headley, an American suspected of aiding the Mumbai attacks, was tripped up because the story he told upon arrival in the US didn't match his travel records or the materials in his luggage.

The key passages, though, fail to give credit to any agency.  Just some anonymous "inspectors" and "agents":

Terror suspect David Headley was questioned by an airport inspector in August and deceptive answers about his travels abroad helped officials begin to unravel Mr. Headley's alleged double life.

The 49-year-old Chicago man was charged this week for helping plot the terror attack in Mumbai a year ago that killed 166 people.

Federal authorities, already suspicious of him, used his return to the U.S. this summer as an opportunity, according to officials. A border inspector asked Mr. Headley about his overseas travel, according to court records and people familiar with the case.

Mr. Headley said he was working for a company called First World Immigration Service. First World is a business that allegedly provided Mr. Headley with cover as he traveled to scout terrorist targets for Lashkar-e-Taiba, the group responsible for the November 2008 assault in Mumbai, according to the federal charges.

Agents searched Mr. Headley's luggage and found it "contained no papers or other documents relating to such a business," according to court documents. They also searched tax records and found no record of income paid to Mr. Headley by the company, court records show.

Hey, Cam, Siobhan!  Where do those unnamed "border inspectors" and "agents" work?  Was it a perceptive DHS investigator who first went looking for the dog that didn't bark (the records any businessman would have had -- but Headley didn't)?  A DHS agent who went the extra mile to check tax records -- not exactly the first thing Headley was expecting at the border?  Was it DHS's travel record data that first flagged Headley for unusual travel -- and that showed he wasn't being truthful when questioned?

OK, I'm guessing that the FBI is the source of the story, but come on, guys, that shouldn't mean you have to deny credit where credit is due.

Well, even if the WSJ isn't offering congratulations, let me be the first to do so publicly.  This is a great example of how DHS, by taking a unified approach to border security, has made a difference over the past years.  Good work.  And thanks.