Skating on Stilts

Privacy surprises ... that somehow aren't

If you’re looking for laws of unintended consequences, you can’t do better than privacy.  Take two examples plucked from last week’s front pages:

Here’s the New York Times reporting on massive fraud in the billion-dollar settlement of claims that the Agriculture Department discriminated against black, Hispanic, and female farmers:

“It was the craziest thing I have ever seen,” one former high-ranking department official said. “We had applications for kids who were 4 or 5 years old. We had cases where every single member of the family applied.” The official added, “You couldn’t have designed it worse if you had tried.”

… “[T]here was no way to refute what they said,” said Sandy Grammer, a former program analyst from Indiana who reviewed claims for three years. “Basically, it was a rip-off of the American taxpayers.”

The true dimensions of the problem are impossible to gauge. The Agriculture Department insists that the names and addresses of claimants are protected under privacy provisions.

And here’s a Boston Herald report on its attempt to find out how many benefits the Tsarnaevs received before their bombing attack on the Boston Marathon:

The Patrick administration clamped down the lid yesterday on Herald requests for details of Tamerlan Tsarnaev’s government benefits, citing the dead terror mastermind’s right to privacy.

Across the board, state agencies flatly refused to provide information about the taxpayer-funded lifestyle for the 26-year-old man and his brother and accused accomplice Dzhokhar Tsarnaev, 19.

On EBT card status or spending, state welfare spokesman Alec Loftus would only say Tamerlan Tsarnaev, his wife and 3-year-old daughter received benefits that ended in 2012. He declined further comment.

On unemployment compensation, labor department spokesman Kevin Franck refused to say whether Tamerlan Tsarnaev ever collected, saying it was “confidential and not a matter of public record.”

On Dzhokhar Tsarnaev’s college aid, University of Massachusetts Dartmouth spokesman Robert Connolly said, “It is our position — and I believe the accepted position in higher education — that student records including academic records and financial records (including financial aid) cannot under federal law be released without a student’s consent.”

On cellphones, the Federal Communications Commission would not say whether either brother had a government-paid cellphone, also citing privacy laws.

Who knew?  Thanks to privacy law, people making dubious claims on a judgment fund don't have to be identified as though they were litigants; and benefit recipients are protected from embarrassment even after death has made embarrassment the least of their troubles.  

Actually, privacy laws have a long history of unintended consequences. Libertarians were outraged when citizens got arrested for recording the police; but those arrests were often based on state privacy laws that prohibited "eavesdropping" on conversations without all parties' permission.  And laws inspired by Louis Brandeis’s famous right to privacy have become the mechanism by which celebrities extract fees for commercial use of their photos.  

These unintended consequences aren't really an accident.  We think we know what we want when we pass laws protecting privacy, but it turns out that our notions of privacy are remarkably fluid and situational, so by the time the laws are actually applied they don’t actually correspond to our sense of right and wrong.  It works about as well as a law codifying and punishing rude behavior in public.

But in another way, there’s nothing at all surprising about the consequences of privacy laws.  From arresting citizen photographers to clamping a lid on government scandals, privacy laws almost always turn out to be remarkably convenient for the powers that be. 

Again, that’s not an accident.  As particular privacy laws lose their connection to evolving cultural standards, we slowly stop enforcing them (see, e.g., Brandeis, supra) .  But they still get dusted off and enforced in a couple of situations:  (1) To punish people whom the authorities don’t like but who haven’t violated any other laws and (2) to protect the kind of people who end up running the government.

Or, to put it another way, it looks as though privacy laws are doing for the twenty-first century what loitering laws did for the twentieth. 

PHOTO: Kai Strandskov

UPDATE: I realized after posting that I had improperly lumped two unintended consequences of privacy laws together in blaming Louis Brandeis for arrests of citizens photographing the police.  Instead those arrests are the heritage of privacy campaigners from the 1960s, who insisted that anti-eavesdropping law prohibit all unconsensual recording.  Louis Brandeis did, however, inspire  the quasi-intellectual-property "right of publicity," an equally unintended outcome of laws adopted to preserve privacy.

Why wasn't Tsarnaev questioned at the border?

There's been considerable speculation about how the government handled Tamerlan Tsarnaev's return from Russia. Before Tsarnaev's return, both the FBI and the CIA had suggested that Tsarnaev belonged in the government's classified terrorist database, and according to some reports an alert for Tsarnaev was entered into the DHS border system. Yet according to Secretary Napolitano  these systems "pinged" when Tsarnaev left the country but not when he returned six months later.

The lack of a ping upon Tsarnaev's return to the United States suggests a gap in US border defenses.  In general, the outbound "ping" is not a big deal.  It tells us that a terror risk is leaving the country, more a matter for celebration than suspicion.  We don't usually inspect or question departing passengers, so it would have taken a pretty unusual notice to earn Tsarnaev much scrutiny on departure.

But his return should have been different.  He was entering the country, and at the border the government's authority to stop travelers, to question them, and to search their luggage, including their electronics, is at its zenith.  

If we have any doubts about the intentions of a returning green-card holder, this is the time and place to question him. When the FBI paid a visit to Tsarnaev's home, Tsarnaev had complete control of the interview.  He could throw the agents out whenever he chose, and he could certainly refuse to let them look at his computer and phone.  

At the border, though, he can't.  We could have learned a lot more about Tsarnaev's journey into radicalism there.  For example, the FBI's preliminary investigation included checking to see if Tsarnaev had posted on certain radical Islamist websites, but it couldn't know what he might have downloaded, and it's not clear that the FBI had any way to tell what he might have posted under a pseudonym.  Again, the government had its best chance of discovering those things by conducting a secondary inspection of Tsarnaev when he returned from Russia.

So why didn't it? I doubt that it was a lack of DHS resources or a flood of higher priority travelers.  There may be half a million people in the terror database, but on any given day, there can't be more than a couple of dozen flying into the United States. Since DHS conducts hundreds if not thousands of secondary inspections at airports every day, you'd expect it to routinely take a look at everyone who's ended up in the terrorist database.

Unless they've been cleared.  There was a hint in Secretary Napolitano's testimony that Tsarnaev wasn't interviewed at the border because the FBI had closed its investigation.  This may mean that the administration has adopted a policy of treating the closure of an FBI preliminary investigation as "clearing" the subject of the investigation.

There are lots of ways that such a policy could have come about.  The FBI could have claimed exclusive authority to interview terror risks at the border, so when DHS calls to say "We've got this guy Tsarnaev coming in; do you want to talk to him?" and the bureau says, "Nah, we closed his case," then DHS is expected to stand down.

If that's the policy, it's dumb.  The FBI may have closed its investigation because it didn't find anything using its very limited authorities, but that should not prevent other agencies from using broader authorities to explore the Russian warnings in more detail.

It's also possible that DHS itself has adopted a policy of not inspecting people in the terrorist database if the investigation has been closed.  That would be equally dumb; closing an investigation for lack of evidence is not the same as clearing the traveler of all suspicion, especially given the FBI's limited ability to act on a vague tip from Russia.

In any event, this is one place where we should be seeking lessons from the Tsarnaev matter.  It sure looks as though the system failed.  Tsarnaev should have been given a very close look as he entered the United States. But it seems as though someone -- probably at the FBI, perhaps at DHS or elsewhere -- decided we should just say "Welcome home" and wave him through.

We should know who made that call, and we should know why.

PHOTO source: FBI, Wikipedia

Fool me once ...

 

 

 

 

Sources: ACLU on street cameras and CISPA; EFF on street cameras and CISPA

George Gershwin and the President's CISPA Veto Threat

This White House sure knows how to snatch defeat from the jaws of victory.

The President's threat to veto CISPA (Download Cyber - S A P ) will likely kill cybersecurity legislation for the year.

Here's the sentence that I believe will eat away at support for the legislation among its last defenders in Silicon Valley:  "The Administration ... remains concerned that the bill does not require private entities to take reasonable steps to remove irrelevant personal information when sending cybersecurity data to the government or other private sector entities."

Those last four words signal a big change in the status quo.  Most companies today can share information voluntarily with the government without legal constraint, though electronic service providers must demand a subpoena before sharing information. And practically all companies, including electronic service providers, may share cybersecurity information with other private companies without worrying that the government is looking over their shoulders.

So in demanding that CISPA limit sharing with "other private sector entities," the Administration is proposing a sweeping new regulatory scheme for the private sector. The scheme will actually impair cybersecurity by restricting the information-sharing companies now conduct to protect their networks.

And while the Statement of Administration Position tries to make the new regulatory scheme sound less harsh by claiming that it only requires "reasonable" steps to remove "irrelevant" private information, those words are code for "You'll need a lawyer before you share any cybersecurity information with anyone."  After all, reasonableness is a famously elastic concept in the law; you only really know whether your actions were reasonable five years after the fact, when the judge rules. 

And what is "irrelevant personal data" exactly?  Can an ISP identify the IP address of the computers sending DDOS packets toward a victim?  Much of the time an IP address is personal -- it identifies an individual, or at least a family.  So is it "relevant" under the Administration's new proposal?  Maybe. Stopping a DDOS attack is often easier if the victim knows the attackers' IP addresses, but does the ISP have to verify that the IP address will actually help the victim stop the attack before handing it over? Will these quick decisions all be second-guessed at leisure by some privacy bureaucrat?   

I say security, you say liability. Let's call the whole thing off. 

It's hard to see any company supporting a bill that turns today's largely functional and scandal-free cybersecurity information exchanges into minefields of uncertainty.  And in the absence of industry support, CISPA will be SOPA without Hollywood.

What's remarkable is that the President started this debate by asking for almost exactly what the House Intelligence Committee has delivered.  Here is the Administration's original legislative proposal on information sharing. On a quick review, I don't see any limitations in the President's proposal on what data the private sector can share -- only limitations on what the government can do with the information it receives. Now that it comes to that, I don't see a lot of the things that the President is suddenly highlighting as fatal flaws in CISPA.

So the short version of this story is simple:  The President says he will veto CISPA because it lacks features that he didn't even bother to include in his own version of the same bill. 

This is some of the flakiest policy making I've ever seen at such a high level, and it strongly suggests that the Administration just isn't that serious about information sharing for cybersecurity.

PHOTO: Donovan Govan

NOTE:  For those who complained that Steve McQueen was an anachronistic cultural reference, please note that I have taken your advice to heart and am now appealing to an entirely different generation.

Luxembourg: The Steve McQueen of Cybersecurity

Here's the scant good news on cybersecurity It’s getting harder for attackers to hide.  The same security weaknesses that bedevil our networks can be found on the systems used by our attackers. A shorter version is something I call Baker’s Law: “Our security sucks.  But so does theirs.”

That’s good news because, with a little gumption, we can exploit hacker networks, gather evidence that identifies our attackers, and eventually take action that will make them regret their career choices.

Unfortunately, the United States has been sitting out this attribution revolution.  Our vaunted CyberCommand may be energetically exploiting hacker networks, but it isn’t helping private victims of cyberespionage. Foreign governments are hacking US companies, law firms, activists, and individuals with abandon, but our government seems unable or unwilling to stop the attacks or identify the attackers.  In fact, hacking victims who want to gather evidence against the bad guys are being warned off, told that conducting a private investigation could put them at risk of prosecution.  As an anonymous Justice Department recently told the press,

 “Arguments for or against hack-back efforts fall into two categories: law and policy,” the DOJ spokesman told BNA. “Both recommend against hack-back. Under current law, accessing a computer that you do not own or operate without permission is likely a violation of law. And while there might be something satisfying about the notion of hack-back on a primal level, it is not good policy either.”

 Actually, the spokesman could have stated the Department’s policy even more concisely: “We don't know how to protect you, but we do know how to keep you from protecting yourselves.”  

Justice wants to cut off the debate over hacking back. But it’s too late for that.  Even if Justice adopts something tougher than its carefully qualified (and longstanding) statement that hackbacks are “likely a violation” of federal law, all it can really do is drive hackbacks offshore, leaving US companies more exposed to intrusions than companies in more tough-minded jurisdictions. 

Exhibit A for this theory is a recent cybersecurity report from two Luxembourg entities, a private computer incident response team and iTrust Consulting.  Because it turns out that, as far as hackbacks go, little Luxembourg has more cojones than the entire United States cybersecurity establishment.

The report, by Paul Rascagnères, focuses on “APT1” -- the cyberespionage gang recently identified by Mandiant as Unit 61398 of the Chinese People’s Liberation Army.  For those of us who think hackback is a useful cybersecurity policy tool, the report is both informative and fun -- because Rascagnères served APT1 a double helping of what the unit has been dishing out to the rest of us for years.  

Inspired by Mandiant, Rascagnères decided to go hunting for the hacking unit’s command and control infrastructure.  Unlike Mandiant, though, he didn’t start with victims and track back to the controllers.  Instead, he started at the other end, scanning whole networks of machines to find ones that were running Poison Ivy, the hackers’ favorite Remote Access Tool, or RAT.  Poison Ivy operates in a client-server model, where the client is installed on a victim's computer and connects to the attacker’s server. The server software presents a graphical user interface for surreptitiously controlling another persons computer. (Several screenshots of this “exploit GUI” are included in the report.) 

The first thing Rascagnères discovered was that APT1 only ran its Poison Ivy servers during office hours – 8 to 5 Shanghai time. That by itself was a pretty good clue for attribution, but Rascagnères was just getting started.

 Building on another researcher’s identification of weaknesses in Poison Ivy, Rascagnères did what any red-blooded Luxembourger would do (someone please cover the Justice Department’s eyes):  he broke into and mapped the hackers’ exploitation network.

And he collected valuable intelligence about how the Chinese unit is responding to the publicity generated by Mandiant’s report.  The Mandiant report described a unit that controlled many victims through a single command and control server, often a compromised machine in the United States.  This meant that when Mandiant got access to that command and control machine, Mandiant could identify dozens of other victim networks.   

What Rascagnères found was more sophisticated – and partially protected from Mandiant’s technique.  Now, it appears, the Chinese hacking unit is covering its tracks by assigning every victim his own dedicated proxy server connected to his own Poison Ivy server. Both machines are remotely controlled by mechanisms (Remote Desktop Protocol and VMWare remote desktop) that obscure the actual location of APT1.  All of this makes it much harder to develop signatures of compromise, since exposing one exfiltration route reveals only a single “bad” IP address and no additional victims. 

 But Rascagnères caught the Chinese unit recycling IP addresses. When a victim realized he’d been infiltrated and started blocking his dedicated Poison Ivy IP address, the unit simply assigned that address to a different victim. So it’s still possible to assemble a list of victims and bad IP addresses, but only if each victim shares every “bad” IP address used against him, and that information is widely disseminated to other potential victims.  These changes tell us a couple of things about the Chinese unit.  First, they’re too cheap, too poor, or too invested to get a new IP address for every new compromise; that’s  a weakness we can work.  And second, given how easily their new scheme can be defeated by widespread information sharing, they must be betting against adoption of CISPA. (The ACLU must be really popular these days in Beijing.)   

Even these discoveries didn’t end the drama.  At one point, the Chinese hackers realized that their network had been penetrated.  They started searching for the intruder, but so hamhandedly that he spotted the effort.  He installed a keylogger on the Poison Ivy servers that he had hacked and waited for the Chinese to log in to their proxy servers.  Then he dropped his compromised connection to the Poison Ivy servers and instead hacked the proxy servers using the Chinese hackers’ credentials. Once in the proxy server, his connection to the network looked like every other victim network communicating with its controller. 

That’s impressive but Luxembourg’s finest wasn’t even close to done. While he was in the hacker’s network Rascagnères copied their remote access logs to map the attackers’ workstation machines.  Then he rifled the Poison Ivy servers to find the tools the hackers were using -- as well as all the data they were stealing from victim networks. The data had been password-protected by the hackers, so he brute-forced their passwords. And, while the Chinese unit was probably still desperately trying to figure out whether they’d successfully locked the intruder out, he exfiltrated  all their stuff out from under their noses. 

For those who’ve been the victims of Unit 61398, that sure sounds familiar.  And deeply satisfying.  Unless you’re the United States Justice Department, in which case it sounds like a felony, and “not good policy either.” 

Justice couldn’t be more wrong.  This kind of tactic is absolutely essential if we want to create an effective defense against cyberespionage. Thanks to Luxembourg’s machismo, we won’t have to learn Unit 61398’s new tactics by trial and error; and we already have ways to thwart the new tactics, plus a store of tools and stolen data.   

Oh and one more thing:  while he was playing with their command and control system, Rascagnères discovered that it didn’t correctly parse data sent by a victim machine.  Using that flaw, he wrote what looks to me like the first public zero-day exploit of the hackers’ own tool and released the code for other researchers to use.  

Perhaps the Justice Department thinks that the government could have found all of this out on its own.  Maybe the government already knows all this from its own supersecret penetrations of Chinese hacker networks, achieved without any help from vigilantes like Rascagnères.  I kind of doubt it, but the more important fact is that it doesn’t really matter to all the private victims in this country what the government knows.  We need to know it too.  And because it wants to protect its sources and methods, the government isn’t likely ever to tell us.  After all, it didn’t tell us about Unit 61398, or about Luckycat, or about Ghostnet.  Everything we know about China’s hackers we owe to brave private citizens like Trend Micro and Mandiant and Citizen Lab, who went right up to the line that Justice is busily waving everyone away from.  

Now we owe a lot to Paul Rascagnères, though he seems to have treated the Justice Department’s line the way Steve McQueen treated the fence in The Great Escape. 

Well, God bless him, he’s showing us a new path to cybersecurity.  It’s better than the old path, for sure.  And no matter what the Justice Department says to American companies, the rest of the world is going to follow.

ART CREDIT: iTrust Consulting and Malware.lu

CAVEAT:  As always, I welcome corrections to my understanding of technical matters.

 

Will CISPA Amendments Hurt Cybersecurity?

The House intel committee is amending CISPA to address privacy criticisms.  Politico's Tony Romm reports on some of the likely amendments:

Still another amendment specifies clearly that CISPA won't allow companies to "hack back" their hackers in pursuit of stolen trade secrets ...

Really?  A government that can't protect us is debating new measures to make sure we can't protect ourselves? 

Well, it does sound kind of familiar ...

UPDATE:  To be fair, I've now seen the proposed  amendment, and it tries to avoid taking a position on active defense, simply saying that CISPA doesn't give any additional authority to private actors who want to investigate their attackers.  That's still a bad idea, and rather than putting forward a sponsor's amendment, the committee leadership should tell us exactly who asked them to reduce computer hacking victims to helpless computer hacking victims.  This article hints that the idea came from the White House and the Justice Department's leadership.