Skating on Stilts

China’s use of privacy law raises questions for privacy advocates

China seems to have found a reliable legal tool for suppressing dissent.  A prominent Chinese human rights lawyer, Pu Zhiqiang, has been arrested after a meeting in a private home to commemorate the 25^th anniversary of the killings at Tiananmen Square.  The charge?  “Illegal access to the personal information of citizens,”  a crime punishable by three years in prison. 

Clearly, China is on its way to earning a second Privy nomination for “Worst Use of Privacy Law to Protect Power and Privilege.”

But where are EFF and EPIC and CDT and the ACLU?  This is not the first time China has brought privacy charges against politically disfavored defendants.  Why haven't these advocates of more privacy law vocally condemned China's use of privacy law to foster oppression? 

The same question might be asked of the Article 29 Working Party in the European Union, along with a second one: How is China’s law different from the data protection laws that Europe has been urging the world to adopt? 

Do France and Belgium have direct wiretap access to telecom switches?

Vodafone put out a highly informative report on the intercept practices of the countries where it does business. The greatest news interest was spurred by its statement that some countries tap directly into the provider's infrastructure and take what they want without notice to the provider: 

In a “small number” of countries, Vodafone said in the report, the company “will not receive any form of demand for communications data access as the relevant agencies and authorities already have permanent access to customer communications via their own direct link.”

Vodafone refused to name the countries. But I can't help thinking that the report provides some pretty clear clues about two of them. I suspect we'll soon discover that they are France and Belgium. 

The reason is buried in the footnotes to the report. The report gives reasons when it does not disclose the number of lawful intercept warrants the company received in a particular country. Sometimes reporting on wiretaps is prohibited by law.

But in eight cases, the report doesn't cite legal restrictions on disclosure.  Instead, it says that it has no intercept numbers because there is “no technical implementation” of lawful intercept capabilities in those countries. In one country, Kenya, there's no implementation because Kenyan law prohibits operators from deploying wiretap capabilities. In the other seven, though, the reason the company gives is murkier: “We have not implemented the technical requirements necessary to enable lawful interception and therefore have not received any agency or authority demands for lawful interception assistance.” 

You might think those are countries that have simply decided not to do lawful intercepts, perhaps because intercept equipment is expensive or technically demanding. For five of the seven, that's plausible. They are Mozambique, Ghana, Lesotho, Tanzania, and Fiji. 

But the other two on the list are France and Belgium. Does anyone think that these two countries lack the resources, the technical skills, or the will to conduct lawful intercepts? Hardly. France is second to none in its enthusiasm for state intelligence collection, and especially for wiretaps. And Francophone Belgium is often heavily influenced by the governing style of French institutions. 

It is inconceivable that these two countries lack a robust wiretapping capability. It is also inconceivable that they would fail to tap mobile phone systems, including Vodafone's. Yet Vodafone says that it has not received any demands for lawful interception from these countries and has not implemented the technical requirements to enable lawful interception. 

The answer may be in how the Vodafone report seems to define lawful interception -- as requiring that the operator carry out the wiretap: 

“In most countries, governments have powers to order communications operators to allow the interception of customers’ communications. This is known as ‘lawful interception’.... . Lawful interception requires operators to implement capabilities in their networks to ensure they can deliver, in real time, the actual content of the communications (for example, what is being said in a phone call, or the text and atachments within an email) plus any associated data to the monitoring centre operated by an agency or authority.”

So if Vodafone had been ordered simply to give the governments of France and Belgium direct access to Vodafone switches, I'm guessing that Vodafone's report would say that it had not implemented lawful interception in those countries. Which is what it does say.

Maybe I'm wrong about this, but my money is on Belgium and France as two of the countries with "direct access" to telecom switches.  

I'm sure the European Commission will investigate, as soon as they finish their proposals for reforming NSA, FBI, DHS, Treasury, CIA, and the Bureau of Land Management.

UPDATE:  Corrected Vodaphone to Vodafone.  Thanks, Bart (Amon_RA)

 

Contest! Hacking the right to be forgotten

Just how dumb is the “right to be forgotten”? Google will make it easy to find out. That's because Google has automated the process for making takedown requests under the European Court of Justice's “right to be forgotten” ruling. If you've got a piece of personal data that you'd like forgotten, all you have to do is fill out Google's handy online form.

Anyone can make a request (though you'll need to take a digital photo of a piece of ID as proof of identity). You then need to find a link (using a European version of Google) and  explain why the personal data at the link is inaccurate, outdated, or inappropriate. The opportunity for abuse is obvious.

I feel bad for Google, which is stuck trying to administer this preposterous ruling. But that shouldn't prevent us from showing quite concretely how preposterous it is.

I propose a contest. Let's all ask for takedowns. The person who makes the most outrageous (and successful) takedown request will win a “worst abuse of privacy law” prize, otherwise known as a Privy. 

To get you started, here are the four requests I've already filed.

1. Ban this book!

 URL:

 http://books.google.co.uk/books?id=-sBl2MiaodoC&pg=PA3&lpg=PA3&#v=onepage&q&f=false

 Reason this link violates the right to be forgotten:

 The book claims that in 2007 I narrowly defeated Vladimir Putin and Tony Blair in a contest to win Privacy International's title “Worst Public Official.” The book also states that the prize was awarded because of NSA's controversial domestic surveillance activities, combined with fallout from the USA Patriot Act, and that the award is a “dubious” honor. This is inaccurate. In fact, I had little or nothing to do with either domestic surveillance activities at NSA or the USA Patriot Act, and the trophy is a “dubious” honor only in the sense that Privacy International never actually gave me the promised trophy, despite repeated requests on my part.

 2. Louis Brandeis memorial wuss fit over a photo

 URL:

 http://legaltimes.typepad.com/blt/2013/09/ex-nsa-gc-on-snowden-security-and-privacy.html

Reason this link violates the right to be forgotten:

 This image is outdated. It shows me with a beard.

 I don't have a beard now. And if you look at the picture, you'll realize why.

 3. You won't believe how much weight you can lose with this simple European Court of Justice trick

URL:

http://www.mccullagh.org/image/10/stewart-baker.html

 Reason this link violates the right to be forgotten:

 This image is outdated. It is 14 years old. I've lost weight since then.

 4. Oh hell, let's just censor people we don't like

 URL:

 https://www.techdirt.com/blog/?tag=stewart+baker

 Reason this link violates the right to be forgotten:

This link is inappropriate. It compiles stories making many distorted claims about my political views. Political views are a particularly sensitive form of personal data. The stories are written by men who disagree with me, and they are assembled for the purpose of making money for a website, a purpose that cannot outweigh my interest in controlling the presentation of sensitive data about myself.

 Think you can do better? Enter as often as you like and send the results to [email protected]. If you don't want your name listed as a winner, tell me, or use a pseudonym.

 Remember, though, that prizes will be awarded only for takedown requests that succeed. Please send details demonstrating that the link you identify was in fact taken down. 

Testifying to the Senate Intelligence Committee on the USA Freedom Act

I'll be testifying tomorrow afternoon before the Senate Select Committee on Intelligence, talking about the bill that bans NSA's bulk collection of metadata.  It passed the House after small amendments that privacy groups are now complaining loudly about.  

I don't like the bill for quite different reasons.  My prepared testimony is here: Download Stewart Baker Testimony June 5 2014 to Senate Intelligence Committee. 

After explaining why bulk collection should not be banned, here's what I say about the privacy groups' objections:

Everyone recognizes that if bulk collection requests are foreclosed, then the government must make individualized requests for data. And to do that, it has to give the companies specific search terms to use. Before amendment, the House bill said that the government could only ask the companies to use three kinds of search terms. They could only ask the companies to look for a suspicious “person, entity, or account.”

This was foolish. Clues come in many forms. What if the agency doesn’t know the suspect’s name but does know his internet address, or the unique identifier of his tablet? Those are properand specific search terms, and they are likely to be of value to terrorism investigators. So the bill was revised; now it allows the agency use search terms “such as … a person, entity, account, address or device.”

Some opponents have a beef with the addition of “address or device.” They claim that these words are too open-ended and ambiguous. But when asked to identify the ambiguity they fear, the critics offer only strained and unlikely interpretations. Senator Ron Wyden has said that the law as adopted by the House “could be used to collect all of the phone records in a particular area code, or all of the credit card records from a particular state.” This apparently rests on the remarkable view that a state or an area code is the same as an “address.” Wow. I knew Oregon was a big state, but I’m still surprised to hear that they’re using area codes as addresses out there.

Let’s be realistic. If that can be called an ambiguity, then no words will ever satisfy the critics. Why not object to the word “person,” for there are cases treating entire cities or counties as persons?

And dropping those words from the bill creates obvious and dangerous gaps in our ability to investigate terrorism. Take these examples:

• Suppose that attackers use a VOIP phone as in Mumbai. The phone might have only an IP address. If we drop “address” from the list, the government can’t serve a 215 order asking for information about the online activities of that phone.
• Or suppose that in a Mumbai-style attack the terrorists keep changing their SIM cards (and thus phone number); we would need to search not for the phone number but for the IMEI number that identifies the actual phone. Drop “device” from the list and the government can’t ask for that information.

Other opponents aim their fire at the words “such as.” They would drop those words, capping the list of search terms at five, or even three. This too is foolish and dangerous. Can the proponents of this change predict with perfect foresight which clues we’ll need to uncover the next conspiracy? I doubt it.

Again, a few examples show why we cannot foreclose the use of other specific search terms:

• What if we pick up intelligence that tells us that a terrorist is staying in a particular hotel room and we want the hotel to produce his name? Is a hotel room an address? Without “such as” in the list, we’ll still be in court arguing about that when he checks out.
• What if we face a terror attack like the Washington sniper case? Can we use section 215 to ask the phone companies to give us the numbers of any phones that were active in the vicinity of all five shootings when they occurred? That’s plenty specific, and a good idea too. I fear that even the current language might make it impossible for counterterrorism investigators to make such a request.
• What if we learn a terror suspect’s license plate number? Can we use section 215 to search DMV records for his name? Not if we’re limited to the five terms listed in the statute.

I suppose that the practical answer to some of these questions is that the government won’t use its counterterrorism or national security authorities. It will rely on criminal subpoenas, which don’t come with any of these restrictions. But if that is so, if the intent is to let our intelligence agencies have all this information as long as they rely on law enforcement authorities, then we’re back to privacy theater.

Or privacy farce, since the result of the legislative changes is to put the United States Congress on record as giving fewer tools to those investigating terrorism and national security threats than to those pursuing muggers and embezzlers.

 

The NYT makes the case for surveillance cameras

The ACLU and EPIC have campaigned long and hard against surveillance cameras in public spaces, and they've had considerable success -- despite a paucity of actual serious privacy abuses.  So it's worth remembering that all this privacy theater imposes real costs on crime victims.  

This story, headlined "After Boy and Girl Are Stabbed, Anger Over a Lack of Cameras" is only surprising because it appears in the New York Times:

The 7-year-old girl is hospitalized in critical condition, the only witness to a crime that so far defies explanation: A man stabbed two young children in the elevator of a public-housing project and escaped into the late-spring evening. Her best friend, a 6-year-old boy, is dead.

Though residents of the Brooklyn housing project saw a man fleeing through the development after the attack, he remained at large on Monday, the search made more difficult because the building has no surveillance cameras.

Living in housing projects in East New York means living with the daily threat of violence, and Boulevard Houses is no exception. But until Sunday night, parents felt safe taking their children downstairs to play....

The lack of cameras raised questions on Monday as elected officials accused the New York City Housing Authority, which manages the building, of being slow to install the cameras.

To be fair, I haven't seen reports suggesting that privacy groups opposed installation of surveillance cameras in these particular public spaces. Maybe they think that city-owned public housing should be as freely surveilled as private housing.  But I wouldn't take bets on it.

 

 

 

"Fast Eddie" Snowden's problem with the truth

The NBC interview with Edward Snowden was instructive in several ways.  He continues to present himself as a reasonable man who tried to stop illegal programs but was left with no option but to go public.  But the more closely you listen, especially when he says things that can be checked against the record, the more dubious his claim begins to seem.  

In fact, the NBC interview, and the exchange with NSA that followed, reveal a lot about Snowden’s style of truth-telling, which turns out to be hard to distinguish from, well, lying.  

When questioned about his claim to have raised concerns inside the NSA before breaking his promises of confidentiality, Snowden said, “I actually did go through channels, and that is documented. The NSA has records, they have copies of emails right now to their Office of General Counsel, to their oversight and compliance folks, from me raising concerns about the NSA’s interpretations of its legal authorities.”

This time, remarkably, NSA was not caught flat-footed. Showing an impressive grasp of the news cycle, the agency quickly released the only email that Snowden sent to the NSA GC.  It was clearly the message Snowden described, but it was nothing like a blown whistle. 

Instead, it asked a question straight out of high school civics.  Pointing to training materials about the agency’s sources of legal authority, starting with the Constitution, Snowden noted that the materials listed “Federal Statutes/Presidential Executive Orders” on a single line. He asked what in retrospect is a gotcha question with a phony humility worthy of Uriah Heep:  “I'm not entirely certain, but this does not seem correct, as it seems to imply Executive Orders have the same precedence as law. My understanding is that EOs may be superseded by federal statute, but EO's may not override statute. Am I incorrect in this?”

NSA’s lawyer responded promptly, and correctly, saying that EO’s were indeed subordinate to statutes.  And there the matter rested. 

Only the delusional would view that exchange as “raising concerns” about NSA’s programs.  But Snowden isn’t delusional.  He’s deliberately misleading us.  Because when we parse his answer, it turns out not to say what we thought it said.  What he actually said was that NSA  had emails “from me raising concerns about NSA’s interpretations of its legal authorities.” (Emphasis added.)

And sure enough, that’s exactly what his email did.  What it didn't do was raise concerns about the lawfulness or wisdom of NSA’s programs – which was of course the impression he meant to leave.  And, quite probably, it was an impression he thought he could get away with.  He didn't think NSA was capable of conducting a wild-goose chase through its email records and quickly declassifying what it found. 

When NSA showed how slippery his original answer had been, Snowden got angry, and his intemperate defense was equally revealing.  He insisted that this was not his only communication, that he had sent other messages to other offices.  But now we know how to read his claims, and it’s likely that those other emails, if they exist, are just more vague expressions of concern about “NSA’s interpretations of its legal authorities.” Because, on a really close reading, that's all he promised us.

Snowden’s second line of defense was to accuse the NSA of having lied earlier, when it said it found no record of his past objections.  Wrong again.  What NSA said at the time was, “we have not found any evidence to support Mr Snowden's contention that he brought these matters to anyone's attention." That’s still true, since the much-touted email doesn’t bring anything (other than Snowden's skill as sea lawyer and proofreader) to anyone's attention, nor does it raise any objection to any program.

In short, Snowden has revealed a lot about himself in this exchange.  In his original statement he worked hard to avoid an outright lie.  But he worked equally hard to leave a deeply false impression, and on a point where he thought the security agencies couldn't contradict him -- either because they were unable to search their records completely or because they were unable to declassify the truth.  I'm willing to bet that Edward Snowden didn't invent his approach to the truth just for this interview.  

More likely, it is something he's done before, such as when talked about NSA committing economic espionage.  He didn't quite say that NSA steals commercial secrets for American companies, but you have to parse him like the Talmud to realize that. Most listeners, and most headline writers, came away convinced that he had confirmed their worst suspicions.  

But if deploying technical truth in support of deliberate misrepresentation is Snowden's style, and I think it is, then there's one simple lesson.  The public can't trust him.  At least not when he offers hints and teases and “interpretations,” rather than factual statements backed by unequivocal documentary evidence.

And, come to think of it, hints and teases and interpretations of the ambiguous are pretty much all the public has been offered by Snowden and his journalist allies since, oh, about June of last year.