Law

The Senate roll call vote is here. Unless a reauthorization passes, various provisions of the USA PATRIOT Act set to expire after three years will expire on December 31, 2005. These provisions include roving wiretaps, the ability to obtain certain kinds of business records without a court order, expansion of wiretap capabilities, certain kinds of sharing between agencies of information obtained via wiretap, etc. The specific details of what was in the Senate bill and the corresponding House bill may be found here (PDF). Some of the pieces of these bills were beneficial, e.g., placing a sunset provision on the use of National Security Letters, which predated USA PATRIOT and which do not currently have an expiration date. Others extended provisions due to sunset on December 31, 2005 to 2006 or later years. (The ACLU has a lawsuit against the constitutionality of National Security Letters.) The vote was 52-47; 60 votes were needed to end the filibuster. 2 Democrats and 50 Republicans voted yes, 41 Democrats, 5 Republicans, and one independent voted no. Arizona: McCain and Kyl both voted yes. UPDATE (March 25, 2007): The link for the ACLU’s lawsuit on National Security Letters is stale, you can now find that information here. ...

News is now out that the Bush administration, in 2002, authorized the National Security Agency to conduct eavesdropping (on international email or phone calls) against U.S. citizens without court oversight. The NSA’s domestic surveillance is supposed to be limited to foreign embassies and missions, and to require court approval. This is not a power granted to the president by the U.S. Constitution. This abuse of power has apparently been exercised against as many as 500 people in the U.S. at any given time. The NY Times reports that some NSA officials, to their credit, refused to participate due to their concerns about the legality of the program. Note that the standards which the Foreign Intelligence Surveillance Court uses to approve wiretaps are already incredibly low (their decision algorithm is pretty close to “say yes to everything”), but apparently that was considered too great a barrier and it had to be bypassed. Approval of torture, secret CIA prisons in Europe, kidnapping citizens of other countries and taking them to Afghanistan… apparently the Bush administration has no respect for the U.S. Constitution on the principles behind it. ...

I just read in The Economist (I’m a few weeks behind and trying to catch up) that Ryanair wants to introduce gambling on flights by 2007, which it thinks may generate enough revenue to not have to charge passengers air fare. Ryanair has already offered free flights (you still have to pay about 15 pounds for taxes and fees) from London’s Stansted airport to some European destinations, as well as fares under five pounds. Ryanair took Southwest’s playbook and took it to the next level. They fly using smaller regional airports, make the flight crews pay for their own uniforms, etc. ...

Sunday morning’s first session was by Stuart Krone, billed as a computer security expert working at Intel. Krone, wearing a National Security Agency t-shirt, of a type sold at the National Cryptologic Museum outside Ft. Meade, spoke on the subject “Technology: Why We’re Screwed.” This was a fear-mongering presentation on technological developments that are infringing on freedom, mostly through invasion of privacy. The talk was a mix of fact, error, and alarmism. While the vast majority of what Krone talked about was real, a significant number of details were distorted or erroneous. In each case of distortion or error, the distortions enhanced the threat to individual privacy or the malice behind it, and attributed unrealistic near-omniscience and near-omnipotence to government agencies. I found his claim that the NSA had gigahertz processors twenty years before they were developed commercially to be unbelievable, for example. He also tended to omit available defenses–for instance, he bemoaned grocery store loyalty programs which track purchases and recommended against using them, while failing to note that most stores don’t check the validity of signup information and there are campaigns to trade such cards to protect privacy. Krone began by giving rather imprecise definitions for three terms: convenience, freedom, and technology. For convenience, he said it is something that is “easy to do,” freedom is either “lack of coercion” or “privacy,” and technology is “not the same as science” but is “building cool toys using scientific knowledge.” While one could quibble about these definitions, I think they’re pretty well on track, and that a lack of society intrusion into private affairs is a valuable aspect of freedom. Krone then said that the thesis of his talk is to discuss ways in which technology is interfering with freedom, while noting that technology is not inherently good or evil, only its uses are. He began with examples of advancements in audio surveillance, by saying that private corporations have been forced to do government’s dirty work to avoid Freedom of Information Act issues, giving as an example CALEA (Communications Assistance for Law Enforcement Act) wiretaps. He stated that CALEA costs are added as a charge on your phone bill, so you’re paying to have yourself wiretapped. He said that CALEA now applies to Voice Over IP (VOIP), including Skype and Vonage, and that the government is now tapping all of those, too. Actually, what he’s referring to is that the FCC issued a ruling on August 5, 2005 on how CALEA impacts VOIP which requires providers of broadband and VOIP services which connect to the public telephone network to provide law enforcement wiretap capability within 18 months. There is no requirement for VOIP providers which don’t connect to the public telephone network, so the peer-to-peer portion of Skype is not covered (but SkypeIn and SkypeOut are). This capability doesn’t exist in most VOIP providers’ networks, and there is strong argument that the FCC doesn’t have statutory authority to make this ruling, which is inconsistent with past court cases–most telecom providers are strongly opposing this rule. The Electronic Frontier Foundation has an excellent site of information about CALEA. Krone next talked about the ability to conduct audio surveillance on the inside of the home using 30-100 GHz microwaves to measure vibrations inside the home. This is real technology for which there was a recent patent application. He raised the issue of cell phone tracking, as is being planned to use for monitoring traffic in Kansas City (though he spoke as though this was already in place–this was a common thread in his talk, to speak of planned or possible uses of technology as though they are already in place). (This is actually currently being used in Baltimore, MD, the first place in the U.S. to use it.) He spoke very briefly about Bluetooth, which he said was invented by Intel and other companies (it was invented by Ericsson, but Intel is a promoter member of the Bluetooth Special Interest Group along with Agere, Ericsson, IBM, Microsoft, Motorola, Nokia, and Toshiba). He stated that it is completely insecure, that others can turn on your phone and listen to your phone’s microphone, get your address book, and put information onto your phone. While he’s quite right that Bluetooth in general has major security issues, which specific issues you may have depend on your model of phone and whether you use available methods to secure or disable Bluetooth features. Personally, I won’t purchase any Bluetooth product unless and until it is securable–except perhaps a device to scan with. Next, Krone turned to video surveillance, stating that in addition to cameras being all over the place, there are now cameras that can see through walls via microwave, that can be used by law enforcement without a search warrant, which hasn’t been fully decided by the courts yet. I haven’t found anything about microwave cameras that can see through walls, but this sounds very much like thermal imaging, which the Supreme Court has addressed. In Kyllo v. U.S. (533 U.S. 27, 2001) it was ruled that the use of a thermal imaging device to “look through walls” constituted a search under the Fourth Amendment and thus requires a search warrant. Scalia, Souter, Thomas, Ginsburg, and Breyer ruled with the majority; Stevens, Rehnquist, O’Connor, and Kennedy dissented. Krone briefly mentioned the use of “see through your clothes” X-ray scanners, stating that six airports are using them today. This technology exists and is in TSA trials, and was actually tested at a Florida airport back in 2002. A newer, even more impressive technology is the new Tadar system unveiled in Germany in mid-October 2005. He addressed RFIDs, and specifically RFIDs being added to U.S. passports in 2006, and some of the risks this may create (such as facilitating an electronic “American detector”). This is a real threat that has been partially addressed by adding a radio shielding to the passport to prevent the RFID from being read except when the passport is open. As Bruce Schneier notes, this is not a complete safeguard. Krone also stated that there is a California bill to put RFIDs in cars, with no commercial justification, just to “know where everyone is and what they have with them at all times.” I’m not aware of the bill he is referring to, but the use of transponders in cars for billing purposes for toll roads is a possible commercial justification. He spoke about the laser printer codes that uniquely identify all documents printed by certain laser printers, which have been in place for the last decade and were recently exposed by the Electronic Frontier Foundation and reported in this blog (Krone mistakenly called it the “Electronic Freedom Foundation,” a common mistake). He also briefly alluded to steganography, which he wrongly described as “the art of hiding information in a picture.” While hiding a message in a picture is one form of steganography, what is characteristic of steganography is that it is hiding a message in such a way as to disguise the fact that a message is even present. He then went on to talk about Intel’s AMT product–“Advanced Management Technology.” This is a technology that allows computers to be remotely rebooted, have the console redirected, obtain various information out of NVRAM about what software is installed, and to load software updates remotely, even if the system is so messed up that the operating system won’t boot. This is a technology that will be extremely useful for large corporations with a geographically dispersed work force and a small IT staff; there is similar technology from Sun Microsystems in their Sun Fire v20z and v40z servers which allows remote access via SSH to the server independent of the operating system, which allows console port and keyboard access, power cycling of the server, etc. This is technology with perfectly legitimate uses, allowing the owner of the machine to remotely deal with issues that would previously have required either physically going to the box or the expense of additional hardware such as a console server. Krone described AMT in such a way as to omit all of the legitimate uses, portraying it as a technology that would be present on all new computers sold whether you like it or not, which would allow the government to turn your computer on remotely, bypass all operating system security software including a PC firewall, and take an image of your hard drive without your being able to do anything about it. This is essentially nonsensical fear-mongering–this technology is specifically designed for the owner of the system, not for the government, and there are plenty of mechanisms which could and should be used by anyone deploying such systems to prevent unauthorized parties from accessing their systems via such an out-of-band mechanism, including access control measures built into the mechanisms and hardware firewalls. He then went on to talk about Digital Rights Management (DRM), a subject which has been in the news lately as a result of Sony BMG’s DRM foibles. Krone stated that DRM is being applied to videos, files, etc., and stated that if he were to write a subversive document that the government wanted to suppress, it would be able to use DRM to shut off all access to that file. This has DRM backwards–DRM is used by intellectual property owners to restrict the use of their property in order to maximize the potential paying customer base. The DRM technologies for documents designed to shut off access are intended for functions such as allowing corporations to be able to guarantee electronic document destruction in accordance with their policies. This function is a protection of privacy, not an infringement upon it. Perhaps Krone intended to spell out a possible future like that feared by Autodesk founder John Walker in his paper “The Digital Imprimatur," where he worries that future technology will require documents published online to be certified by some authority that would have the power to revoke it (or revoke one’s license to publish). While this is a potential long-term concern, the infrastructure that would allow such restrictions does not exist today. On the contrary, the Internet of today makes it virtually impossible to restrict the publication of undesired content. Krone spoke about a large number of other topics, including Havenco, Echelon, Carnivore/DCS1000, web bugs and cookies, breathalyzers, fingerprints, DNA evidence, and so on. With regard to web bugs, cookies, and malware, he stated that his defense is not to use Windows, and to rely on open source software, because he can verify that the content and function of the software is legitimate. While I hate to add to the fear-mongering, this was a rare instance where Krone doesn’t go far enough in his worrying. The widespread availability of source code doesn’t actually guarantee the lack of backdoors in software for two reasons. First, the mere availability of eyeballs doesn’t help secure software unless the eyeballs know what to look for. There have been numerous instances of major security holes persisting in actively maintained open source software for many years (wu-ftpd being a prime example). Second, and more significantly, as Ken Thompson showed in his classic paper “Reflections On Trusting Trust” (the possibility of which was first mentioned in Paul Karger and Roger Schell’s “Multics Security Evaluation” paper), it is possible to build code into a compiler that will insert a backdoor into code whenever a certain sequence is found in the source. Further, because compilers are typically written in the same language that they compile, one can do this in such a way that it is bootstrapped into the compiler and is not visible in the compiler’s source code, yet will always be inserted into any future compilers which are compiled with that compiler or its descendants. Once your compiler has been compromised, you can have backdoors that are inserted into your code without being directly in any source code. Of the numerous other topics that Krone discussed or made reference to, there are three more instances I’d like to comment on: MRIs used as lie detectors at airport security checkpoints, FinCen’s monitoring of financial transactions, and a presentation on Cisco security flaws at the DefCon hacker conference. In each case, Krone said things that were inaccurate. Regarding MRIs, Krone spoke of the use of MRIs as lie detectors at airport security checkpoints as though they were already in place. The use of fMRI as a lie detection measure is something being studied at Temple University, but is not deployed anywhere–and it’s hard to see how it would be practical as an airport security measure. Infoseek founder and Propel CEO Steve Kirsch proposed in 2001 using a brainscan recognition system to identify potential terrorists, but this doesn’t seem to have been taken seriously. There is a voice-stress analyzer being tested as an airport security “lie detector” in Israel, but everything I’ve read about voice stress analysis is that it is even less reliable than polygraphs (which themselves are so unreliable that they are inadmissible as evidence in U.S. courts). (More interesting is a “stomach grumbling” lie detector…) (UPDATE March 27, 2006: Stu Krone says in the comments on this post that he never said that MRIs were being used as lie detectors at airport security checkpoints. I’ve verified from a recording of his talk that this is my mistake–he spoke only of fMRI as a tool in interrogation.) Regarding FinCen, the U.S. Financial Crimes Enforcement Network, Krone made the claim that “FinCen monitors all transactions” and “keeps a complete database of all transactions,” and that for purchases made with cash, law enforcement can issue a National Security Letter, including purchases of automobiles. This is a little bit confused–National Security Letters have nothing specifically to do with financial transactions per se, but are a controversial USA PATRIOT Act invention designed to give the FBI the ability to subpoena information without court approval. I support the ACLU’s fight against National Security Letters, but they don’t have anything to do with FinCen. Krone was probably confused by the fact that the USA PATRIOT Act also expanded the requirement that companies whose customers make large cash purchases (more than $10,000 in one transaction or in two or more related transactions) fill out a Form 8300 and file it with the IRS. Form 8300 data goes into FinCen’s databases and is available to law enforcement, as I noted in my description of F/Sgt. Charles Cohen’s presentation at the Economic Crime Summit I attended. It’s simply not the case that FinCen maintains a database of all financial transactions. Finally, Krone spoke of a presentation at the DefCon hacker conference in Las Vegas about Cisco router security. He said that he heard from a friend that another friend was to give a talk on this subject at DefCon, and that she (the speaker) had to be kept in hiding to avoid arrest from law enforcement in order to successfully give the talk. This is a highly distorted account of Michael Lynn’s talk at the Black Hat Briefings which precede DefCon. Lynn, who was an employee of Internet Security Systems, found a remotely exploitable heap overflow vulnerability in the IOS software that runs on Cisco routers as part of his work at ISS. ISS had cold feet about the presentation, and told Lynn that he would be fired if he gave the talk, and Cisco also threatened him with legal action. He quit his job and delivered the talk anyway, and ended up being hired by Juniper Networks, a Cisco competitor. As of late July, Lynn was being investigated by the FBI regarding this issue, but he was not arrested nor in hiding prior to his talk, nor is he female. I found Krone’s talk to be quite a disappointment. Not only was it filled with careless inaccuracies, it presented nothing about how to defend one’s privacy. He’s right to point out that there are numerous threats to privacy and liberty that are based on technology, but there are also some amazing defensive mechanisms. Strong encryption products can be used to enhance privacy, the EFF’s TOR onion routing mechanism is a way of preserving anonymity, the Free Network Project has built mechanisms for preventing censorship (though which are also subject to abuse). ...

In the past week I attended two conferences–one work-related conference, the National White Collar Crime Center (NW3C)’s Economic Crime Summit in Phoenix on November 8-9, and one personal-interest conference, the Freedom Summit in Phoenix on November 12-13. I had thought after attending the first conference to write a blog entry comparing and contrasting them, but after attending the second conference I realized several of the talks there merit full entries of their own. Einzige also attended the Freedom Summit, so we will both have comments on parts of it. The Economic Crime Summit was put on by NW3C, a private organization that is funded by Congress and run mostly by former law enforcement personnel. It’s an example of one of many private organizations that exists in partnership with the public sector which seem to have proliferated lately for various reasons. Unfortunately, I believe some of the reasons include to be exempt from public disclosure (such as Freedom of Information Act requests) and to engage in activity which might be difficult for public sector agencies to do on their own. The Economic Crime Summit was mostly attended by law enforcement personnel from Arizona and elsewhere, representing federal, state, and local agencies as well as a small number of private companies, mostly banks. The main subject matter was economic crimes, with an emphasis on identity theft and fraud on the Internet and directed against the elderly. As I’m in charge of information security for a global telecommunications company, I have an interest in finding ways to prevent fraud and to help law enforcement catch such criminals. The Summit began in a large banquet audience of perhaps 300. To my surprise, everyone was asked to stand for the presentation of colors, the singing of the national anthem, and an ecumenical prayer by Chaplain Rabbi Robert Kravitz of the Phoenix Police Department. I felt like I had stepped into a military/religious alternative universe, and found Kravitz’ comment in his prayer about supporting the U.S. Constitution rather ironic. As NW3C is a private organization this was likely not an actual violation of the First Amendment, but since it is Congressionally funded and most of the presenters were from government agencies, it felt very much like a violation to me. I wonder if this kind of disregard for the sensibilities of nonbelievers is as common in law enforcement as it is in the military (with the Air Force Academy’s promotion of evangelical Christianity a particularly egregious example). Arizona Attorney General Terry Goddard showed up and gave a short talk after the invocation, which I thought was well-timed. Other morning breakfast banquet speakers included Arizona Department of Public Safety Director (and former Pinal County Sheriff) Roger Vanderpool, who also included a reference to God at the end of his talk, John Vincent of the Rocky Mountain Information Network, and Assistant Chief of Police for the Phoenix PD, Kevin Robinson. Fortunately, there was no further endorsement of the supernatural in any of the individual presentations I attended. F/Sgt. Charles Cohen of the Indiana State Police gave an excellent presentation on “Successful Investigation of Skilled Offenders” which included information on what information is available from FinCen (currency transaction reports, CTRs, for transactions over $10,000 are available to law enforcement without a subpoena; casino reports; foreign bank account information; Form 8300 reports of large purchases made with cash–these were expanded under the USA PATRIOT Act to include such things as automobile purchases, as I learned firsthand when I bought my last car with cash). I also attended talks on identity theft and electronic crime by a U.S. Postal Inspector, a U.S. Secret Service Agent, and a joint presentation by a Special Agent from the Office of the Inspector General of the Department of Education (I didn’t realize such an office existed–she investigates student loan-related fraud issues) and an Assistant U.S. Attorney. One of the things that struck me is how seemingly uncoordinated many of these federal law enforcement activities are, with the exception of some cooperation between the FBI and U.S. Secret Service (the latter of which has now moved from the Department of Treasury to the Department of Homeland Security). The use of private organizations like NW3C and others that were present with exhibits at the conference is probably in part due to actions by individuals trying to solve problems that arise from such separate silos. By contrast, the Freedom Summit did not begin with a prayer but with a debate on the existence of God between atheist George Smith and Mesa pastor Eric Lounsbery. I did not attend the debate, which took place on Friday night, as I feared it would not go as an Internet Infidels-sponsored debate would go. From what I heard, it was as bad as I feared, with Smith unprepared to address Lounsbery’s shotgunned series of arguments. (In a debate format, dropping the opponent’s arguments is a way to lose.) The public debate format is not a great format for seriously addressing any intellectual issue (written materials are essential for any real depth), but it can be done well if the participants are properly prepared and skilled and experienced at working in the debate format. The Freedom Summit was an interesting and entertaining mix of speakers from a variety of fields on topics relevant to personal freedom, with a few well beyond the fringe (which I’ll discuss individually). Especially good talks were given by David Friedman (on market failure), Chris Heward (on failings of government-sponsored science), Karen Kwiatkowski (on the war on Iraq), and Jim Bovard (on the Bush Administration and the use of the threat of terrorism to trample on civil liberties).

As reported at Brian Krebs’ Washington Post blog, there has been a class action lawsuit filed against Sony in California and another one about to be filed in New York. The California lawsuit alleges violations of California’s anti-spyware law, the Consumer Legal Remedies Act, and the California Unfair Competition law. In other news from Krebs, there is now real malware exploiting Sony’s DRM to hide itself. Krebs seems to be breaking the key news on this story–there are a number of other related articles on his blog worth reading, such as the one on Sony’s past history of cavalier and inconsistent actions on DRM. The EFF has an analysis of the EULA for Sony’s software–it’s something no reasonable person should agree to. Back at Mark Russinovich’s blog that exposed this issue and began the controversy, he rebuts a response from First 4 Internet, the implementers of the Sony DRM, and points out more evidence that their software is poorly written and can crash Windows.

Ed Brayton comments on the “Isaac Newton of Intelligent Design”’s crazy accusations of obsession against his critics. Dembski’s latest is to accuse mathematician Jeff Shallit of being removed as a witness in the Dover trial because “his obsessiveness against me and ID made him a liability to the ACLU.” Actually, Shallit did not testify because he was a rebuttal witness to Dembski, Dembski withdrew from the trial, and the defense did not use Dembski’s ideas in their case. Dembski then dug the hole deeper, stating that this couldn’t be the reason. Why not? Because he withdrew before Shallit’s deposition was taken. He went on to challenge the ACLU and Shallit to release a transcript of the deposition. Unfortunately for Dembski, it was the defense that took the deposition, to make sure they would be prepared in case Shallit would be used as a witness–and the deposition (at least in the preliminary, uncorrected transcript) is already a public record. Perhaps Dembski should work on responding to his critics, rather than accusing them of stalking him. ...

Clint Bolick and Alan Dershowitz have written two very different–yet only occasionally directly contradictory–rememberances of Chief Justice William Rehnquist. Bolick, in a piece distributed by the Goldwater Institute and published in the Arizona Republic, describes Rehnquist as a conservative, moderating influence on a liberal court, advocating state’s rights, school choice, and presiding over a court that has been “usually (though less frequently lately) siding with individual liberty over state power.” Dershowitz, on the other hand, in a piece published on the Huffington Post, describes Rehnquist as a bigot who enjoyed racist and anti-Semitic jokes, who defended the “separate but equal” doctrine in Plessy v. Ferguson as a law clerk for Justice Jackson, and who began his legal career as a Republican thug who obstructed African-American and Hispanic voters at Phoenix polling places. Bolick gives a more nuanced view that actually addresses more of Rehnquist’s work on the court (though less than I would have expected), while Dershowitz emphasizes evidence of Rehnquist’s personal character which mostly derives from before he was on the Supreme Court. I was surprised that Bolick didn’t mention some of the recent cases (such as Raich v. Ashcroft and Kelo v. New London) where Rehnquist voted for liberty (and was unfortunately in the minority). Yet I have no doubt that there is accuracy in both descriptions. Bolick has in the past seen people as defenders of liberty who have done much to destroy it, such as former Attorney General John Ashcroft. Dershowitz alternatively takes courageous stands in defense of liberty and crazy stands which oppose it. One area where I was less than impressed with Rehnquist was on religious liberty, specifically for nonbelievers. He (like the majority) went the wrong way on Elk Grove v. Newdow (the Pledge of Allegiance “under God” case) and (unlike the majority) the wrong way on the McCreary County v. ACLU case (Ten Commandments display in a Kentucky courtroom which included a written statement that the display was “in remembrance and honor of Jesus Christ, the Prince of Ethics”).

The Economist reports on research from Steven Most at Yale into a condition called “emotion-induced blindness” (apparently similar to and named analogously to motion-induced blindness). Most’s research shows that gory and erotic images trigger a condition which lasts for two-tenths to eight-tenths of a second during which the viewer fails to process what they see immediately afterwards. This is attributed to “an information-processing bottleneck in the brain when it is presented with important stimuli,” the categories in question being relevant to avoiding dangers and reproductive success, respectively. This phenomenon provides grounds for an argument that some content-based restrictions on visual material in certain locations (e.g., alongside highways) are justified on the basis of their potential to cause physical harm. (Or that liability should be incurred for resulting accidents by those who put such material in place.) ...