Blown To Bits

Archive for the ‘Security’ Category

The Internet Archive and the FBI

Friday, May 9th, 2008 by Harry Lewis
The cheapest dexamethasone price samples will then go to a laboratory where a lab get cheap triamterene online effects technician will measure the amount of protein in each one. get discount atenolol According to the Centers for Disease Control and Prevention (CDC), find cialis most heart attacks present as discomfort or pain in the toradol side effects pill center or left side of the chest. As a result, buy generic griseofulvin a person with paraplegia may not notice injuries to their erythromycin online stores legs, or they may experience painful burning or tingling sensations cheapest celexa in their lower body. According to the National Health Service gentamicin eye drops prescription (NHS) in the United Kingdom, alcohol misuse can potentially contribute order tizanidine from us to laryngitis. It can occur as a primary infection without buy methotrexate online australia any involvement of the lungs or during an active case lasix for sale of pulmonary (lung) TB if the infection spreads to organs within.

The Wayback Machine is a marvelous invention. Using the Internet Archive, a huge series of periodic snapshots of the Web, the Wayback Machine enables you with a single click and see what the web page you are now viewing looked like months or years ago. It’s fun. It’s useful. Even the FBI uses it.

For some reason the FBI got curious about someone else who was using the Internet Archive for something, and asked if it might please know what human being was associated with a particular “address.” Brewster Kahle, the father of the Internet Archive, protested, and the FBI withdrew its request.

It’s important to realize how much that brief account leaves out. The FBI did not go to court to get a search warrant issued. No conventional police work needed if national security is at stake. The FBI issued a “National Security Letter,” which it can do on its own. NSLs have the further interesting property that recipients cannot lawfully disclose having received them. Kind of like the double-secret-probation of Animal House memory. We know about Kahle’s only because he successfully argued that he was running a library, and when the PATRIOT Act was renewed, an exception for libraries was built in.

I’m delighted for Kahle, but somehow the whole sequence of events does not leave me feeling happy. The FBI issues 50,000 NSLs annually. We find out about very few so there are no statistics about who gets them and how many of them are requests for IP addresses of people using web sites. We don’t know what counts as a library; I’m glad the Internet Archive seems to, but only because the State of California classifies it as such.

“Orwellian” is one of those terms that have been cheapened by overuse. But it’s hard to think of a reason not to use it here. According to the Electronic Frontier Foundation’s coverage, these are the terms that were presented to Kahle: “The NSL included a gag order, prohibiting Kahle from discussing the letter and the legal issues it presented with the rest of the Archive’s Board of Directors or anyone else except his attorneys, who were also gagged. The gag also prevented the ACLU and EFF from discussing the NSL with members of Congress, even though an ACLU lawyer who represents the Archive recently testified at a congressional hearing about the FBI’s misuse of NSLs.”

He couldn’t talk even to his congressperson!

It’s a great victory, but it settles nothing, because the case never went to court. Nor has any other challenge to an NSL; in every one of the handful of cases in which an NSL was challenged, the FBI simply withdrew the NSL and the case evaporated.¬†

So the bottom line seems to be: 1984 is alive and well, as we report in Chapter 2 of Blown to Bits. There is no way to know how many ISPs, in situations as outrageous as Kahle’s but lacking the resources or the will to fight the FBI, simply comply with its demands and shut up. Whatever else the PATRIOT Act is, it’s a license for the FBI just to keep trying things, confident that it is almost certain to succeed even if it goes beyond the already vast powers Congress and the President have granted it.

One final, hopeful note. Where civil liberties are balanced against national security, significant numbers of people will usually go for the promise of security. But maybe people are getting fed up. Of the 77 comments on the Washington Post story linked to above, not a single one seems favorably disposed toward the FBI in this case. Of course, the FBI couldn’t really talk to the Post’s reporter ‚Ķ.

The Politics of Surveillance

Sunday, April 27th, 2008 by Harry Lewis

I used to think that conservatives would oppose ubiquitous government surveillance. I figured it was the left that would be watching to make sure I was not smoking in the wrong place or saying something bad about the wrong people. That image of the politics of surveillance is outdated.

Today it is the right that wants the government to have carte blanche to listen in on our conversations. The rationale, of course, is that the government will keep us safe from terrorists if only we let it know everything we are saying. We should like being watched, to paraphrase Blown to Bits, because it means we are being watched over.

The Protect America Act, a six-month extension of the Foreign Intelligence Surveillance Act or FISA, expired recently. Here is one of the recent conservative rants on this subject, by Cliff May: “The law that gave America’s intelligence agencies the authority to freely monitor the communications of foreign terrorists abroad expired in February. A bill to restore that authority passed the Senate by a solidly bipartisan 68-to-29 majority. A bipartisan majority in the House would almost certainly vote in favor of the same measure but Speaker Nancy Pelosi (D-Calif.) —for more than two months—has used the power of her office to stop members from voting.” Another of the same ilk, by Robert Novak, describes the law as making it possible for the government to “continue eavesdropping on suspected foreign terrorists.”What such capsule summaries fail to mention is that the laws make it possible to eavesdrop on foreign terrorists by legalizing eavesdropping on anyone at all, including Americans, talking about anything at all, as long as the bits cross the US border. As EPIC’s summary explains, “[The Protect America Act] permits the warrantless surveillance of Americans when the surveillance is ‘directed at’ someone believed to be outside the United States—whether that person outside the United States is an American or not.” That means your emails and VoIP conversations with your family traveling abroad. And don’t think they don’t have enough agents to be listening in on you talking to your spouse—automated voice recognition is good enough now to recognize when you are mentioning bombs or Islam, however humorously.The price of liberty is eternal vigilance, but it does not require ceding to the government the authority to listen to Americans talking to Americans when they have done nothing to arouse suspicion. The conservatives should be ashamed of themselves for advocating that we surrender our Fourth Amendment rights by implying that these proposals don’t apply to us. They do.The limits of government surveillance should figure into the presidential campaign. Would the Dems take a stand on privacy and liberty? I’ll bet they wouldn’t, and that if any debate moderator were to pose the question, they too would tell us, in so many words, that the only way to keep us safe from terrorist attacks is to empower Big Brother to the max.

Twitter to Freedom

Friday, April 25th, 2008 by Ken Ledeen

Sometimes its not what you say, but to whom and how you say it. And in the post-digital-explosion world the possibilities are utterly transformed.

Consider what happened with James Karl Buck.

On April 10th he was arrested in Egypt while covering an anti-government protest.¬† As he was being led off to¬† an uncertain future he sent a single word message to the Twitter.com blogging site.¬† In case you’ve¬†never looked at it, in their own words “Twitter is a service for friends, family, and co‚Äìworkers to communicate and stay connected through the exchange of quick, frequent answers to one simple question:¬†¬† What are you doing?”
When I first encountered Twitter I had two conflicting reactions.¬† The first was “you’ve got to be kidding, will anybody actually do this?”¬† The second was “why not?”¬† After all, I had witnessed inumerable¬†cell phone conversations that had no more content than the central twitter question “what are you doing.”
  
But I digress.
  
Jim Buck sent his single word message “ARRESTED” to his friends¬†via Twitter, and it was enough to make all the¬†difference.¬†¬†You can read the whole story on the web here.
 
From the Blown To Bits perspective this is a classic example of the fundamental transformation that the digital explosion¬†has wrought.¬† Information moves everywhere.¬† The degree of connectivity, the ability to convey information¬†broadly, is staggeringly different from what was available in the pre-explosion era.¬† Twitter didn’t get Jim¬†out of jail, the collective efforts of his friends did.¬† But in the absence of the web, his fate could well have¬†been quite different.¬†
 
Had the designers of the Internet not created a system that¬†could be adapted for use in ways that were not imagined by those very creators, had they not produced, in Jonathan Zittrain’s lexicon, a “generative¬†technology” James Buck might well be in an Egpytian jail today.
       

Phishing by Phone

Sunday, April 20th, 2008 by Hal Abelson

 

 

As everyone keeps telling us over and over, we should never send sensitive information to an email address, or enter it into a web page, unless we’re confident we know where it’s going. Tricking people with bogus network addresses is called phishing. It’s an online fraud that goes back to the pre-Web days of America On Line, but its prevalence has skyrocketed over past decade because it’s so easy to accomplish with today’s web browsers. A text link you see on a web page might read ‚Äúwww.bankofamerica.com,‚Äù but if you were to examine the program code, you’d see that it’s not Bank of America’s web site you visit when you click on the link, but some other site, perhaps located in Eastern Europe, which looks just like the Bank of America site. Enter your account number and password, and they are dutifully stashed away as loot for identity thieves.

It’s a well-known trick, and even people who should know better get fooled all the time. For the past several several months, a large fraction of the MIT community has been receiving email messages from ‚Äúthe MIT network administrators‚Äù telling them that their MIT email accounts are about to expire and they need to re-register by emailing their password to an address shown in the message. You’d think MIT people wouldn’t fall for this, but it happens. The real MIT network administrators watch for email outgoing to the bogus address and contact the hapless victims, a group that’s included a few faculty members in the past month.

More...

When everything is bits, frauds easily cross from one domain to another. In a variant of phishing known as vishing (‚Äúvoice phishing‚Äù) the perpetrator uses bogus caller ID information to trick victims into thinking they are being called by a bank, mimics the bank’s automated answering system, and asks for credit card information to be entered by touch tone. Spoofing the caller ID information ‚Äì making a fake phone number appear on recipient’s caller ID display ‚Äì is simple thanks to Voice over IP and the open Internet architecture that lets anyone create phone applications. There’s phone software widely available that includes spoofing as a ‚Äúfeature,‚Äù and even services like www.spoofcard.com that will sell you an account from which you can make spoofed phone calls: merely type in the called ID number you’d like your recipient to see, and call.

Just today, I encountered a variant of this trick I hadn’t seen before ‚Äì a cross-domain phishing hoax (phvishing ?) that almost fooled me. It came in the guise of an official looking email from Bank of America informing me that I needed to call them ‚Äúregarding recent activity on your account.‚Äù The email included the usual strong warnings against replying by sending account information by email. No bogus phishing links on this web page: all the links really did go to the BofA web site. But phoning the 800 number reached an official sounding automated answering system that asked me to punch in my account number, expiration date, and credit card validation code. It then told me that my card information had ‚Äúalready been registered‚Äù and everything was OK. Luckily, the email spoof was poorly done, and a close look at the return address showed that the mail was bogus, so I knew enough not to enter my real credit card data. It turns out that this hoax has been around since at least 2006; I just hadn’t encountered it before.

I doubt that I would have been fooled for an instant had this been a pure email hoax or a pure phone hoax, but the combination of the two was something I hadn’t expected. We all know to be cautious about internet messaging, but fewer of us feel are as suspicious about phone numbers, especially when we’re the ones doing the calling, as with the phony Bank of America number. The root of this difference in attitude is that the Internet (as described in Blown to Bits) has grown up as an open architecture, while the phone system has not. As the communication systems converge, they produce hybrids to which our instincts and attitudes are not attuned. Where this will end up, we don’t know. But of this we can be certain: digital convergence will continue, and so will human fraud.