Blown To Bits

Archive for the ‘Surveillance’ Category

Clean Up Your Facebook Page

Sunday, September 21st, 2008 by Harry Lewis
However, real cialis without prescription this article should not be used as a substitute for viagra canada the knowledge and expertise of a licensed healthcare professional. Doctors order erythromycin from canada appear to have had fairly good knowledge about bone structure cheap price atarax and some awareness of how the brain and liver worked. cheap dexamethasone Medications, such as enzyme preparations or dissolving agents, may help find cheap cialis break down specific components of the bezoar. Both of the cost robaxin above studies found that young males who received a second augmentin online dose of the vaccine had the highest risk of heart mirapex sale inflammation. Naps may have neutral or even positive effects on cialis from india a person's risk of developing Alzheimer's disease, but it depends on.

It should not surprise anyone, but a survey of 3100 employers confirms that 22% of them check social network sites for information about candidates. That’s twice as many as checked Facebook and MySpace two years ago.

Sometimes what the employer discovers hurts your candidacy, especially if you or any of your buddies posts information about your drinking or using drugs. Of course, it’s also unwise to post information about your qualifications that is inconsistent with what you submitted when you applied for the job.

Sometimes the information can actually help, for example if it demonstrates your good communication skills.

Ready for another non-surprise? College admissions offices do it too.

Dragnet Surveillance

Friday, September 19th, 2008 by Harry Lewis

That’s the term the Electronic Frontier Foundation is using to describe the data collection methods it yesterday sued the federal government to stop. Dragnet fishing involves scooping up everything, and throwing back everything except the particular fish you were looking to catch; dragnet surveillance is collecting data on everyone, and then sifting through it to identify the bad guys. Here, from the lawsuit against the National Security Agency, the President, and various other parties, is a summary description of what it alleges the government is doing.

8. The core component of the Program is Defendants’ nationwide network of sophisticated communications surveillance devices, attached to the key facilities of telecommunications companies such as AT&T that carry Americans’ Internet and telephone communications.

9. Using this shadow network of surveillance devices, Defendants have acquired and continue to acquire the content of a significant portion of the phone calls, emails, instant messages, text messages, web communications and other communications, both international and domestic, of practically every American who uses the phone system or the Internet, including Plaintiffs and class members, in an unprecedented suspicionless general search through the nation’s communications networks.

10. In addition to using surveillance devices to acquire the domestic and international communications content of millions of ordinary Americans, Defendants have unlawfully solicited and obtained from telecommunications companies such as AT&T the complete and ongoing disclosure of the private telephone and Internet transactional records of those companies’ millions of customers (including communications records pertaining to Plaintiffs and class members), communications records indicating who the customers communicated with, when and for how long, among other sensitive information.

The “Program” is what President Bush called the “Terrorist Surveillance Program,” instituted shortly after the 9/11 attacks and only revealed in 2005. The plaintiffs are various ordinary citizens who object to the NSA reading their ¬†mail and listening to their phone calls without a warrant or probable cause, as provided in the Fourth Amendment. There is, I expect, no reason any of them should be under suspicion of plans to terrorize anyone.

I had an argument over dinner last night with a staunch Republican who was convinced that one of the reasons to vote for McCain was that McCain would appoint strict constructionists to the Supreme Court. I asked him if he thought a strict interpretation of the Fourth Amendment would allow this sort of surveillance of citizens, or the warrantless search and seizure of laptops at the border about which I wrote earlier. His non-response was that this sort of thing had been going on for years, even under Clinton. I am amazed that conservative originalists so readily forget that the Constitution was premised on the realization, based on hard experience, that governments can’t be trusted. The restraints on government power are as much a part of the Constitution as their favored interpretation of the Tenth Amendment.

Little-Brotherism Goes Mainstream

Wednesday, September 10th, 2008 by Harry Lewis

The New York City police department has established a Real Time Crime Center, to which citizens are encouraged to send cell phone photos of crimes. You can also text “CRIMES” with your tips. Mayor Bloomberg spoke enthusiastically about the new unit, but urged common sense. “If some big hulking guy is coming at you with a hatchet,” he said, “I would suggest you don‚Äôt take out your camera and try to take a picture.”

Doubtless this will help solve some crimes, as it perhaps did in the case of Jeffrey Berman reported in Blown to Bits. Will it have any unforeseen consequences? How will we feel about vigilante citizen jaywalking enforcers who snap pictures of us crossing the street at the wrong place and build up digital police files of our persistent lawlessness?

A Surprising Technique for Mobile Phone Surveillance

Tuesday, September 9th, 2008 by Harry Lewis

Chris Soghioian reports on a little-known industry that does something you might have thought illegal: provide to governments detailed data, including graphical presentations, of who is calling whom. The companies data-mine phone records to infer clusters. The story shows an example, taken from a corporate presentation, of a Google Earth map of Indonesia mashed up with phone data on 50 million people, crunched to reveal small groups of dissidents with a habit of calling each other.

But it couldn’t happen here, I hear you cry. If the government wanted this work done for them, where would they get the data? The cell phone companies, such as Verizon and Sprint, can’t legally turn it over without a court order, right?

Well, sort of right. But it turns out that wiretap laws don’t protect the data when it’s in the hands of other companies that the cell phone companies use for services related to your phone calls. For example, the cellular carrier doesn’t actually own any cell phone towers; it relies on companies such as Tower, Inc. for those. Tower, Inc. passes the phone calls on to the cellular carrier for processing, but isn’t covered by the same restrictive laws about use of that data. According to the article, suppose the National Security Agency wanted to conduct surveillance of the phone habits of U.S. citizens within the U.S.

Thus, while it may be impossible for the NSA to legally obtain large-scale, real-time customer location information from Verizon, the spooks at¬†Fort Meade¬†can simply go to the company that owns and operates the wireless towers that Verizon uses for its network and get accurate information on anyone using those towers–or go to other entities connecting the wireless network to the landline network. The wiretapping laws, at least in this situation, simply don’t apply.

And with the gag orders attached to data requests in the Patriot Act era, no one would probably be the wiser if this were happening right now.

Search Histories, Caylee Anderson, and Bill Gates

Saturday, September 6th, 2008 by Harry Lewis

Caylee Anderson is the Florida toddler whose mother Casey failed to report her missing for a month and who has been jailed for child endangerment (she’s out on bail). No one yet knows what happened to the little girl, but CNN reports this tidbit today:

Authorities said they have found traces of chloroform in the car Anderson drove and Internet searches of chloroform Web sites on her computer.

Searching computers is as much a part of criminal forensics now as searching a crime scene or the home of a suspect. And because, as we say, bits don’t go away, it can be even harder to eradicate digital fingerprints than it is to eradicate real ones.

Most likely the authorities were just checking the web browser history on Casey’s computer. If you don’t know what I’m referring to, look for a “History” menu on your browser; it’ll show ¬†where you’ve been to on the Web. The default setting on Safari, a browser I use on my Mac, is to save the history for a week, but I can make it longer. It’s a convenience; every now and then I want to go back to something I was looking at a few days ago, and by using the history I can find it quickly. When I search using Google, the history records not just that I was using Google, but what I was searching for. Bingo, if you’re a gumshoe and can get access to my machine. (There is an entirely separate issue of whether Google is keeping its own record of my searches and would turn it over to law enforcement. We talk about that in Blown to Bits also.)

Suppose Casey wanted to cover her tracks — what should she have done? Well, Safari has a “Clear History” command; that would be a good place to start. There’s also a “Reset Safari” menu item (try it — it will let you choose what to reset and give you the option of canceling or following through). Firefox calls this “Clear Private Data.”

But most people are PC and Internet Explorer users. I assumed Casey is too, and checked what Microsoft says about clearing the history of Explorer searches.

Have you seen those Mac ads where a geeky Bill Gates figure fumbles about the complexities of Vista, side by side with a cooler, more normal Mac user? (As a personal caricature, it’s actually unfair to Bill; when he was the age of the actor, he was wiry and energetic, like a coiled spring, not the doughy goofball the ad depicts. Of course, the ad doesn’t claim that’s supposed to be Bill. And in any case ads aren’t required to be fair about things like that.)

Here’s what Microsoft has to say about How to Clear the History Entries in Internet Explorer for version 6:

1. Close all running instances of Internet Explorer and all browser windows.
2. In Control Panel, click Internet Options.
3. Click the General tab, and then click Clear History.
4. Click Yes, and then click OK to close the Internet Options dialog box.

If the cached addresses are still listed in the Address box in Internet Explorer, use the following steps:

1. Quit Internet Explorer.
2. Delete all of the values except for the (Default) value from the following registry key:

HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TypedURLs

NOTE: Values in this registry key are listed as Url1, Url2, Url3, and so on. If you delete only some values and the remaining values are not in consecutive numerical order, only some of the remaining entries are listed in the Address box. To prevent this behavior from occurring, rename the remaining values so that they are in consecutive numerical order.

Even if Casey had tried to cover her tracks, she probably couldn’t have managed, if she was using the version of Explorer that is most widely in use. No wonder Microsoft is mounting its own funky advertising campaign, starring Jerry Seinfeld and the real Bill Gates, to humanize its products.

And no wonder Google sees an opportunity with its new Chrome browser, as we discussed recently. And indeed, no wonder, as David Pogue noted, Chrome has

something called Incognito mode, in which no cookies, passwords or cache files are saved, and the browser’s History list records no trace of your activity. (See also: Safari, Internet Explorer 8 [which is now available in Beta].) Google cheerfully suggests that you can use Incognito mode “to plan surprises like gifts or birthdays,” but they’re not fooling anyone; the bloggers call it “porn mode.”

That’s a useful feature for anyone planning a crime, too!

P.S. There is yet another issue. Even if the history isn’t visible through the menu commands, traces of it may well still be stored on disk in a way that a brute force search of disk blocks, one by one, would reveal. “Deleted” doesn’t actually mean that the bits have been destroyed utterly. In both the offense and defense of computer forensics, you can almost always do a better job if you spend more time and money, so how confidently one can say that bits are “gone forever” depends on the cash value you attach to destroying them or discovering them.

ISPs Back Away From Packet Inspection

Monday, September 1st, 2008 by Harry Lewis

We’ve blogged before about the advantages to advertisers to know your search habits, and more generally, what sort of thing interests you, as those preferences are revealed by your Internet usage. NebuAd is a pioneer in “deep packet inspection,” opening the “envelopes” of data being sent to you to report back to the ISP what’s in them. The privacy issues surrounding this practice have come up for congressional scrutiny; see previous blog posts here and here.

The AP reports good news today: the pressure is working. ISP’s are deciding not to renew their arrangements with NebuAd in such numbers that the company’s financial status is touchy. Boston Globe story here: Privacy concerns may derail web tracking venture.

Once again, if there were competition and full disclosure, the federal government would not have to get involved. But neither operates robustly enough to restrain the industry, and the technology for this kind of unexpected snooping on our behavior is getting better and better. So laws are going to be needed, in spite of this apparent short-term victory.

Tracking Terrorists, The Right and Wrong Ways

Sunday, August 31st, 2008 by Harry Lewis

Terrorists use the Internet just like the rest of us. Probably moreso. They email each other. They post stuff on web sites. They have discussions about what they are planning. All the big things we know about the Internet — that it can spread information quickly and cheaply, that it is an effective tool for cooperative action by widely dispersed participants — are value-neutral. The Internet’s capabilities can be exploited for either good or evil.

The U.S. government understands this, and watches what happens on the Internet as part of its war on terror. Two recent news items show different ways this can be done.

The online edition of the German magazine Spiegel has a fascinating profile of SITE and IntelCenter, two companies run by young Americans. Essentially all they do is to sit in front of computer screens at their offices and watch what the terrorists are saying and doing. Sometimes they have to create fraudulent identities and obtain passwords to do so. They often need translators. But in essence, these companies are just bit processors. Though they don’t disclose all their tricks in the article, it seems that their staff just shows up at their offices in the morning (at undisclosed locations), pull bits in and push a few out, all day long. They use no shoe leather or even cell phones. They pass along what they have learned to parties who pay them for the information.

They are an important source of information to the CIA, FBI, and other American security and defense agencies. Their discoveries are used by news agencies as well. The Federal government has developed some similar capabilities internally, but got into the business later and is still catching up.

A success story for private enterprise and the small-business entrepreneurship, and for sensible cooperation between the federal government and the private sector.

Another part of the federal government’s anti-terror intelligence operations is the use of so-called National Security Letters (NSLs). These orders require (among other things) Internet Service Providers to turn over electronic communications, usually without disclosing that they have done so to the communicating parties or to anyone else. NSLs are provided for in the PATRIOT Act, and have long been resented by civil libertarians. Hundreds of thousands of NSLs have been issued, almost all accompanied by gag orders.

A small ISP (which one is itself being kept secret) took the government to court on First Amendment grounds. The ISP claimed that the requirement that it keep quiet even about the fact that it had received a NSL was an infringement of its constitutional right to free speech, as the gag order made it impossible to protest the government’s action. A lower federal court agreed with its claim that this provision of the PATRIOT Act was unconstitutional. The matter is now before a federal appeals court, as Reuters reports. It appears that the court is skeptical of the government’s arguments, to judge from this passage from the Reuters story:

The government argues [gag orders] are in place for national security concerns, such as keeping terrorists from learning what they are investigating.

“You can’t tell me that any terrorist is going to make anything out of the fact you issued NSLs to AT&T and Verizon,” said Circuit Judge Sonia Sotomayor, using a hypothetical example.

The technology is neither good nor bad. It’s all about what you do with it, and we should all be thinking about the choices the government makes.

The PATRIOT Act Drives Internet Traffic Offshore

Saturday, August 30th, 2008 by Harry Lewis

We explain in Blown to Bits that bits crossing entering the U.S. are, under U.S. law, subject to inspection by federal authorities. No matter whether they are in a laptop (see earlier post about new border procedures) or in a fiber optic cable. So the U.S. government claims the right to read the email your daughter sends you while she is in Toronto and you are in Detroit.

According to John Markoff of the New York Times, this law is one of the reasons that Internet traffic is increasingly bypassing the U.S. entirely. Since this is where the Internet started, the U.S. network used to be a kind of hub for the rest of the world; no longer.

It’s not the only reason — there are more Chinese Internet users than American now, so of course it makes sense for other countries to build up their communications infrastructure for purely economic reasons. But this may be an early example of the U.S. driving business away by its incursions into what we used to think of as private information.

I expect that sooner or later some business executive from a friendly foreign country will have his laptop seized and searched at the U.S. border, along with documents of great sensitive value to the business and of no significance to the war on terror. The incident will cause a stink that will lead international executives to suggest that their American counterparts come visit them abroad next time, rather than expecting foreigners to subject themselves to data disclosure by visiting U.S. soil.

Border Searches and Email Privacy

Wednesday, August 27th, 2008 by Harry Lewis

Mark Rasch is a security expert and lawyer practicing in Washington, DC. He has written two good pieces about important issues on blogged here: The government’s new policy about searching and seizing laptops at the border (which I blogged here), and the case of Mr. Steven Warshak, where the feds have successfully asserted their right to snoop email without a warrant (which I blogged here).

The Web Site Finds You

Friday, August 22nd, 2008 by Harry Lewis

Google has launched its “New Gears Geolocation API.” This is a set of developer tools making it easy to build applications that utilize location information reported by your cell phone to bring up content that depends on where you are — without your having to key in your location manually. Here’s an example Google cites of how useful this can be:

One of the most popular travel sites in the Europe, lastminute.com, has now location-enabled their new mobile restaurant finder to help you find restaurants near you without requiring you to type in where you are. If you’re in the UK, just go to fonefood at¬†m.lastminute.com, click the “Find your location” link on the home page, select the type of restaurant you want, and lastminute.com will automatically work out which neighbourhood and city you are in and find matching restaurants.

We discussed something similar in our Providence Journal opinion piece of a week ago — a facility that would steer you to stores near you that had in stock a product you wanted to buy. It’s coming!