Header graphic for print

Steptoe Cyberblog

Using Attribution to Deter Cyberespionage

By Stewart Baker on Posted in China, Cybersecurity and Cyberwar, International, Security Programs & Policies

Foreign Policy has published my article on how attribution can be used to deter foreign governments’cyberespionage. Excerpts below:

The Obama-Xi summit in Sunnylands ended without any Chinese concessions on cyber-espionage. This came as no surprise; cyber spying has been an indispensable accelerant for China’s military and economic rise. And though Beijing may someday agree that international law governs cyberspace, that won’t help the victims of espionage, which is not regulated by international law. So if negotiation won’t work, what will? Not a strategy that relies entirely on defense. That’s like trying to end street crime by requiring pedestrians to wear body armor.

The good news is that there has been a revolution in our ability to identify cyberspies. It turns out that the same human flaws that make it nearly impossible to completely secure our networks are at work in our attackers too. And, in the end, those flaws will compromise the anonymity of cyberspies…

But attribution is only half the battle if we want to deter cyber-espionage. The other half is retribution. Once we identify the attackers, we need to persuade them to choose another line of work. If we’re serious about stopping cyberespionage, there are plenty of tools at our disposal …

The government already uses classified information to label terrorist supporters and drug kingpins as “specially designated nationals” and to impose sanctions on them — seizing their bank accounts and assets, for example, and prohibiting U.S. citizens from doing business with them. The United States even has such programs for sanctioning Belarusian kleptocrats and conflict diamond purveyors. Maybe it makes sense for Washington to use sanctions to punish misdeeds in Belarus or West Africa, but shouldn’t it first use these measures to punish people who are invading homes and offices in, you know, the United States?

It’s unclear why the president hasn’t done this already — he’s already got all the authority he needs to impose sanctions on cyber spies and their enablers. Under the International Emergency Economic Powers Act, the president could determine that cyber spying poses “an unusual and extraordinary threat” to the United States and declare it a “national emergency.” He could then publish a list of hackers who would be subject to sanctions. In keeping with past practice, he could rely heavily on classified data to make the designations — without disclosing any of it….

But punishing individual hackers is only part of the story. What if the United States applied all of these measures not just to the hackers themselves but to companies that benefit from the data they filch from U.S. networks? There’s no difference in criminal responsibility between a thief and the customer he’s stealing for. But there could be all the difference in the world between hackers who do their work from the safe environs of a protective government and the hackers’ customers, who can’t be truly successful in today’s world if they aren’t part of the global marketplace. And going global means exposing their companies, executives, and assets to the legal systems of the United States, Europe, and a host of other countries that are furious at the wholesale espionage aimed at their companies. If a few big companies in China find that having a cozy relationship with hackers means criminal prosecutions and asset seizures, they’re a lot more likely to say “Thanks, but no thanks” to offers of stolen data.

Of course, to bring those cases, the government will have to have those companies dead to rights, and so far it doesn’t. U.S. security researchers have done a great job of tracking the thieves back home. But they’ve had trouble identifying the companies who ultimately benefit from cyberspying.

That too is an attribution problem — the next one we have to solve if we want to really discourage commercial cyber-espionage. It will be difficult, but no harder than the first attribution problem looked five years ago. Given the stakes, improving cyber-attribution should be at the top of U.S. intelligence priorities. And now that private researchers have demonstrated how much attribution can be accomplished without all the resources and authorities of the CIA and NSA, those agencies should be embarrassed by their poor record to date. And they may not have much time before someone — Iran, North Korea, Hezbollah — causes a power outage or other control system failure in the United States. If they can’t tell the president who did that, the heads of those agencies will be looking for new jobs. As part of the attribution effort the United States needs for defense, it shouldn’t be that hard to identify the customers who benefit from cyber-espionage….

In recent months, the Hill has been buzzing with new ideas for identifying and punishing cyberspies and the companies that benefit from them.

At a recent hearing before the Senate Judiciary Committee’s Subcommittee on Crime and Terrorism, I testified about some of these ideas. Senators Sheldon Whitehouse (D-RI) and Lindsey Graham (R-SC) expressed particular interest in measures to impose sanctions on countries that support hackers as well as potential visa restrictions.

Another example is the Deter Cyber Theft Act (S. 884), which has been sponsored by a bipartisan group of senators, that includes Senators Carl Levin (D-MI), John McCain (R-AZ), Tom Coburn (R-OK), and Jay Rockefeller (D-WV). This bill would require intelligence agencies to annually report to Congress on countries and entities that engage in cyber-espionage as well as to identify intellectual property that has been stolen as a result of hacking. It further permits the president to prevent the importation into the United States of products that are linked to foreign cyber-espionage activities, such as articles that have been manufactured using stolen IP or that have been produced by companies that have benefited from it. In short, the bill would nudge the government towards broader attribution, greater naming and shaming, and some efforts to deny companies the fruits of using stolen information.

If these measures result in the punishment of Chinese companies, there is no doubt but that China will seek to reciprocate. But once again, asymmetry is likely to complicate their task. U.S. intelligence agencies do not steal commercial secrets for U.S. companies so it will be hard for China to mirror these measures without faking the evidence. In short, a focus on the beneficiaries of commercial espionage could cause real pain for cyber spies and their customers.

Cloudy With a Chance of Exploitation

By Jason M. Weinstein on Posted in Cloud Computing, Privacy Regulation

With all the controversy surrounding the leaks regarding the PRISM program, there is at least one constituency that is likely rejoicing — Europe-based cloud computing companies.

For the past few years, cloud providers in Europe have tried to gain a competitive advantage over US-based providers in the European market by arguing that the Patriot Act gives the US government essentially unfettered access to content stored with US-based companies. The term “Patriot Act” has become a weapon wielded by overseas providers to instill fear in potential customers and to deter them from using American cloud companies. Never mind that what those overseas providers have been saying about the Patriot Act is, in many respects, not true. And never mind that national security officials in many European countries have the same or greater access to content stored with Europe-based providers than the US government does with US-based providers, often with no judicial oversight.

US-based providers, along with officials from, among others, the Departments of Justice, State, and Commerce, have struggled to get the message across to European governments and citizens that the rhetoric about the Patriot Act did not match the reality. After the revelations of the past week, that struggle just got even harder.

Reasonable people can certainly disagree about whether the benefits of the PRISM program outweigh the risks to privacy, or whether the level of congressional or judicial oversight is adequate. But the reality is that in many European countries – including, among others, the UK, Germany, and France – the government has very similar – and in some cases significantly broader – authority in national security investigations to obtain content from providers based in, or subject to the jurisdiction of, those countries, without any court approval.

Moreover, unlike in the US, in many European countries – such as Denmark, Ireland, France, and the UK, just to name a few – providers can voluntarily provide content and customer data to the government, whereas in the US, legal process is required. Those who are criticizing the providers who were subject to the PRISM program should keep in mind that those providers were not voluntarily giving the government the data – rather, they were subject to legally authorized directives from the government to do so. Without such directives, they would have been legally prohibited from providing that data. The same can’t be said for providers in many European countries.

Privacy advocates often hail the EU as a model of privacy and data protection because of its laws governing data collection and processing by businesses. (Whether the EU’s consumer data privacy model is actually any more protective of privacy than the US sectoral model is a debate for another time.) But those same privacy advocates fail to recognize, or acknowledge, that when it comes to government access to data for national security purposes, EU member states are no more protective of privacy than the US government – and in many cases, much less so – and that’s as true today as it was a week ago.

Moreover, contrary to popular belief, it’s far from clear that the US government can get data stored abroad directly from a cloud provider’s US parent. Section 215 of the Patriot Act and regular criminal subpoenas apply only to business records, and not to customer information (such as the content of a cloud customer). And search warrants have no validity as to information stored abroad. So the only way the US government could obtain such data would be to seek assistance from the local country’s law enforcement agency pursuant to a Mutual Legal Assistance Treaty (if one exists), and that local agency would have to comply with local law. Data stored with an American-owned company in that country would thus be afforded the same protection as data stored with a European-owned company.

Europe-based providers may try to exploit the current PRISM controversy, but businesses seeking cloud services would be wise to consider that, notwithstanding the rhetoric about the Patriot Act and US law generally, storing their content with Europe-based cloud providers would not afford their data any greater privacy protections than if they stored their data with an American-owned cloud provider. And in many instances, using a Europe-based provider would give them less protection, subjecting their data to a legal regime in the host country that may make the Patriot Act and FISA Amendments Act look like privacy statutes.

“I’m shocked—shocked—to find that surveillance is going on in here.”

By Michael Vatis on Posted in Privacy Regulation

It seems we can’t go a day without another bombshell in what we can now call the “Snowden Affair.” Many people are calling Edward Snowden a “whistleblower” for leaking two classified intelligence programs. But that term is usually reserved for someone who reveals government lies, law-breaking, or malfeasance. What Snowden revealed, though, are government activities that, based on what’s been reported, appear to be lawful, at least in the sense of being consistent with laws enacted by our elected representatives. One can legitimately argue about whether the two programs are effective, whether the benefits to security are worth the cost to privacy, and whether there is sufficient congressional and judicial oversight of such programs. One can also argue about whether such programs violate the Fourth Amendment. But there does not seem to be any reasonable doubt that the programs are consistent with the United States Code. Nor, really, should these revelations surprise anyone. So the member of Congress, reporter, or civil libertarian who professes shock that these programs exist hasn’t been paying close attention to developments in national security law the last eight years. Or, like Captain Renault in Casablanca, he’s just turned a blind eye to them.

Last week I discussed Snowden’s first leak, which involved the Hoovering of massive amounts of telephone “metadata” from US telecoms, including metadata about local calls in the United States. This program is being performed pursuant to Section 215 of the USA Patriot Act, which allows the Foreign Intelligence Surveillance Court (FISC) to issue “an order requiring the production of any tangible things…for an investigation to obtain foreign intelligence information not concerning a United States person or to protect against international terrorism or clandestine intelligence activities.” To obtain such an order, the government must show only “that there are reasonable grounds to believe that the tangible things sought are relevant to an authorized investigation.”

Today, I’ll focus on the second leak, involving a Top Secret government program known as “Prism.” According to press reports, the NSA and FBI are tapping into the databases of Microsoft, Google, Yahoo!, Facebook, PalTalk, YouTube, Skype, AOL, and Apple. The agencies are obtaining, inter alia, the content of e-mails, chats, videos, video conference calls, VoIP communications, photos, file transfers, and responses to “special requests.” Unlike the telephone metadata program, which involves only access to stored data, Prism appears to allow the government to wiretap communications during transmission.

Prism is based not on Section 215 of the Patriot Act, but on Section 702 of the FISA Amendments Act of 2008 (codified at 50 U.S.C. § 1881a). This provision authorizes US intelligence agencies to “target” for acquisition the communications of non-US persons who are “reasonably believed to be located outside the United States”—even if the surveillance is effected in, and one or more parties to the communication are located within, the United States. Section 702 allows the Attorney General and the Director of National Intelligence, without a court order, to direct an electronic communication service provider to “immediately provide the Government with all information, facilities, or assurance necessary to accomplish the acquisition.”

However, prior to such surveillance, the government must gain approval from the Foreign Intelligence Surveillance Court of its “targeting” and “minimization” procedures. The targeting procedures are supposed to ensure that surveillance is “targeted” only at non-US persons outside the United States. The minimization procedures are meant to limit the acquisition and retention, and prohibit the dissemination, of information collected against “unconsenting United States persons consistent with the need of the United States to obtain, produce, and disseminate foreign intelligence information.”

What does this mean in plain English? That the NSA and FBI can collect the communications of non-US persons located outside the US even if those communications are with a US person inside the US. They can do so without a court order.  And they can retain and use any information collected about US persons as long as the government determines that such retention or use is needed for foreign intelligence purposes.

That last point has gone largely unnoticed by reporters and analysts. Much of the press seems to view the telephone metadata program as more worrisome because it appears to be collecting information about pretty much all calls that occur within, or cross through, the United States. But remember, that program does not collect the content of phone calls, or even the names of the persons on the call, but only information about what phone numbers are in communication with each other, the duration of the calls, and things like that. Prism, on the other hand, collects the content of a broad spectrum of Internet communications. Many people seem to regard Prism as a less serious privacy intrusion because the surveillance cannot be targeted at US persons (i.e., citizens and legal resident aliens). But the communications of US persons are being collected.

The government refers to the collection of US persons’ communications as “incidental,” since the US person may not be the “target.” This makes it sound like the collection is rare, inadvertent, and minor. But that’s not really accurate. One of the points of the collection is to determine whether foreign terrorists (or spies) are conspiring with someone in the United States, to do harm in America. Indeed, that is how the Administration has justified the program. Officials have cited, in particular, the use of Prism to disrupt a 2009 plot by an American, Najibullah Zazi, to bomb the New York subway system. They say the government learned about the plot because the NSA was monitoring the communications of an al-Qaeda bomb-maker, Rashid Rauf, and found he was in contact with Zazi, who was in Aurora, Colorado. Presumably the authorities then got a FISA warrant to eavesdrop on Zazi’s complete communications. Senator Dianne Feinstein (D-CA), Chair of the Senate Intelligence Committee, also said that Prism helped implicate American David Headley in the 2008 terrorist attacks in Mumbai.

In addition, a government official, in describing Prism, said that

“[i]f the N.S.A. comes across information about an American citizen during the search, it turns over that material to the F.B.I. for an assessment.”

That hardly sounds like “incidental” collection the way ordinary people would understand that term.

Once the government has reason to focus surveillance on—i.e., “target”—a particular US person, it would have to get a regular FISA surveillance order, or a criminal wiretap order. One would expect that the government’s targeting and minimization procedures address this.

Another issue concerns how Prism works. The leaked slides describing Prism say that NSA collects the information “directly from the servers” of the participating communication providers. Several providers deny that the government has direct access to their servers, and say that they respond only to targeted requests for information. But this seems to be a semantic quibble. According to another leaked document, Prism allows “collection managers [to send] content tasking instructions directly to equipment installed at company-controlled locations.” And this process is probably automated. So it sounds like the government attaches hardware to the companies’ networks; it sends “tasking” instructions to that hardware instructing it to collect the communications of certain targets; and the hardware then extracts the communications and sends them to NSA. So is the government collecting the information directly from the companies’ servers, or is it collecting from the hardware it attached to the servers? Does it matter?

After you cut through all the semantics, the only important questions are whether the program is effective, whether it is constitutional, and whether the benefit to security is worth the cost to privacy. As to its effectiveness, the government claims that Prism is a vital tool and has been instrumental in stopping terrorist attacks. We’ll probably hear about cases other than the Zazi and Headley matters in the coming days to demonstrate this. And according to the NSA slides, Prism data has been cited in the President’s Daily Intelligence Brief more than any other source, and its data has resulted in nearly one in seven intelligence reports. If this information is not just puffery, it suggests that Prism is pretty darn effective.

Is it legal? Well, all three branches of government seem to think so. The Executive Branch obviously does, as it is implementing the program, and President Obama has given a full-throated defense of it. The Legislative Branch does, too, since Prism appears completely consistent with Section 702 of the FISA Amendments Act. And at least part of the Judicial Branch does, since the FISC hasn’t chosen to reject the procedures under which Prism operates and thereby stop the program.

But can there be more meaningful judicial review? After all, the FISC has only a limited role, and is often accused (fairly or not) of being a rubber stamp for the intelligence agencies. Its opinions are also almost never made public.

Unfortunately, the likelihood of more meaningful review is quite small. Just this March, the US Supreme Court, in Clapper v. Amnesty International, turned aside a constitutional challenge to Section 702 on the ground that the plaintiffs—a group of civil liberties lawyers, human rights advocates, and others—lacked “standing” to bring suit. To establish standing, a plaintiff must show some concrete “injury in fact.” If the injury is only something that might take place in the future, then that threatened injury must be “certainly impending.”

The plaintiffs in Clapper claimed standing based on their fear that the US government would intercept their communications with non-US persons overseas without a warrant, and on the costs they had incurred to protect the confidentiality of their communications. But the Court found that these claimed injuries did not pass muster, since they “relie[d] on a highly attenuated chain of possibilities.” The Court said that even if plaintiffs could demonstrate that their foreign contacts were being monitored (which they hadn’t), they could not show that the US government was monitoring those persons under Section 702, as there are “numerous other methods of conducting surveillance,” or that spying on such persons would also lead to the interception of the plaintiffs’ communications. Thus, the plaintiffs’ argument was based on what the Court implied was “a paranoid fear.”

That fear doesn’t seem so paranoid in light of last weeks’ revelations. But the reality is that the Court’s decision makes it difficult for anyone to challenge the law. The only real chance is if someone is prosecuted based on information gathered pursuant to Section 702, and that person moves to suppress the evidence at trial. But that is fairly unlikely, since the government would almost certainly use at trial only wiretap evidence that it collected pursuant to a regular FISA or criminal wiretap order, or documentary or testimonial evidence. Moreover, a challenge would have to overcome the state secrets privilege, which has proven to be an all but insurmountable obstacle to challenges of government intelligence programs, including the Bush Administration’s warrantless wiretapping program.

Finally, there’s the question of whether the security benefits of the program are worth the cost to privacy. At bottom that’s a subjective question, and people will make their own judgments based largely on their personal notions of privacy. In a democracy, the societal judgment about such things is supposed to be made by our elected representatives. No President, whose first responsibility is to protect the security of the nation, is realistically going to decline to use a legal authority that has been granted to him. So that leaves Congress. And as I’ve said, Congress already enacted Section 702. If Congress now collectively determines that it didn’t realize what it was authorizing back in 2008, or thinks the intelligence community has gone too far, it can a) eliminate or cut back on the program, or b) exercise more rigorous oversight to make sure the program stays within bounds. Will it do either of these things? We’ll have to wait and see. But I wouldn’t hold my breath.

prism photo courtesy of thadz

The FISA Court Order Flap: Take a Deep Breath

By Stewart Baker on Posted in Privacy Regulation

There may be a lot less to the NSA “scandal” than meets the eye. In an article for Foreign Policy, I explain why I am quite confident that the program underlying the FISA court order is lawful:

[T]his is not some warrantless or extra-statutory surveillance program. The government had to persuade up to a dozen life-tenured members of the federal judiciary that the order is lawful. You may not like the legal interpretation that produced this order, but you can’t say it’s lawless.

In fact, it’s a near certainty that the underlying program has been carefully examined by all three branches of government and by both parties. As the Guardian story makes clear, Senator Ron Wyden has been agitating for years about what he called an interpretation of national security law that goes beyond anything the American people understood or would support. He could easily have been talking about orders like this. So it’s highly likely that the law behind this order was carefully vetted by both intelligence committees, Democrat-led in the Senate and Republican-led in the House. (Indeed, today the leaders of both committees gave interviews defending the order.) And in the executive branch, any legal interpretations adopted by the Bush administration would have been carefully scrubbed by President Obama’s Justice Department.

The two other questions about the program are why such a sweeping collection and how can something that broad be lawful. Here’s my guess about answers to the first question:

Imagine that the United States is intercepting al Qaeda communications in Yemen. Its leader there calls his weapons expert and says, “Our agent in the U.S. needs technical assistance constructing a weapon for an imminent operation. I’ve told him to use a throw-away cell phone to call you tomorrow at 11 a.m. on your throw-away phone. When you answer, he’ll give you the number of a second phone. You will buy a phone in the bazaar, and call him back on the second number at 2 p.m.”

Now, this is pretty good improvised tradecraft, and it would leave the government with no idea where or who the U.S.-based operative is or what phone numbers to monitor. It doesn’t have probable cause to investigate any particular American. But it surely does have probable cause to investigate any American who makes a call to Yemen at 11 a.m., Sanaa time, hangs up after a few seconds, and then gets a call from a different Yemeni number three hours later. Finding that person, however, isn’t easy, because the government can only identify the suspect by his calling patterns, not by his name.

So how does the NSA go about finding the one person in the United States whose calling pattern matches the terrorists’ plan? Well, it could ask every carrier to develop the capability to store all of their calls and to search them for patterns like this. But that would be very expensive, and its effectiveness is really only as good as the weakest, least cooperative carrier. And even then it wouldn’t work without massive, real-time information sharing — any reasonably intelligent U.S.-based terrorist would just buy his first throwaway phone from one carrier and his second phone from a different carrier.

The only way to make the system work, and the only way to identify and monitor the one American who is plotting with al Qaeda’s operatives in Yemen, is to pool all the carriers’ data on U.S. calls to and from Yemen and to search it all together — and for the costs to be borne by all of us, not by the carriers.

In short, the government has to do it.

And here’s my guess about how to answer the second question:

The technique that squares that circle is minimization. As long as the minimization rules require that all searches of the collected data must be justified by probable cause, Americans are protected from arbitrary searches. In the standard law enforcement model that we’re all familiar with, , privacy is protected because the government doesn’t get access to the information until it presents evidence to the court sufficient to identify the suspects. In the alternative model, the government gets possession of the data but but is prohibited by the court and the minimization rules from searching it until it has enough evidence to identify terror suspects based on their patterns of behavior.

That’s a real difference. Plenty of people will say that they don’t trust the government with such a large amount of data, that there’s too much risk that it will break the rules, even rules enforced by a two-party, three-branch system of checks and balances. Even I, when I first read the order, had a moment of chagrin and disbelief at its sweep.

But for those who don’t like the alternative model, the real question is “compared to what?” Those who want to push the government back into the standard law enforcement approach will have to explain how it will allow us to catch terrorists who use half-way decent tradecraft — or why sticking with the standard approach is so fundamentally important that we should do so even if it means more acts of terror at home.

Total Information Awareness, Redux

By Michael Vatis on Posted in Privacy Regulation

There have been many critics of the Obama Administration’s aggressive pursuit of leakers. But today’s news offers a new line of attack on the Administration’s tactics: they’re apparently not working. The UK paper The Guardian was the beneficiary of a huge new leak, this one about a secret court order to a Verizon subsidiary ordering the company to turn over to the National Security Agency (NSA) “all call detail records or “telephony metadata” created by Verizon for communications (i) between the United States and abroad; or (ii) wholly within the United States, including local telephone calls.” In other words, the NSA likely now has records pertaining to you, me and Grandma Marie. Officials suggest that other communications companies have received similar orders, as part of a program going back seven years. Banks, credit card companies, travel firms and many other businesses may have received similar directives. The order is actually not at all surprising to observers of intelligence matters. So far, the White House and some Members of Congress have staunchly defended the program. This stands in marked contrast to the scorn heaped a decade ago on Adm. John Poindexter and his proposed “Total Information Awareness” program, which would have done pretty much the same thing. So who’s calling the Admiral to apologize?

The order was issued under Section 215 of the USA Patriot Act (codified at 50 U.S.C. § 1861), which allows the Foreign Intelligence Surveillance Court (FISC) to issue “an order requiring the production of any tangible things (including books, records, papers, documents, and other items) for an investigation to obtain foreign intelligence information not concerning a United States person or to protect against international terrorism or clandestine intelligence activities.” To obtain such an order, the government must show only “that there are reasonable grounds to believe that the tangible things sought are relevant to an authorized investigation.”

Opponents of the USA Patriot Act originally dubbed Section 215 “the library provision,” because they feared it would be used to obtain records of the books people took out from the library. Silly them. That was always a laughable concern. The reading habits of terrorists and spies were never the government’s focus. Bank, credit card, travel, email and phone records were more like it. And because of Section 215’s broad scope, and the low bar for getting one (mere “relevance” to an investigation), it was clear all along that the government could use a 215 order to obtain records related to innocent people so it could sift through them to find intelligence; it was distinctly not limited to obtaining the records of suspected terrorist and spies.

The government tried to quell fears that Section 215 would be used in such a sweeping way by pointing out that it was really just an intelligence version of a criminal subpoena for business records. And, indeed, Section 215 was amended to make this limitation clear; it now stipulates that an order “may only require the production of a tangible thing if such thing can be obtained with a [grand jury] subpoena…or with any other order issued by a court of the United States directing the production of records or tangible things.” That’s never satisfied some critics, since a “tangible” thing can still mean pretty much anything other than the thoughts in your head. And, in the communications context, at least, the Electronic Communications Privacy Act (ECPA) allows the government to obtain electronic communications records of subscribers or customers pursuant to a subpoena or court order. Moreover, it allows the government to obtain the contents of some communications with a subpoena or court order, and of any communications with a search warrant (though the Administration has recently endorsed the view that the Fourth Amendment requires that a search warrant be obtained before the government can get a hold of all communications content). So, at least arguably, the government could get the same information it has gotten from Verizon using a subpoena or a so-called “2703(d)” court order under ECPA, though perhaps not as easily.

Notably, the Section 215 order does not require disclosure of the content of communications “or the name, address, or financial information of a subscriber or customer.” The metadata the government seeks includes “comprehensive communications routing information, including but not limited to session identifying information (e.g., originating and terminating telephone number, International Mobile Subscriber Identity (IMSI) number, International Mobile station Equipment Identity (IMEI) number, etc.), trunk identifier, telephone calling card numbers, and time and duration of call.” The limitation to metadata may reflect a concern about having the FISC reject an application for content on statutory or constitutional grounds. Or it may reflect the Administration’s own evolving view of the Fourth Amendment.

The White House is not denying the authenticity of the order published by The Guardian, but calling it a lawful and necessary part of its efforts to prevent terrorist acts. Some congressional Democrats and Republicans are defending it, too, and saying it is part of a routine reauthorization of a program they have long known about. Rep. Mike Rogers (R-MI), Chairman of the House Intelligence Committee, even said the program helped prevent a significant terrorist attack in the US in the last few years. So far, the most critical lawmaker has been Sen. Ron Wyden (D-OR), who confirmed that the order is part of the program that he and Sen. Mark Udall (D-CO) have been warning about, in a cryptic way, each time Section 215 has come up for renewal.

So what is the government doing with the information? It is likely trying to draw connections between known suspects and other unknown affiliates. It may also be looking for patterns (e.g., calls to Yemen or Pakistan, combined with calls to certain financial institutions known for laundering terrorists’ money, etc.) to try to identify new suspects for further investigation. If the government is combining the communications data with other databases—such as bank, travel, educational, or purchase records—then it really would amount to the same thing as Poindexter’s much-criticized Total Information Awareness program.

The big question is what the government is doing to “minimize” the innocent information about you, me and Grandma Marie that it does not need (or use). Section 215 requires that the government show the FISC the specific procedures designed “to minimize the retention, and prohibit the dissemination, of nonpublicly available information concerning unconsenting United States persons consistent with the need of the United States to obtain, produce, and disseminate foreign intelligence information.” Note that the government is not required to destroy data about US persons that have nothing to do with foreign intelligence; it just has to “minimize the retention of it.” Its minimization procedures thus may well allow the government to retain innocent communications for a period of time in case they may be useful in the future.

Now that the public is attuned to the problem, and civil liberties groups are apoplectic, we are likely to learn more about exactly how the program is used, and how information is minimized. There will be congressional hearings, in which embarrassed Members of Congress, who never bothered to attend briefings on the program, will grill Executive Branch officials for details. And there will be leaks. Oh yes, lots of leaks. Which means there will be leak investigations. Gee, I wonder who placed a call to Glenn Greenwald of The Guardian recently…

Location, Location, Location

By Jason M. Weinstein on Posted in Privacy Regulation, Security Programs & Policies

The Geolocation Privacy and Surveillance (GPS) Act is one of several pieces of legislation that would require law enforcement to obtain a warrant based on probable cause whenever it seeks location information.  The term “location information” is very broadly defined, and the proposed law would make no distinctions based on the level of precision or the length of time for which the information is sought, or whether the information is historical or prospective.

As a general matter, this is an area where legislation is needed.  Federal prosecutors already routinely obtain warrants based on probable cause when seeking precision-location information from cellphones, but the law is less clear regarding what standard must be met in order to obtain less-precise cell site information.  Under the Electronic Communications Privacy Act (ECPA), for historical cell site information, prosecutors are generally required to obtain court orders based on a showing of “specific and articulable facts,” pursuant to 18 U.S.C. § 2703(d).  But for prospective cell tower records, courts are split on whether a so-called “hybrid order” based on “specific and articulable facts” or a warrant based on “probable cause” is required.  In some instances, that split involves judges in the same circuit, or even the same courthouse.  That lack of clarity and consistency is not fair to anyone – law enforcement, providers, or the public.  Moreover, recent reporting suggests that local and state law enforcement officers may not be adhering to the same standards required by ECPA, which are supposed to be the law of the land.  So legislation clarifying the confusion over cell tower records, and making clear that the law binds law enforcement at all levels, is a good thing.

But having clear rules does not mean having only one rule, and this is one place where the GPS Act is off the mark.  The bill’s “one size fits all” approach presents potential risks to public safety and privacy.  Our system of privacy laws have historically provided a continuum of protection, with a greater evidentiary showing required as the degree of intrusion increases.  For instance, to obtain historical telephone toll records, law enforcement uses a subpoena.  To obtain call records prospectively, law enforcement must get a court order known as a “pen register.”  But to listen to the content of calls – a far greater degree of intrusion – law enforcement must obtain a wiretap, which requires a showing of probable cause.  This continuum balances the strong interests in privacy and public safety by allowing law enforcement – which typically does not begin investigations with probable cause – to use less-intrusive techniques to gather evidence that forms the building blocks necessary to develop criminal cases or to satisfy the stricter standards required for using more intrusive techniques.

The same principle applies to location information.  There is a greater privacy interest in real-time, GPS information about a suspect’s movements than there is in the location of a nearby cell tower that served a call the suspect made on a particular day six months ago.  But the GPS Act would obliterate any such distinctions.  In doing so, the Act would have the unintended consequence of impairing many different types of law enforcement investigations – including investigations of cyber criminals and others who threaten our privacy.  Truly protecting privacy requires not only that we keep personal information from criminals who seek to steal it, but also that we ensure that law enforcement can get the data it needs to catch and prosecute those criminals – using appropriate legal process at every stage.

But the GPS Act is not limited to the question of law enforcement access to location data.  The bill also seeks to prohibit commercial service providers from sharing customers’ geolocation information with outside entities without customer consent.  This is an area where legislation is not needed, but where meaningful self-regulation is critical.

In a recent speech at the Network Advertising Initiative (NAI) member summit, FTC Commissioner Maureen Ohlhausen expressed support for an industry-created mechanism to allow consumers to opt out of online tracking, as opposed to new legislation mandating such steps.  Commissioner Ohlhausen stated:

“Self-regulation can offer benefits because it is nimble, and is able to keep pace with rapid changes in technology in ways that legislation and regulation cannot.”

These remarks were as on-target as, well, a GPS.  Transparency and consumer trust regarding the collection and use of personal information are critical to a vibrant Internet economy, but these are best achieved through the market.  Industry stakeholders have already demonstrated the ability to develop self-regulatory programs with meaningful compliance regimes.  For instance, the NAI, a coalition of online advertising providers, has a Code of Conduct for collection, use, and transfer of personal data by Internet advertisers that is backed by a strong compliance program.  That Code requires clear notice to consumers about the way in which data will be collected and used and about their choices regarding targeted ads, and it requires opt-in consent for the use of particular types of more sensitive data, including precise geolocation data.

Contrary to popular belief, providers care about privacy too, and not just because the FTC or Congress tells them to.  And now more than ever, privacy is becoming a competitive issue, as companies are increasingly highlighting their commitment to privacy protection to try to gain an advantage in the marketplace.

Regimes such as NAI’s provide consumers with the information necessary to make informed choices about the use of their information, without new regulatory burdens that can stifle innovation.

Overreacting to the AP Subpoenas

By Jason M. Weinstein on Posted in Privacy Regulation, Security Programs & Policies

Wired recently reported that four members of Congress have introduced the Telephone Records Protection Act, which would require federal law enforcement to obtain a court order before obtaining telephone toll records – whether from reporters or anyone else – in an investigation.

However well-intentioned, this bill is an extreme overreaction to the frenzy over DOJ having used a “secret” subpoena to obtain telephone records of AP reporters in a national security leak case. First, grand jury subpoenas are by definition “secret” – by law, the grand jury process is conducted in private in order to protect the integrity of ongoing investigations and the reputations of innocent people who may be investigated and later exonerated. Second, DOJ guidelines require review of media subpoenas by a number of career employees at various levels of the Department before the subpoena even reaches the desk of the Attorney General or, in this case, the Deputy Attorney General, and there is no indication of any deviation from those procedures in this case.

Reasonable people can of course disagree about whether the subpoena for AP phone records should have been issued at all, or whether it should have been more narrowly tailored. And those members of Congress who have concerns about the subpoena and the impact on the First Amendment may want to consider a media shield law to provide some greater measure of protection to reporters. They may even want to consider requiring prior court approval for a subpoena to the media. But to respond to this episode by trying to preclude the use of grand jury subpoenas to obtain telephone records from anyone, in any investigation, is like trying to kill a fly with a missile.

Telephone toll records – which reflect only the numbers dialed, and not the content of any call – are the type of basic information that is used by agents and prosecutors as building blocks in criminal investigations, and law enforcement has been using grand jury subpoenas to obtain them pretty much since the telephone was invented. Law enforcement officers routinely use grand jury subpoenas to obtain many other types of evidence needed to build criminal cases, such as records of bank and other financial transactions, without prior judicial approval. That is not to say there is no judicial involvement in the subpoena process – the grand jury is supervised by a judge, and a prosecutor who misuses the grand jury is subject to significant professional consequences and will answer to the court, and likely the bar. That accountability acts as a check and balance on prosecutors and agents that makes prior court approval unnecessary.

Changing the rules to better protect reporters is a laudable goal. But the kind of across-the-board change to evidence-gathering contemplated by the Telephone Records Protection Act is a solution in search of a problem.

Support for Retribution and Active Defense Increases

By Stewart Baker on Posted in China, Cybersecurity and Cyberwar, International, Security Programs & Policies

Chinese hacking continues to build anger in American business and government circles. As a result, private companies may be encouraged to do more than passively defend their networks as evidenced by the recent report of a commission headed by two Obama appointees, former US Ambassador to China (and minor GOP Presidential candidate) Jon Huntsman and former Director of National Intelligence Dennis Blair. The report apparently lists Chinese hacking as a major threat to intellectual property (it’s due out later today). And, according to early press reports, the commission calls for an expansion of private companies’ authority to track their stolen data back to the attacker’s network:

“The commission argued that American companies “ought to be able to retrieve their electronic files or prevent the exploitation of their stolen information” by designing their computer files to self-destruct if they fall into the wrong hands. But the authors of the report also say that if the damage “continues at current levels,” the government should consider allowing American companies to counterattack — essentially taking cyberwar private.

“If counterattacks against hackers were legal, there are many techniques that companies could employ that would cause severe damage to the capability” of the Chinese or other groups committing computerized theft, the report said. But it added a qualifier: “while properly empowered law enforcement authorities are mobilized.” Many in the administration have opposed such ideas, fearing that they could lead to a cycle of escalation between the United States and other nations that could easily spin out of control.”

The commission also adopts another view first popularized here: that attribution of attacks should be followed by retribution, and it comes up with at least one clever bit of retribution that I’d missed: restrictions on access to US stock exchanges:

“The new report does propose specific remedies. One is to mandate that foreign companies that want to be listed on stock exchanges in the United States first pass a review by the Securities and Exchange Commission about whether they use stolen intellectual property. “They all want their shares to be traded here, so this would impose a real cost,” Mr. Blair said. Similarly, whether companies protect intellectual property would be considered by the Committee on Foreign Investment in the United States, which judges whether an investment in the United States could pose a security risk. Currently it looks only at national security implications of investments; this would add a new criterion.”

Lessons From the New York ATM Heist

By Jason M. Weinstein on Posted in Cybersecurity and Cyberwar, Data Breach, International, Security Programs & Policies

The announcement yesterday of charges in New York against eight members of a cybercrime ring that stole $40 million from ATMs in 24 countries, all within 10 hours, is the latest in a series of episodes that illustrate the constant threat of cyber attacks against our corporate networks. This case should be a wake-up call to anyone who underestimates the sophistication and determination of today’s cyber-criminals. Now more than ever, hackers in different countries can collaborate across borders and time zones and despite language barriers, just as easily as if they were in the same room. They can orchestrate and execute highly sophisticated, complex criminal schemes that involve coordinating the actions of associates around the globe.

For victim companies, the results can be devastating, including financial losses, heavy remediation costs, and reputational harm. But it doesn’t stop there, because the companies can also face regulatory proceedings and litigation for years to come.

Every company with a network to protect – which is to say, every company, anywhere – should look at the New York case as a reminder to review its own breach preparedness. That means more than just network security. It also means ensuring that contracts with business partners address liability for data security, and that insurance coverage is appropriate. It means ensuring that the company is in compliance with applicable legal requirements for processing, storing, and securing data. And it means having an incident response plan in place, and testing that plan, before a breach occurs.

This type of comprehensive review of information governance and data security is the best way to mitigate the risks of harm from a breach. And in the event a breach occurs, demonstrating the steps the company took to prevent and prepare for a breach will be a critical part of the company’s defense in enforcement proceedings and litigation. The best defense later is a proactive defense now.

Kudos to the prosecutors from the Eastern District of New York and their partners in the Secret Service and ICE for their work in this case, which no doubt continues as they pursue the hackers who masterminded the scheme.

Not-So-Shocking Privacy Surprises

By Stewart Baker on Posted in Privacy Regulation

Privacy laws are an ideal illustration of laws with unintended consequences. Take two examples plucked from last week’s front pages:

On April 25, The New York Times reported on massive fraud in the billion-dollar settlement of claims that the Agriculture Department discriminated against black, Hispanic, and female farmers:

“It was the craziest thing I have ever seen,” one former high-ranking department official said. “We had applications for kids who were 4 or 5 years old. We had cases where every single member of the family applied.” The official added, “You couldn’t have designed it worse if you had tried.”

… “[T]here was no way to refute what they said,” said Sandy Grammer, a former program analyst from Indiana who reviewed claims for three years. “Basically, it was a rip-off of the American taxpayers.”

The true dimensions of the problem are impossible to gauge. The Agriculture Department insists that the names and addresses of claimants are protected under privacy provisions.

The Boston Herald reported on its attempt to find out how many benefits the Tsarnaevs received before their bombing attack on the Boston Marathon:

The Patrick administration clamped down the lid yesterday on Herald requests for details of Tamerlan Tsarnaev’s government benefits, citing the dead terror mastermind’s right to privacy.

Across the board, state agencies flatly refused to provide information about the taxpayer-funded lifestyle for the 26-year-old man and his brother and accused accomplice Dzhokhar Tsarnaev, 19.

On EBT card status or spending, state welfare spokesman Alec Loftus would only say Tamerlan Tsarnaev, his wife and 3-year-old daughter received benefits that ended in 2012. He declined further comment.

On unemployment compensation, labor department spokesman Kevin Franck refused to say whether Tamerlan Tsarnaev ever collected, saying it was “confidential and not a matter of public record.”

On Dzhokhar Tsarnaev’s college aid, University of Massachusetts Dartmouth spokesman Robert Connolly said, “It is our position — and I believe the accepted position in higher education — that student records including academic records and financial records (including financial aid) cannot under federal law be released without a student’s consent.”

On cellphones, the Federal Communications Commission would not say whether either brother had a government-paid cellphone, also citing privacy laws.

Who knew? Thanks to privacy law, people making dubious claims on a judgment fund don’t have to be identified as though they were litigants; and benefit recipients are protected from embarrassment even after death has made embarrassment the least of their troubles.

In fact, privacy laws have a long heritage of unintended consequences. For example, Libertarians were outraged when citizens got arrested for recording the police; but those arrests were often based on state privacy laws that prohibited “eavesdropping” on conversations without all parties’ permission. There’s also the example of Louis Brandeis’s famous right to privacy, which inspired the quasi-intellectual property “right of publicity,” an equally unintended outcome of laws adopted to preserve privacy that have become the mechanism by which celebrities extract fees for commercial use of their photos.

We can’t really call these unintended consequences an accident. We think we know what we want when we pass laws protecting privacy, but it turns out that our notions of privacy are remarkably fluid and situational, so by the time the laws are actually applied they don’t actually correspond to our sense of right and wrong. It works about as well as a law codifying and punishing rude behavior in public.

But in another way, there’s nothing at all surprising about the consequences of privacy laws. From arresting citizen photographers to clamping a lid on government scandals, privacy laws almost always turn out to be remarkably convenient for the powers that be.

Again, that’s not an accident. As particular privacy laws lose their connection to evolving cultural standards, we slowly stop enforcing them (see, e.g., Brandeis, supra). But they still get dusted off and enforced in a couple of situations: (1) To punish people whom the authorities don’t like but who haven’t violated any other laws and (2) to protect the kind of people who end up running the government.

In other words, it looks as though privacy laws are doing for the twenty-first century what loitering laws did for the twentieth.

PHOTO:  Kai Strandskov