Privacy, Security & Government Surveillance

Quote of the Day

by on March 14, 2008 · 2 comments

Regarding yesterday’s secret session of Congress:

Democrats said very little was discussed that could not have been revealed in open session. Pelosi didn’t show up, and Democrats, underwhelmed by the GOP’s evidence, used just 10 minutes of their allotted 30 minutes of secret time. “We probably could have gone and eaten together at McDonald’s, and it would have had just as much effectiveness,” said Rep. Charlie Melancon (D-La.), one of the conservative Democrats the GOP was targeting.

It’s incredibly refreshing to see the House take seriously its responsibility to resist White House efforts to undermine the rule of law. Six weeks ago, I thought it was only a matter of time before Congress capitulated and once again reduced judicial oversight over domestic surveillance activities. But now people are seriously talking about the stalemate lasting for the remainder of the Bush administration.

The White House has cried wolf so many times that the tactic is becoming less effective with every repetition. As the House continues to ignore the president’s scare tactics, those tactics are beginning to look faintly ridiculous. At this point, there is very little political reason for the House to capitulate, and good policy reasons for them not to.

Who says airport security checks have to be a bad time?

At his Iconoclast blog, Declan McCullagh has a very good write-up of the broad sweep of NSA surveillance and the resurrection of the Total Information Awareness program in new guise.

Don’t let the facetious headline fool you: I welcome news stories like this New York Times piece (via Ars), which reports on the amount of data major online firms collect.

It gives us tech sophisticates some more information, but, more importantly, it starts to educate the lay public that they are part of an information economy whether they like it or not. This will stimulate them on the margin to make choices about where they surf, whether they accept cookies, and so on. Putting this information in the hands of the public pits these online firms against one another to seek trust with the public, such as by controlling their data collection, ensuring the public that the data won’t be misused, and so on.

The marketplace continues to lag in its provision of privacy, in part because of the technical difficulty of determining how things work, what data goes where, etc. With the press overwhelmed by the problem of figuring this stuff out, it hasn’t been able to put the public in a position to act. In a small way, this article starts to clear that fog. A welcome development indeed.

The head of the California Assembly’s Transportation Committee has introduced a resolution rejecting REAL ID. Wired’s Threat Level blog reports:

Howard Posner, a policy consultant to the Transportation Committee, said that last year the committee contemplated moving legislation to accept Real ID, but reconsidered after “looking at the cost, and the incredible inconvenience for driver’s license holder and the privacy issues.”

“We heard the feds had enacted this without any kind of review process or holding hearings,” Posner said. “We thought someone ought to step back and see if this is the most cost effective way to secure driver’s licenses.”

Arrington reports that a G-mail archiver called G-Archiver, which backs up all of your Gmail emails to your hard drive, sends every user’s email address and password to the creator’s own email account, giving him access to all of their Gmail messages. And he observes:

That has led a number of experts to conclude that Google Apps can never be a real threat to Microsoft Exchange and Sharepoint. All of the sensitive business information of a company, if stored on Google’s servers, is just a password guess, or in this case what is effectively a phishing scam, away.
This reprises his earlier observation (which I amplified here) that “unauthorized document access is a simple password guess or government ‘request’ away.”

Looking down the horizon, I don’t see why it’s better to have computing and storage done remotely. Better security (for the corporation and individual alike) will come from owning and physically controlling your storage and computing. The winners won’t be the providers of computing in the cloud (think Google); it’ll be the ones who make the portable and easy-to-use devices (think Apple).

An EFF release issued Thursday tells of another telecom employee who has revealed government access to Americans’ communications.

Babak Pasdar, a computer security consultant, has gone public about his discovery of a mysterious “Quantico Circuit” while working for an unnamed major wireless carrier. Pasdar believes that this circuit gives the U.S. government direct, unfettered access to customers voice calls and data packets. These claims echo the disclosures from retired AT&T technician Mark Klein, who has described a “secret room” in an AT&T facility.
Given the lack of information available to Congress on this and other allegations, three House Committee Chairmen have written their colleagues arguing against a “vote in the dark” on FISA reform and telecom immunity.

Schneier on REAL ID

by on March 8, 2008 · 0 comments

Security guru Bruce Schneier has a good op-ed on the REAL ID Act in the Minneapolis Star Tribune, along with a short Q&A.

Those AWOL Libertarians

by on March 8, 2008 · 4 comments

Via Julian, diarist at Daily Kos has repeated the complaint that libertarians have been AWOL on FISA. This is beyond silly. Let me offer a quick timeline:

  • Feb 1: Cato’s daily podcast features me discussing the FISA debate. And on Cato’s blog, I debunk the idea that telecom immunity is about trial lawyers.
  • Google’s recent announcement that it is creating a home for personal health records online is a natural outgrowth of Silicon Valley’s Web 2.0 consumer Internet focus. The question this raises is whether a market-driven system is better for keeping health records than one run by the government. Here is my column discussing it.