Privacy, Security & Government Surveillance

Jennifer Medina of the New York Times penned an article yesterday on the debate over social networking fears leading to calls for age verification mandates. She noted that measures are moving in several states that would require social networking sites to age-verify users before they are allowed to visit the sites or create profiles there. But Medina also noted that there are many difficult questions about how age verification would work and how “social networking” would even be defined. (I summarize these questions in my recent PFF report, “Social Networking and Age Verification: Many Hard Questions; No Easy Solutions.”)

Ms. Medina was also kind enough to interview me for the story and she summarizes some of what I had to say in her piece. In a nutshell, I stressed that the most effective way to deal with this problem is to get serious about dealing with sex offenders instead of trying to regulate law-abiding citizens. We need to be locking up convicted sex offenders for a lot longer in this country to make sure they behind bars instead of behind keyboards seeking to prey on our children.

I also stressed the importance of online safety education as part of the strategy here. But my comments on that didn’t make the cut in the story. But you can read my big recent paper on this issue for additional details.

Previous installments (1, 2, 3 & 4) in this series have documented how our government seems to have a difficult time keeping tabs on laptops and personal information. The latest on this front comes from the Transportation Security Administration (TSA). Last week, the TSA informed us that a computer hard drive containing the personal, payroll and bank information of 100,000 current and former TSA workers has apparently gone missing and is assumed stolen. The FBI and the Secret Service have apparently opened a criminal investigation into the matter.

I was about to launch into another rant on this front, but then I picked up this morning’s Washington Post and their editorial on this issue really nails it:

Continue reading →

Here’s Congress siding with Boston’s idiotic public officials. The Terrorist Hoax Improvements Act of 2007 would allow government officials to sue people who fail to promptly clear things up when those officials mistakenly think that they have stumbled over a terrorist plot.

There’s nothing in the bill allowing individuals or corporations to sue government officials when hare-brained overreactions interfere with their lives and business or destroy their property.

The comment period on Department of Homeland Security regulations implementing the REAL ID Act ends early next week. A broad coalition of groups has put together a Web page urging people to submit their comments. The page has instructions for commenting, a quite helpful thing given how arcane the regulatory process is.

Feel free to comment — good, bad, or indifferent – on the regs. My views are known, but the Department of Homeland Security doesn’t know yours.

Oh MY, the title of this post is meta.

I found a rare opportunity to lightly critique Bruce Schneier’s thinking and put it on Cato@Liberty. These opportunities don’t come around often . . .

Question Authority

by on April 21, 2007

Matt Shannon questioned mine – and got an earful in the comments!

(It may be a coincidence / mistaken identity. Don’t assume I got my Google research right.)

Stop Illegal Spying

by on April 20, 2007 · 2 comments

Another reason you should listen to this week’s podcast is so you can hear Derek Slater discuss StopIllegalSpying.org, a website that EFF has created with the ACLU and others to pressure Congress to hold real hearings on the Bush administration’s terrorist surveillance illegal wiretapping program. I encourage you to check out the site and send a message to your Congresscritter.

In the podcast, Derek also updates us on other aspects of the fight against illegal spying, so I encourage you to check it out.

digg_url = ‘http://digg.com/podcasts/Tech_Policy_Weekly_from_The_Technology_Liberation_Front‘;

http://digg.com/tools/diggthis.js

Link Analysis and 9/11

by on April 19, 2007

In our paper Effective Counterterrorism and the Limited Role of Predictive Data Mining, Jeff Jonas and I pointed out the inutility of data mining for finding terrorists. The paper was featured in a Senate Judiciary Committee hearing earlier this year, and a data mining disclosure bill discussed in that hearing was recently marked up in that Committee.

On his blog, Jeff has posted some further thinking about 9/11 and searching for terrorists. He attacks a widespread presumption about that task forthrightly:

The whole point of my 9/11 analysis was that the government did not need mounds of data, did not need new technology, and in fact did not need any new laws to unravel this event!
He links to a presentation about finding the 9/11 terrorists and how it could have been done by simply following one lead to another.

Jeff feels strongly that Monday morning quarterbacking is unfair, and I agree with him. Nobody in our national security infrastructure knew the full scope of what would happen on 9/11, and so they aren’t blameworthy. Yet we should not shrink from the point that diligent seeking after the 9/11 terrorists, using traditional methods and the legal authorities existing at the time, would have found them.

The Piggybacking Epidemic

by on April 18, 2007 · 2 comments

My co-blogger Brian Moore notes another of these ridiculous “wi-fi theft” cases, this one in the UK. Brian’s take is spot-on:

I can’t think of a better example of a victim-less crimes. The “victims” were so unconcerned about people accessing their network that they didn’t bother to give it even the minimal security that most wireless access points will automatically prompt you to install. Secondly, absolutely nothing the “perpetrators” did harmed the “victim.” This is a positive externality — this is like me listening to good music coming out of your house. We both benefit from your purchase. It’s better than bad, it’s good! The only exception would be if the connection burglars were doing something that negatively impacted the owners of the network — such as downloading massive files that slowed their connection. But nothing in the article implies this — they merely saw him sitting in a car across the street with a laptop. If someone cracks your encryption and steals your credit card numbers, then yes, this is a crime. But that’s not what’s happening. Here’s the crime they were charged with: “dishonestly obtaining electronic communications services with intent to avoid payment.” Imagine a similar crime — I purchase a newspaper and throw it out into the street after I’m done with it. Someone walks by and picks it up, and starts reading it. Then the police arrest him for “dishonestly obtaining paper communications services with intent to avoid payment.” What’s worse, in this example, the original owner of the newspaper has actually lost the ability to use it because there’s only one copy, even if it’s obvious he doesn’t care about it. “Stealing” wireless access doesn’t (normally) impact the owner’s ability to use it.