Keeping politicians' hands off the Net & everything else related to technology
Attorney General Alberto R. Gonzales and now FBI Director Robert Mueller (see Adam’s post) are fond of reminding us that the Internet creates opportunities for terrorists and sexual predators. But for law enforcement, the Internet is a gift. For example, it allows undercover agents to pose as children for the purpose of apprehending sexual predators. Consider this anecdotal evidence of the success of these operations:
In a speech today before the International Association of Chiefs of Police, FBI Director Robert Mueller called for data retention mandates for Internet service providers to record their customers’ online activities. Declan McCullagh has complete coverage over at CNet.
Several of us here at the TLF are concerned about these growing calls for mandatory data collection and have written about it. See these past essays:
“Mandatory Data Retention: How Much is Appropriate?” by Adam Thierer, June 26, 2006.
“Internet Data Storage Is The Wrong Way To Combat Child Sexual Exploitation,” by Hance Haney, Sept. 20, 2006.
“Data Retention on the Move,” by Jim Harper, June 1, 2006.
In this recent post, TechCrunch briefly assessed some concerns with Google’s office strategy. As most TLFers probably know, Google has online offerings in the works that could substitute for the word processing and spreadsheet software on your computer – just like Gmail did with e-mail.
And just like Gmail, documents and information would remain on Google’s servers so they can be accessed anywhere. This is a great convenience, but brings with it several problems, namely:
The fact that unauthorized document access is a simple password guess or government “request” away already works against them. But the steady stream of minor security incidents we’ve seen (many very recently) can also hurt Google in the long run.
Arrington’s post goes on to highlight a series of small but significant security lapses at Google. If Google wants companies and individuals to store sensitive data on their servers, they have to be pretty near perfect – or better than perfect.
Then there is government “request.” Arrington makes appropriate use of quotation marks to indicate irony. Governments rarely “request” data in the true sense of that term. Rather, they require its disclosure various ways – by warrant or subpoena, for example, by issuing “national security letters,” or by making a technical “request” that is backed by the implicit threat of more direct action or regulatory sanctions.
Via Gene Healy, here’s a Wall Street Journal article that offers some perspective on the “suitcase nuke.” In a nutshell, it’s barely more than an urban legend. As Viktor Yesin, former chief of staff of Russia’s Strategic Missile Forces, explains:
Let’s start by noting that “nuclear suitcase” is a term coined by journalists. Journalistic parlance, if you wish. The matter concerns special compact nuclear devices of knapsack type. Igor Valynkin, commander of the 12th Main Directorate of the Defense Ministry responsible for nuclear ordnance storage, was absolutely honest when he was saying in an interview with Nezavisimaya Gazeta in 1997 that “there have never been any nuclear suitcases, grips, handbags or other carryalls.” As for special compact nuclear devices, the Americans were the first to assemble them. They were called Special Atomic Demolition Munitions (SADM). As of 1964, the U.S. Army and Marine Corps had two models of SADM at their disposal–M-129 and M-159. Each SADM measured 87 x 65 x 67 centimeters [34 by 26 by 26 inches]. A container with the backpack weighed 70 kilograms [154 pounds]. There were about 300 SADMs in all. The foreign media reported that all these devices were dismantled and disposed of within the framework of the unilateral disarmament initiatives declared by the first President Bush in late 1991 and early 1992. The Soviet Union initiated production of special compact nuclear devices in 1967. These munitions were called special mines. There were fewer models of them in the Soviet Union than in the United States. All of these munitions were to be dismantled before 2000 in accordance with the Russian and American commitments concerning reduction of tactical nuclear weapons dated 1991. [When the Soviet Union collapsed, Boris Yeltsin reiterated the commitment in January 1992.] Foreign Minister Igor Ivanov said at the conference on the Nuclear Weapons Nonproliferation Treaty in April 2000 that Russia had practically completed dismantling “nuclear mines.” It means that Russia kept the promise Yeltsin once made to the international community.
No one disputes that Osama bin Laden would desperately like to get his hands on a nuclear weapon. But as the article explains, there are three ways to get a nuclear weapon–buy it, steal it, or make it yourself. And luckily, each of these methods appears to be well out of Al Qaeda’s reach. Anti-proliferation efforts are important, of course, but the real nuclear threat comes from states, not terrorists.
EFF links to a New York Times article on a Department of Homeland Security program to “let the government monitor negative opinions of the United States or its leaders in newspapers and other publications overseas.” The EFF’s Marcia Hofmann thinks that it “could affect the willingness of journalists to report negative information or controversial opinions about the United States, and otherwise chill online speech protected by the First Amendment.”
My reaction is rather different: the program strikes me as being somewhere between harmless and silly. They’re just taking publicly available stories and running them through text analysis software in an effort to gauge how “hostile” they are. It’s not obvious that this software will be able to do anything that a team of human analysts couldn’t. In fact, in the short term, at least, the human analysts are likely to be substantially better, as natural language processing technology is far from prime time.
Even if I’m wrong and this turns out to be an incredibly powerful tool for monitoring foreign media, I don’t see how it would be a threat to free speech. This is foreign media we’re talking about, so DHS couldn’t censor them if they wanted to. And all the information they’re using is available to the general public, so I don’t see any serious privacy implications. We can debate whether it’s worth the $2.3 million price tag, but this doesn’t seem like a program that civil libertarians should be upset about.
This morning’s Wall Street Journal opinion page blasts Republicans for passing the REAL ID Act. [subscription required]
Keyed to a recent report showing the costs of compliance at $11 billion, the piece notes that all Americans will have to reapply for their drivers’ licenses and ID cards if states go along with this unfunded federal surveillance mandate. It also addresses whether a national ID protects against terrorism or provides effective immigration control and finds REAL ID wanting on both counts. My book Identity Crisis shows why.
Sooner rather than later, Congress will recognize its error in passing the REAL ID Act. Most likely it will try to kick the can down the road. Look for a quiet attempt to change the deadline for getting a national ID in everyone’s hands.
But that is not the solution. If Congress wants a national ID, it should have hearings, markup and pass legislation, then fund and implement a national ID itself.
Congress didn’t have a single hearing or up-or-down vote on the REAL ID Act. This much exposure would kill a national ID plan, of course.
Jim is apparently too modest to whore his posts out to multiple blogs, but his comments on terrorist watch lists are very good, so I’m going to do it for him:
In the U.S., people who have done something wrong are supposed to be arrested, taken to court and charged, then permitted to contest the accusation. If they are found guilty, they pay money or serve time in jail. Watch-listing follows no similarly familiar pattern. Law enforcement or national security personnel place a person on a list and then, wherever that list is used, treat the person (and other people with the same name) differently, stopping them, interrogating them, searching them, or whatever the case may be. This unilateral process is alien to our legal system. Rather than watch-listing, people who are genuinely suspected of being criminals or terrorists should be sought, captured, charged, tried, and, if convicted, sentenced. Watch-listing allows law enforcement to be very active and intrusive without actually doing what it takes to protect against crime and terrorist acts. In Identity Crisis, I wrote that “watch listing and identification checking [are] like posting a most-wanted list at a post office and then waiting for criminals to come to the post office.” At the national border, watch-listing must be used–deftly–because we cannot reach wrongdoers worldwide. Those watch-lists allow us to be vigilant against bad people who may arrive on our shores. Domestically, though–in our free country–the practice should end.
Quite so.
Steve Kroft of 60 Minutes has obtained a copy of the no-fly list the TSA uses to decide who among the flying public should be subject to extra scrutiny or denied the right to fly altogether. It is, not surprisingly, shockingly inadequate. It includes the “names of people not likely to cause terror, including the president of Bolivia, people who are dead and names so common, they are shared by thousands of innocent fliers.”
We’ve been told since the beginning of the program that we couldn’t release the list because it might tip off the terrorists. This has never made much sense–future terrorists can find out if they’re on the list by doing a test flight and seeing if they get extra scrutiny. The more plausible explanation for the TSA’s reluctance to release the list was due to their fears that it would be subject to harsh criticism. Luckily, the press has done its job here, and the list is now being subject to the scrutiny it deserves. Hopefully that will lead to improvements in our security procedures.
This point can be generalized: systems are made more, not less, secure when they’re open to scrutiny. This is the majority view among computer security experts, who tend to trust open, time-tested encryption algorithms over new-fangled proprietary ones, because it’s less likely that someone will discover a serious flaw in the system. We’ve seen the same phenomenon with computerized voting machines, where closed, proprietary machines have consistently been found to have serious security flaws. And the same is almost certainly true of physical security: opening up our airport security system to greater scrutiny will give security experts and the general public the opportunity to spot problems and pressure the authorities to remedy them. Security through obscurity doesn’t work in the high-tech world, and it’s not likely to work in airport security either.
Hat Tip: Jim Lippard
I see that the California Initiative For Internet Privacy (CIFIP) is turning up the heat on Google and other search engine provides with threats of legislative campaigns or a push for a ballot initiative regulating data collection.
When it comes to the contentious issue of data retention, search companies are basically damned if they do and damned if they don’t. That is, if they DO collect / retain search terms and records, the privacy zealots go crazy and run to Rep. Ed Markey (or, in this case, California legislators) and ask for new laws strictly limiting what can be collected / retained.
On the other hand, if they DO NOT collect / retain any of this info, then the “law and order” / “we must protect the children” crowd in Congress and state AG offices start breathing fire down their necks and demand mandatory data preservation / retention, potentially for lengthy periods of time (and for quite a bit of information).
How in the world is Google (or any other search provider or even ISP) supposed to balance those conflicting policy goals? I have no idea, but there is no doubt that this will be one of the top technology policy issues over the coming year. (For our perspectives on the data retention debate, see these TLF essays by Jim, Hance and me.)
I wish I could buy this guy a beer:
A Wisconsin man who wrote “Kip Hawley is an Idiot” on a plastic bag containing toiletries said he was detained at an airport security checkpoint for about 25 minutes before authorities concluded the statement was not a threat. Ryan Bird, 31, said he wrote the comment about Hawley–head of the Transportation Security Administration–as a political statement. He said he feels the TSA is imposing unreasonable rules on passengers while ignoring bigger threats. A TSA spokeswoman acknowledged a man was stopped, but likened the incident to cases in which people inappropriately joke about bombs. She said the man was “a little combative” and that he was detained only a few minutes.
Bird’s original account of the incident is here.
The Technology Liberation Front is the tech policy blog dedicated to keeping politicians' hands off the 'net and everything else related to technology.
