Gadget Gurus

♲ Technology+%7C+The+Guardian 2017-03-12 00:01:08:

I invented the web. Here are three things we need to change to save it | Tim Berners-Lee It has taken all of us to build the web we have, and now it is up to all of us to build the web we want – for everyone Today marks 28 years since I submitted my original proposal for the worldwide web. I imagined the web as an open platform that would allow everyone, everywhere to share information, access opportunities, and collaborate across geographic and cultural boundaries. In many ways, the web has lived up to this vision, though it has been a recurring battle to keep it open. But over the past 12 months, I’ve become increasingly worried about three new trends, which I believe we must tackle in order for the web to fulfill its true potential as a tool that serves all of humanity. 1) We’ve lost control of our personal data Continue reading...

WikiLeaks has published what it claims is the "largest ever publication of confidential documents on the CIA." It includes more than 8,000 documents as part of ‘Vault 7’, a series of leaks on the agency which expose the agency's massive hacking arsenal.

♲ Techdirt. 2017-01-25 23:11:31:

State Appeals Court Says Unlocking A Phone With A Fingerprint Doesn't Violate The Fifth Amendment As was hinted heavily three years ago, you might be better off securing your phone with a passcode than your fingerprint. While a fingerprint is definitely unique and (theoretically...) a better way to keep thieves and snoopers from breaking into your phone, it's not much help when it comes to your Fifth Amendment protections against self-incrimination. The Minnesota Appeals Court has ruled [PDF]that unlocking a phone with a fingerprint is no more "testimonial" than a blood draw, police lineup appearance, or even matching the description of a suspected criminal. (h/t Orin Kerr)

Diamond relies on In re Grand Jury Subpoena Duces Tecum, 670 F.3d 1335 (11th Cir. 2012), to support his argument that supplying his fingerprint was testimonial. In In re Grand Jury, the court reasoned that requiring the defendant to decrypt and produce the contents of a computer’s hard drive, when it was unknown whether any documents were even on the encrypted drive, “would be tantamount to testimony by [the defendant] of his knowledge of the existence and location of potentially incriminating files; of his possession, control, and access to the encrypted portions of the drives; and of his capability to decrypt the files.” Id. at 1346. The court concluded that such a requirement is analogous to requiring production of a combination and that such a production involves implied factual statements that could potentially incriminate. Id. By being ordered to produce his fingerprint, however, Diamond was not required to disclose any knowledge he might have or to speak his guilt. See Doe, 487 U.S. at 211, 108 S. Ct. at 2348. The district court’s order is therefore distinguishable from requiring a defendant to decrypt a hard drive or produce a combination. See, e.g., In re Grand Jury, 670 F.3d at 1346; United States v. Kirschner, 823 F. Supp. 2d 665, 669 (E.D. Mich. 2010) (holding that requiring a defendant to provide computer password violates the Fifth Amendment). Those requirements involve a level of knowledge and mental capacity that is not present in ordering Diamond to place his fingerprint on his cellphone. Instead, the task that Diamond was compelled to perform—to provide his fingerprint—is no more testimonial than furnishing a blood sample, providing handwriting or voice exemplars, standing in a lineup, or wearing particular clothing.

Of course, it's what's contained in the now-unlocked device that might be incriminating, which is why Diamond pointed to In re Grand Jury as being analogous to the forced provision of a fingerprint. The court's rebuttal of this argument, however, doesn't make a lot of sense. It says the process that unlocked the device requires no knowledge or mental capacity -- which is certainly true -- but that the end result, despite being the same (the production of evidence against themselves) is somehow different because of the part of the body used to obtain access (finger v. brain). In recounting the obtaining of the print, the court shows that some knowledge is imparted by this effort -- information not possessed by law enforcement or prosecutors.

Diamond also argues that he “was required to identify for the police which of his fingerprints would open the phone” and that this requirement compelled a testimonial communication. This argument, however, mischaracterizes the district court’s order. The district court’s February 11 order compelled Diamond to “provide a fingerprint or thumbprint as deemed necessary by the Chaska Police Department to unlock his seized cell phone.” At the April 3 contempt hearing, the district court referred to Diamond providing his “thumbprint.” The prosecutor noted that they were “not sure if it’s an index finger or a thumb.” The district court answered, “Take whatever samples you need.” Diamond then asked the detectives which finger they wanted, and they answered, “The one that unlocks it.”

This is something only Diamond would know, and by unlocking the phone, he would be demonstrating some form of control of the device as well as responsibility for its contents. So, it is still a testimonial act, even if it doesn't rise to the mental level of retaining a password or combination. (And, if so, would four-digit passcodes be less "testimonial" than a nine-digit alphanumeric password, if the bright line comes down to mental effort?) Given the reasoning of the court, it almost appears as though Diamond may have succeeded in this constitutional challenge if he had chosen to do so at the point he was ordered to produce the correct finger.

It is clear that the district court permitted the state to take samples of all of Diamond’s fingerprints and thumbprints. The district court did not ask Diamond whether his prints would unlock the cellphone or which print would unlock it, nor did the district court compel Diamond to disclose that information. There is no indication that Diamond would have been asked to do more had none of his fingerprints unlocked the cellphone. Diamond himself asked which finger the detectives wanted when he was ready to comply with the order, and the detectives answered his question. Diamond did not object then, nor did he bring an additional motion to suppress the evidence based on the exchange that he initiated.

And so, in first decision of its kind for this Appeals Court, the precedent established is that fingerprints are less protective of defendants' Fifth Amendment rights than passwords. Permalink

♲ Technology+%7C+The+Guardian 2017-01-13 11:00:16:

WhatsApp backdoor allows snooping on encrypted messages Exclusive: Privacy campaigners criticise WhatsApp vulnerability as a ‘huge threat to freedom of speech’ and warn it could be exploited by government agencies A security backdoor that can be used to allow Facebook and others to intercept and read encrypted messages has been found within its WhatsApp messaging service. Facebook claims that no one can intercept WhatsApp messages, not even the company and its staff, ensuring privacy for its billion-plus users. But new research shows that the company could in fact read messages due to the way WhatsApp has implemented its end-to-end encryption protocol. Continue reading...

♲ Ars+Technica 2017-01-13 22:20:12:

San Francisco sues local drone maker, drone maker then shuts down Enlarge (credit: Lily Robotics) A San Francisco-based drone startup that raised $34 million in pre-orders folded on Thursday, the same day the company, Lily Robotics, was sued by the local district attorney in county court. The city accuses Lily Robotics of engaging in false advertising and unlawful business practices. The company's story is reminiscent of the now-defunct Torquing Group, a Wales-based firm that raised $3.4 million (the largest European Kickstarter project to date) to build a drone called the Zano that ended up not going anywhere, either. In 2015, Lily Robotics released a slick YouTube promo video demonstrating its drone, calling it the world’s first “throw-and-shoot camera.” It received widespread, breathless coverage from various other media outlets, ranging from Wired to TechCrunch. Lily Robotics' founders were named on the “Forbes 30 under 30” list in 2015. And in addition to its pre-orders, the startup took in $15 million in venture capital, according to CrunchBase. Read 4 remaining paragraphs | Comments

♲ Technology+%7C+The+Guardian 2016-10-21 21:30:58:

Google’s ad tracking just got creepier. Here’s how to disable it Google in June quietly deleted a clause in its privacy settings that said it would not combine cookie information with personal information without consent Google has changed the way it tracks users across the internet so that it can now link people’s personally identifiable information from Gmail, YouTube and other accounts with their browsing records across the web. The company had previously pledged to keep these two data sets separate to protect individuals’ privacy. As first reported by Propublica, Google quietly updated its privacy settings in June to delete a clause that said “we will not combine DoubleClick cookie information with personally identifiable information unless we have your opt-in consent”. Continue reading...

♲ The+Intercept 2016-09-28 14:00:52:

Apple Logs Your iMessage Contacts — and May Share Them with Police Apple promises that your iMessage conversations are safe and out of reach from anyone other than you and your friends. But according to a document obtained by The Intercept, your blue-bubbled texts do leave behind a log of which phone numbers you are poised to contact and shares this (and other potentially sensitive metadata) with law enforcement when compelled by court order. Every time you type a number into your iPhone for a text conversation, the Messages app contacts Apple servers to determine whether to route a given message over the ubiquitous SMS system, represented in the app by those déclassé green text bubbles, or over Apple’s proprietary and more secure messaging network, represented by pleasant blue bubbles, according to the document. Apple records each query in which your phone calls home to see who’s in the iMessage system and who’s not. This log also includes the date and time when you entered a number, along with your IP address — which could, contrary to a 2013 Apple claim that “we do not store data related to customers’ location,” identify a customer’s location. Apple is compelled to turn over such information via court orders for of systems known as “pen registers” or “tap and trace devices,” orders that are not particularly onerous to obtain, requiring only that a government lawyer represent they are “likely” to obtain information whose “use is relevant to an ongoing criminal investigation.” Apple confirmed to The Intercept that it only retains these logs for a period of 30 days, though court orders of this kind can typically be extended in additional 30-day periods, meaning a series of monthlong log snapshots from Apple could be strung together by police to create a longer list of whose numbers someone has been entering. The Intercept received the document about Apple’s Messages logs as part of a larger cache originating from within the Florida Department of Law Enforcement’s Electronic Surveillance Support Team, a state police agency that facilitates police data collection using controversial tools like the Stingray, along with conventional techniques like pen registers. The document, titled “iMessage FAQ for Law Enforcement,” is designated for “Law Enforcement Sources” and “For Official Use Only,” though it’s unclear who wrote it or for what specific audience — metadata embedded in the PDF cites an author only named “mrrodriguez.” (The term “iMessages” refers to an old name for the Messages app, a name still commonly used to refer to it.) Phone companies routinely hand over metadata about calls to law enforcement in response to pen register warrants. But it’s noteworthy that Apple is able to provide information on iMessage contacts under such warrants given that Apple and others have positioned the messaging platform as a particularly secure alternative to regular texting. The document like a fairly standard overview that one might forward to a clueless parent (questions include “How does it work?” and “Does iMessage use my cellular data plan?”), until the final section, “What will I get if I serve Apple with a [Pen Register/Tap and Trace] court order for an iMessage account?”: This is a lot of bullet points to say one thing: Apple maintains a log of phone numbers you’ve entered into Messages, and potentially elsewhere on an Apple device, like the Contacts app, even if you never end up communicating with those people. The document implies that Messages transmits these numbers to Apple when you open a new chat window and select a contact or number with whom to communicate, but it’s unclear exactly when these queries are triggered, and how often—an Apple spokesperson confirmed only that the logging information in the iMessage FAQ is “generally accurate,” but declined to elaborate on the record. Illustration: Selman Design for The Intercept Apple provided the following statement:

“When law enforcement presents us with a valid subpoena or court order, we provide the requested information if it is in our possession. Because iMessage is encrypted end-to-end, we do not have access to the contents of those communications. In some cases, we are able to provide data from server logs that are generated from customers accessing certain apps on their devices. We work closely with law enforcement to help them understand what we can provide and make clear these query logs don’t contain the contents of conversations or prove that any communication actually took place.”

And it’s true, based on the sample information provided in the FAQ, that Apple doesn’t appear to provide any indication whatsoever that an iMessage conversation took place. But a list of the people you choose to associate with can be just as sensitive as your messages with those people. It requires little stretching of the imagination to come up with a scenario in which the fact that you swapped numbers with someone at some point in the past could be construed as incriminating or compromising. Andrew Crocker, an attorney with the Electronic Frontier Foundation, said the document prompted further questions:

“How often are lookups performed? Does opening [an iMessage] thread cause a lookup? Why is Apple retaining this information?”

The Florida Department of Law Enforcement did not return a request for comment. The fact that Apple is able and willing to help the government map the communications networks of its users doesn’t necessarily undermine the company’s posturing (and record) as a guardian of privacy, though this leaked document provides more detail about how the iMessages system can be monitored than has been volunteered in the past. Ideally, customers wouldn’t need to read documents marked “For Official Use Only” in order to know what information Apple may or may not disclose to the police. In a section of its website devoted to touting the privacy safeguards in its products, Apple claims that “your iMessages and FaceTime calls are your business, not ours… Unlike other companies’ messaging services, Apple doesn’t scan your communications, and we wouldn’t be able to comply with a wiretap order even if we wanted to.” In 2013, after Apple was revealed to be among the tech companies caught up in an NSA surveillance program known as PRISM, which tapped into customer information on the central servers of nine leading internet companies, the company released a rare statement regarding its “commitment to customer privacy,” insisting that it would be unable to share sensitive customer data even if it wanted to:

For example, conversations which take place over iMessage and FaceTime are protected by end-to-end encryption so no one but the sender and receiver can see or read them. Apple cannot decrypt that data. Similarly, we do not store data related to customers’ location, Map searches or Siri requests in any identifiable form.

Questions of how much Apple could or would aid police if asked vaulted back into headlines following the mass shooting in San Bernardino last year, which left the FBI in possession of the shooter’s iPhone, which it was unable initially to decrypt. Apple balked at demands that it help crack the phone, allowing it to enjoy a reputation as not just a maker of expensive electronics, but a determined privacy advocate. We need more technology companies that are willing to take public, principled stands in defense of our private lives, but these same companies should follow through with technical transparency, not just statements. Sign up for The Intercept Newsletter here. The post Apple Logs Your iMessage Contacts — and May Share Them with Police appeared first on The Intercept.

♲ The+Intercept 2016-09-12 18:33:47:

Long-Secret Stingray Manuals Detail How Police Can Spy on Phones Harris Corp.’s Stingray surveillance device has been one of the most closely-guarded secrets in law enforcement for more than 15 years. The company and its police clients across the United States have fought to keep information about the mobile-phone-monitoring boxes from the public against which they are used. The Intercept has obtained several Harris instruction manuals spanning roughly 200 pages and meticulously detailing how to create a cellular surveillance dragnet. Harris has fought to keep its surveillance equipment, which carry price tags in the low six figures, hidden from both privacy activists and the general public, arguing that information about the gear could help criminals. Accordingly, an older Stingray manual released under the the Freedom of Information Act to news website TheBlot.com last year was almost completely redacted. So too have law enforcement agencies at every level, across the country, evaded almost all attempts to learn how and why these extremely powerful tools are being used—though court battles have made it clear Stingrays are often deployed without any warrant. The San Bernardino Sheriff’s Department alone has snooped via Stingray, sans warrant, over 300 times. Richard Tynan, a technologist with Privacy International, told The Intercept that the “manuals released today offer the most up to date view on the operation of” Stingrays and similar cellular surveillance devices, with powerful capabilities that threaten civil liberties, communications infrastructure, and potentially national security. He noted that the documents show the “Stingray II” device can impersonate four cellular communications towers at once, monitoring up to four cellular provider networks simultaneously, and with an add-on can operate on so-called 2G, 3G, and 4G networks simultaneously.

“There really isn’t any place for innocent people to hide from a device such as this,” he wrote in an email message.

“As more of our infrastructure, homes, environment, and transportation are connected wirelessly to the internet, such technologies really do pose a massive risk to public safety and security.” And the Harris software isn’t just extremely powerful, Tynan adds, but relatively simple, providing any law enforcement agent with a modicum of computer literacy the ability to spy on large groups of people:

The ease with which the StingRay II can be used is quite striking and there do not seem to be any technical safeguards against misuse… It also allows the operator to configure virtually every aspect of the operation of the fake cell tower… The Gemini platform also allows for the logging and analysis of data to and from the network and “Once a message to/from any active subscriber in the Subscriber list is detected, Gemini will notify the user.” How many innocent communications of the public are analyzed during this process?

Tynan also raised questions about the extent to which Stingrays may be disrupting the communications infrastructure, including existing cellular towers. Harris declined to comment. In a 2014 letter to the FCC, the company argued that if the owner’s manuals were released under the Freedom of Information Act this would “harm Harris’ competitive interests” and that “criminals and terrorist [s]would have access to information that would allow them to build countermeasures.” But Stingrays are known for spying on low-level marijuana dealers and other domestic targets, not al Qaeda; as the Electronic Frontier Foundation’s Jennifer Lynch said in December, “I am not aware of any case in which a police agency has used a cell-site simulator to find a terrorist.” Meanwhile, it is already publicly known that the NSA uses Stingray-like devices to locate suspected terrorists as part of a system known as Gilgamesh. Nathan Wessler, an attorney with the ACLU, told The Intercept that “when the most likely ‘countermeasure’ is someone turning their phone off or leaving it at home, it is hard to understand how public release of a manual like this could cause harm.” And furthermore, says Wessler, “it is in the public interest to understand the general capabilities of this technology, so that lawmakers and judges can exercise appropriate oversight and protect people’s privacy rights.” The documents described and linked below, instruction manuals for the software used by Stingray operators, were provided to The Intercept as part of a larger cache believed to have originated with the Florida Department of Law Enforcement. Two of them contain a “distribution warning” saying they contain “Proprietary Information and the release of this document and the information contained herein is prohibited to the fullest extent allowable by law.” Although “Stingray” has become a catch-all name for devices of its kind, often referred to as “IMSI catchers,” the manuals include instructions for a range of other Harris surveillance boxes, including the Hailstorm, ArrowHead, AmberJack, and KingFish. They make clear the capability of those devices and the Stingray II to spy on cell phones by, at minimum, tracking their connection to the simulated tower, information about their location, and certain “over the air” electronic messages sent to and from them. Wessler added that parts of the manuals make specific reference to permanently storing this data, something that American law enforcement has denied doing in the past. One piece of Windows software used to control Harris’ spy boxes, software that appears to be sold under the name “Gemini,” allows police to track phones across 2G, 3G, and LTE networks. Another Harris app, “iDen Controller,” provides a litany of fine-grained options for tracking phones. A law enforcement agent using these pieces of software along with Harris hardware could not only track a large number of phones as they moved throughout a city but could also apply nicknames to certain phones to keep track of them in the future. The manual describing how to operate iDEN, the lengthiest document of the four at 156 pages, uses an example of a target (called a “subscriber”) tagged alternately as Green Boy and Green Ben: The documents also make clear just how easy it is to execute a bulk surveillance regime from the trunk of a car: a Gemini “Quick Start Guide”, which runs to 54 pages, contains an entire chapter on logging, which “enables the user to listen and log over the air messages that are being transmitted between the Base Transceiver Station (BTS) and the Mobile Subscriber (MS).” It’s not clear exactly what sort of metadata or content would be captured in such logging. The “user” here, of course, is a police officer. In order to maintain an uninterrupted connection to a target’s phone, the Harris software also offers the option of intentionally degrading (or “redirecting”) someone’s phone onto an inferior network, for example knocking a connection from LTE to 2G: A video of the Gemini software installed on a personal computer, obtained by The Intercept and embedded below, provides not only an extensive demonstration of the app but also underlines how accessible the mass surveillance code can be: Installing a complete warrantless surveillance suite is no more complicated than installing Skype. Indeed, software such as Photoshop or Microsoft Office, which require a registration key or some other proof of ownership, are more strictly controlled by their makers than software designed for cellular interception. “While this device is being discussed in the context of US law enforcement,” said Tynan, “this could be used by foreign agents against the US public and administration. It is no longer acceptable for our phones and mobile networks to be exploited in such an invasive and indiscriminate way.” Documents published with this article:

Gemini 3.3 Quick Start Guide

Gemini RayFish Controller R3.3.1 Release Notes

iDEN 2.4 Operator Manual

iDEN 2.4 Release Notes

Arrowhead 1.0.1 Release Notes

Sign up for The Intercept Newsletter here. The post Long-Secret Stingray Manuals Detail How Police Can Spy on Phones appeared first on The Intercept.

♲ Motherboard ([email protected]) :

Inventor of The Internet’s Most Terrifying Search Engine Shows Us How To Use It The internet isn’t just made of Facebook, Motherboard, 4chan and all your other favorite websites. There are thousands of devices, such as webcams, smart light bulbs, printers, and even smart homes, connected to it and there’s a special search engine that allows you to find them. It’s called Shodan and it’s a great tool to find insecure devices, so that people can fix them and make the internet safer. Shodan crawls the internet and collects all kind of stuff connected to the internet, from mundane smart fridges to industrial control systems. It’s a powerful tool, and you don’t really appreciate it until you use it yourself, or, better yet, until its inventor shows you what it can do. We met with Shodan’s creator John Matherly, who gave us a glimpse of all the crazy things you can find with Shodan. “There’s so many homes connected to the internet,” Shodan’s inventor John Matherly says. Check out the deleted scene above to learn about Shodan, and check out VICELAND’s documentary series CYBERWAR every Tuesday at 10:30 PM on VICELAND.

​One time, I misjudged the depth of a creek, stepped in, and was literally in over my head. Not that big of a problem, except I had various electronics in my backpack. As thousands (millions?) of peop

♲ Techdirt. :

Michael Bloomberg Comes Down On The Wrong Side Of The Crypto Wars: Supports Backdooring Encryption This is perhaps not surprising, but still disappointing. Former NYC mayor and current billionaire media/tech company boss Michael Bloomberg has come down on the wrong side of the "going dark" encryption fight. In a Wall Street Journal op-ed (possible paywall link) he scolds tech execs for daring to side with Apple over the FBI and the Justice Department on the question of backdooring encryption. Bloomberg does not appear to actually understand the issues at play.

The fireworks and parades this weekend will give Americans a chance to celebrate the nation’s independence from England and show their love of country. But true patriotism involves more than flying the flag—and more than paying taxes and casting ballots. It requires putting America’s needs above individual interests when national security and public safety are at stake. Generations of Americans have honored that principle, risking their lives to preserve a nation “conceived in Liberty,” as Lincoln remarked in his Gettysburg Address, “and dedicated to the proposition that all men are created equal.” Today, 1.3 million men and women serve in the military on active duty, often in dangerous situations overseas. Yet here at home, some executives in an industry that thrives on freedom—technology—are resisting government efforts to safeguard it. They are dangerously wrong.

Note the false framing here. Bloomberg is setting up the argument that backdooring encryption for the sake of the FBI/DOJ is "good for national security and public safety." He's wrong. It's not. It's not even close. It actually puts many more people at risk, because the only way to backdoor encryption effectively is to break that encryption and put everyone who uses it at much more risk. Yes, it means that the FBI/NSA won't be able to track some people, but it's a very small number of people, and they have other ways to track them without undermining the security of everyone else.

The freedom that Americans enjoy requires shared sacrifices, and not only by soldiers. “We the people” impose limits on our personal liberty to protect ourselves and those around us. We are free to speak our minds, but we cannot yell “Fire!” in a crowded theater. We are free to travel without restriction, but driving a vehicle requires a license, and boarding a plane requires official identification. We are free to smoke tobacco, but today in most states we cannot do so indoors.

This is also dangerously wrong. We've discussed this many times before, but the lame "we cannot yell fire in a crowded theater" line is simply incorrect. It's based on an ignorance of the actual law in that space (the court case where this statement was made is no longer the accepted standard under the law). It's also just a weak excuse for someone who is about to strip away other rights. It's basically a warning sign of someone who doesn't have a strong argument for why they want to strip away rights, so they'll make a misleading and incorrect statement claiming that you can't yell fire in a crowded theater (even though, in most cases, you actually can).

We also limit our right to privacy. The Fourth Amendment protects against “unreasonable searches and seizures,” but it also explicitly authorizes warrants based on probable cause. Every day, judges approve warrants authorizing searches of homes, cars and computers. Even our bodies can be subject to search warrants, as drunken-driving suspects learn when they attempt to refuse a blood test. Those suspected of other crimes may have their calls tapped and mail opened—all with the safeguard of an independent judiciary certifying the public need, to protect both our liberty and safety.

This is an especially intellectually dishonest move. He goes from "fire in a theater" to arguing that we already "limit our right to privacy" because judges issue warrants. But this is different. The 4th Amendment directly includes the warrant exception, unlike the First Amendment which includes no exception. And, really, many people question a lot of things that Bloomberg finds acceptable violations of privacy. That's not a huge surprise though. After all, as mayor, Bloomberg was a major supporter of the unconstitutional stop and frisk program that the police used under his watch... until a court threw it out. Of course, he also was against any transparency of his own administration or of the NYPD.

When Apple refused to unlock a cellphone used by one of the San Bernardino terrorists (and owned by his public employer), many in the tech industry came to the company’s defense. They argued, in effect, that they shouldn’t be forced to cooperate with a search warrant for one of their products, even though failure to comply could put more innocent lives at risk. Thankfully, the government was able to unlock the phone on its own. But next time, the public may not be so lucky. Imagine if the government is in possession of a cellphone that it has reason to believe contains information about an imminent hijacking—or an effort to detonate a dirty bomb. Should we allow the manufacturer to refuse a court order to unlock it?

This, again, totally misrepresents the situation. The issue was not the court order to unlock, but the fact that based on the encryption used on the phone, the only way to "unlock" it was to create a revamped operating system that undermined a number of key security features -- which would likely create much more risks for everyone. This was not a question of just turning a key as Bloomberg implies. The issue was not whether the government could just force a company to "unlock" an encrypted phone, but rather whether or not it could force them to build technology that deliberately undermines security. And, really, this stupid game of "but what about the next time..." is ridiculous. THERE IS ALWAYS SECRET INFO THAT LAW ENFORCEMENT DOESN'T KNOW ABOUT. And it's not the end of the world. There is information in people's heads. There is information that they already destroyed. And somehow, law enforcement survives. The fact that some information may get scrambled by encryption is like that other kind of info. It's not the end of the world. In fact, we deliberately designed our legal system with the recognition that law enforcement does not have an automatic right to every bit of information.

Of course not. We are a nation of laws, and no industry is above them. The Constitution doesn’t carve out an exception for tech companies.

This is the most frustrating line in the article, because it's complete bullshit. No one is arguing they're above the law. Exactly the opposite. They're questioning whether or not having a valid warrant would then require tech companies to construct a new tool to deliberately undermine security. Being "above the law" is doing things like deliberately hiding documents and emails from the public despite being legally required to reveal them. Being above the law is doing things like refusing to accept a decision of the City Council against your unconstitutional policies. Those were things that Mayor Bloomberg did. What the tech companies are doing is not above the law at all.

Yet Apple responded to the investigation with a troubling announcement: In the future, phones will be designed to prevent even Apple from opening them, just as the makers of some messaging services have already done. Such a move would be an unprecedented rejection of public authority and a potentially catastrophic blow to public safety. The prospect of criminals and terrorists communicating with phones beyond the reach of government search warrants should send a shiver down the spine of every citizen.

This is again a misrepresentation of reality. Apple had already said that the phones would be designed that way well before this investigation. And the reason they did so was not to "reject public authority," but rather because it's a better way to protect public safety. Don't ask me, ask the NYPD who used to go around telling people to encrypt their phones to make them less appealing to thieves, who steal thousands upon thousands of those devices all the time, often seeking to get the info that's on the devices.

Google, Facebook, Snapchat and WhatsApp are all working to increase encryption in ways that will make it impossible for the courts and law-enforcement officials to obtain their users’ data. They argue that if they are forced to comply with government requests for data, terrorists will simply choose open-source encryption apps instead. But lone wolves are not always that sophisticated. Those that are may have no regard for investigations following their death. And for those that do want to cover their tracks: Why should we help them?

Again, the efforts they're making are not to keep law enforcement out, it's to keep criminals out. It's about protecting the public. And, as for "lone wolves" not always being "that sophisticated," that's exactly why this shouldn't be a huge concern. Because as we've noted time and time again, unless you're really good, you're probably going to make a mistake when you try to encrypt stuff, and you'll leak out plenty of info for law enforcement. So if they're really not that sophisticated, none of this is actually a problem.

It’s true that encryption may make it harder for repressive regimes to crack down on dissent, but it also makes it harder for democratic societies to protect themselves against terrorists and criminals. We can work to undermine repressive regimes in ways that do not compromise our own safety, and we should expect tech leaders to help lead the way.

Again, this is misrepresenting why encryption is so important. It DOES NOT make it harder for democratic societies to protect themselves against terrorists or criminals. It does the exact opposite, by providing the tools for people to better protect themselves against both of those things.

It’s worth remembering that the U.S. taxpayers, beginning under President Eisenhower, funded the R&D that led to the development of the internet and other technological advances without which these companies would not exist. And while many of them claim to be concerned about their customers’ privacy, let’s also remember that many turn around and sell their customers’ personal information to advertisers. If anyone thinks they are more concerned about privacy than profits, I have a bridge to sell you.

Again, this is not the actual argument. Bloomberg is throwing out so many strawmen, you'd think that they were on clearance. The fact that the government helped fund the development of some of these technologies is kind of irrelevant. It also helped fund plenty of research into encryption as well. So what? That doesn't mean we should undermine it all and make us all less safe. And, the whole "but companies sell your info to advertisers" point is a complete red herring. Having stronger encryption actually gives individuals more ability to take control over their own info and prevent that kind of thing. Sure, companies are mostly interested in their own profits, as, I assume, is Bloomberg's own company. But that's why they're building better encryption as well. Because they know that making their customers safer and keeping them from having devices stolen or hacked creates a better product.

When America entered World War I, Thomas Edison devoted most of his time to naval research. His work led to various military inventions and improvements, including instruments to detect torpedoes. It is perhaps too idealistic to expect Silicon Valley’s best minds to give up their jobs to serve the government in the fight against terrorism. But a little cooperation shouldn’t be too much to ask.

Lots of people in Silicon Valley are proactively helping in the fight against terrorism. It's complete bullshit to argue that because we think that working encryption is necessary that people are refusing to help the government. The whole point is that breaking encryption doesn't help stop terrorism. It doesn't help stop crime. It puts us all at more risk. It's too bad Bloomberg doesn't have anyone working for him who could have explained this to him before he sounded off so ignorantly in the WSJ. But, really, if Bloomberg thinks that tech companies need to build compromised, backdoored encryption, here's a solution: he can put some of his billions towards building just such a product, and see what the market thinks of it. If he's right, and this is what the public needs to be safe, won't he be making tons of profits? After all, where else is he getting that bridge he wants to sell us... Source

♲ Techdirt. :

Google Comes Down On The Wrong Side Of The TPP This is extremely unfortunate, but not surprising. Google has made some noise sounding supportive of the TPP over the past year or so, and now it's put out a blog post strongly supporting the agreement, and claiming that it's good for intellectual property and the internet. The company is wrong. The statement is right about a big problem on the internet -- the growing restrictions and limitations on the internet in different jurisdictions:

But Internet restrictions -- like censorship, site-blocking, and forced local storage of data -- threaten the Internet’s open architecture. This can seriously harm established businesses, startups trying to reach a global audience, and Internet users seeking to communicate and collaborate across national borders.

Yes, absolutely. And the TPP only tackles a tiny part of that -- and in some ways makes other aspects worse. But that's not what Google says. Instead, it misrepresents what the TPP really does. The post is correct about the issue of cross-border data flows and localization -- and I agree that these are good things -- but they're small parts of an agreement that has so many other problems:

The Internet has revolutionized how people can share and access information, and the TPP promotes the free flow of information in ways that are unprecedented for a binding international agreement. The TPP requires the 12 participating countries to allow cross-border transfers of information and prohibits them from requiring local storage of data. These provisions will support the Internet’s open architecture and make it more difficult for TPP countries to block Internet sites -- so that users have access to a web that is global, not just local.

It's after that where the post goes off the rails:

The TPP provides strong copyright protections, while also requiring fair and reasonable copyright exceptions and limitations that protect the Internet. It balances the interests of copyright holders with the public’s interest in the wider distribution and use of creative works -- enabling innovations like search engines, social networks, video recording, the iPod, cloud computing, and machine learning. The endorsement of balanced copyright is unprecedented for a trade agreement. The TPP similarly requires the kinds of copyright safe harbors that have been critical to the Internet’s success, with allowances for some variation to account for different legal systems.

This is just wrong, and it's the most frustrating part of the post. The TPP expands copyright rules to ridiculous levels in many countries, including extending copyright terms at a time when there is no sound basis for advocating for extending copyright terms. And the "requiring fair and reasonable copyright exceptions and limitations that protect the Internet" is just wrong. Yes, it's true that for the first time the USTR actually acknowledges user rights in such an agreement. In the past, all such trade agreements only focused on expanding copyright holder rights. So you can argue that's progress. But the details showed that it's not creating "fair and reasonable copyright exceptions and limitations," but instead pushing a misleading tool that will limit the way countries can explore fair use, and (even more important) makes the fair use stuff optional. Google claiming that it requires such things is just... wrong.

The TPP advances other important Internet policy goals. It prohibits discrimination against foreign Internet services, limits governments’ ability to demand access to encryption keys or other cryptographic methods, requires pro-innovation telecom access policies, prohibits customs duties on digital products, requires proportionality in intellectual property remedies, and advances other key digital goals.

Yes, this part is also a good thing that it's in the TPP, but (1) it's so outweighed by bad things that it's really not that big of a deal and (2) the issues around encryption and telecom access policies are not nearly as clear cut in the TPP as this blog post implies, nor are they necessary to do via the TPP process. As I've said before, I'm a supporter of free trade, generally (unlike many who oppose the TPP). But the TPP is not about free trade, other than at the margins. There's so much in there that's about blatant protectionism and supporting certain business models over others. Of course, that's how the trade game is played these days. Companies get big enough to influence the USTR to advocate for closed room deals that favor them. And Google is big enough to play that game. This public support of the TPP is a part of that game, but it's unfortunate. The company could have and should have taken a stand on this, noting the things that are important in the TPP, but also being honest about the disastrous IP section and other problems in the agreement (such as the corporate sovereignty provisions that will almost certainly come back to bite Google and others). There are good trade agreements to be made. And they can focus on things like protecting a free and open internet, and creating important safe harbors for communication and innovation. But the TPP is not that agreement -- and it's disappointing that Google has decided to jump on board, rather than highlight the very clear and very real problems of the TPP. Source

♲ Motherboard ([email protected]) :

Court: Cops Need a Warrant to Open Your Phone, Even Just to Look at the Screen In a major decision back in 2014, the Supreme Court finally ruled that police need a warrant to search someone’s cellphone when making an arrest. That case, Riley v. California, was a major privacy victory. Now, it's being interpreted by a federal court in Illinois to mean that even opening a phone to look at the screen qualifies as a “search” and requires a warrant. The Illinois case involves a sting operation that ensnared Demontae Bell, an alleged drug dealer accused of illegal possession of an AK-47 assault rifle. An officer testified that while interrogating Bell he pulled out a confiscated flip phone and opened it, revealing a picture of the rifle, which Bell had set as his home screen's wallpaper. That was then used as grounds for a warrant to search Bell's phone for metadata about when and where the photo was taken. The officer claimed he opened the phone in order to turn it off. But on Wednesday, the judge ruled police have no right to open a suspect's phone and look at the screen without first getting a warrant, even if it's just to turn it off, since the Riley case clearly established doing so is a “search” under the Fourth Amendment. “Officer Sinks' opening of Bell's cell phone exceeded a 'cursory inspection' because he exposed to view concealed portions of the object—i.e., the screen,” wrote Judge James E. Shahid. “[B]ecause Officer Sinks had to manipulate the phone to view the picture on the screen, that picture was by definition not in 'plain view'.” That suggests that even if your device isn't locked with a passcode, a cop wouldn't be allowed to turn on the screen and look for incriminating notifications or messages without a search warrant. The Supreme Court did say there are “exigent circumstances” for allowing warrantless searches, however, including imminent threats to officer safety (checking if there's a razor blade concealed in the phone's case, for example) and preventing destruction of evidence (preventing the phone from receiving a remote wiping command). “Yet neither the government's response, nor the warrant affidavit, asserted that the officer in this case opened Bell's cell phone out of concern for officer safety or preservation of evidence,” Judge Shahid wrote. Thus, “The search of Bell's cell phone violated the Fourth Amendment prohibition against unreasonable searches and seizures.” Nevertheless, the judge denied Bell's motion to suppress evidence from the illegal search, reasoning that based on other testimony given about Bell's illegal rifle, “the photo would have ultimately been discovered.”

♲ Technology+%7C+The+Guardian :

From Uber to Eric Schmidt, tech is closer to the US government than you'd think Twitter was scrabbling to defend the appointment of a Chinese head with government ties, yet US tech has a busy revolving door with its own government What’s worse for a Silicon Valley executive: ties to the Chinese military or friends in the US Defense Department? Twitter found itself confronting that question this week after it hired Kathy Chen, a former engineer for the People’s Liberation Army (PLA), to head up ad sales and business development in China, Hong Kong and Taiwan. Internet freedom activists and Chinese dissidents, who have to skirt Beijing’s digital censors to use Twitter, said it was a betrayal. Continue reading...