Categories
Links

Turkey coup plotters’ use of ‘amateur’ app helped unveil their network

The Guardian:

A senior Turkish official said Turkish intelligence cracked the app earlier this year and was able to use it to trace tens of thousands of members of a religious movement the government blames for last month’s failed coup.

Members of the group stopped using the app several months ago after realising it had been compromised, but it still made it easier to swiftly purge tens of thousands of teachers, police, soldiers and justice officials in the wake of the coup.

Starting in May 2015, Turkey’s intelligence agency was able to identify close to 40,000 undercover Gülenist operatives, including 600 ranking military personnel, by mapping connections between ByLock users, the Turkish official said.

However, the Turkish official said that while ByLock helped the intelligence agency identify Gülen’s wider network, it was not used for planning the coup itself. Once Gülen network members realised ByLock had been compromised they stopped using it, the official said.

But intelligence services are policing agencies are still ‘Going Dark’…

Categories
Links

IMSI Catcher Report Calls for Transparency, Proportionality, and Minimization Policies – The Citizen Lab

IMSI Catcher Report Calls for Transparency, Proportionality, and Minimization Policies:

The Citizen Lab and CIPPIC are releasing a report, Gone Opaque? An Analysis of Hypothetical IMSI Catcher Overuse in Canada, which examines the use of devices that are commonly referred to as ‘cell site simulators’, ‘IMSI Catchers’, ‘Digital Analyzers’, or ‘Mobile Device Identifiers’, and under brand names such as ‘Stingray’, DRTBOX, and ‘Hailstorm’. IMSI Catchers are a class of of surveillance devices used by Canadian state agencies. They enable state agencies to intercept communications from mobile devices and are principally used to identify otherwise anonymous individuals associated with a mobile device and track them.

Though these devices are not new, the ubiquity of contemporary mobile devices, coupled with the decreasing costs of IMSI Catchers themselves, has led to an increase in the frequency and scope of these devices’ use. Their intrusive nature, as combined with surreptitious and uncontrolled uses, pose an insidious threat to privacy.

This report investigates the surveillance capabilities of IMSI Catchers, efforts by states to prevent information relating to IMSI Catchers from entering the public record, and the legal and policy frameworks that govern the use of these devices. The report principally focuses on Canadian agencies but, to do so, draws comparative examples from other jurisdictions. The report concludes with a series of recommended transparency and control mechanisms that are designed to properly contain the use of the devices and temper their more intrusive features.

I’m not going to lie: after working on this with my colleague, Tamir Israel, for 12 months it was absolutely amazing to publicly release this report. What started as a 1,500 word blog post meant to put defense lawyers on notice of some new legislation transmogrified into a 130 page report that is the most comprehensive legal analysis of these devices that’s been done to date. It’s going to be interesting to see what the effects of it are for cases currently being litigated in Canada and around the world!

Categories
Links

Location Privacy: The Purview of the Rich and Indigent

Krebs on Security:

In Texas, the EFF highlights how state and local law enforcement agencies have free access to ALPR equipment and license plate data maintained by a private company called Vigilant Solutions. In exchange, police cruisers are retrofitted with credit-card machines so that law enforcement officers can take payments for delinquent fines and other charges on the spot — with a 25 percent processing fee tacked on that goes straight to Vigilant. In essence, the driver is paying Vigilant to provide the local cops with the technology used to identify and detain the driver.

“The ‘warrant redemption’ program works like this,” the EFF wrote. “The agency is given no-cost license plate readers as well as free access to LEARN-NVLS, the ALPR data system Vigilant says contains more than 2.8-billion plate scans and is growing by more than 70-million scans a month. This also includes a wide variety of analytical and predictive software tools. Also, the agency is merely licensing the technology; Vigilant can take it back at any time.”

That’s right: Even if the contract between the state and Vigilant ends, the latter gets to keep all of the license plate data collected by the agency, and potentially sell or license the information to other governments or use it for other purposes.

Another case of the private surveillance sector overcoming state institutions, and to the detriment of citizens’ rights to privacy.

Categories
Writing

The Fourth Amendment in the Information Age

Litt’s article focuses on finding new ways of conceptualizing privacy such that the current activities of intelligence agencies and law enforcement organizations are made legal, and thus shift the means by which their activities are legally and constitutionally evaluated. While his proposal to overturn much of the third-party doctrine coheres with the positions of many contemporary scholars his suggested replacement — that we should no longer focus on collecting data, but on use of collected data — would eviscerate basic privacy protections. In particular, I think that it’s important we not just ignore the ‘search’ aspect of fourth amendment law: we need to recalibrate what a search is within the context of today’s reality. And that doesn’t mean just letting the government collect with fewer baseline restrictions but instead modifying what a ‘search’ is itself.

The core aspects of the article that give a flavour of the entire argument are:

I suggest that—at least in the context of government acquisition of digital data—we should think about eliminating the separate inquiry into whether there was a “reasonable expectation of privacy” as a gatekeeper for Fourth Amendment analysis. In an era in which huge amounts of data are flowing across the Internet; in which people expose previously unimagined quantities and kinds of information through social media; in which private companies monetize information derived from search requests and GPS location; and in which our cars, dishwashers, and even light bulbs are connected to the Internet, trying to parse out the information in which we do and do not have a reasonable expectation of privacy strikes me as a difficult and sterile task of line-drawing. Rather, we should simply accept that any acquisition of digital information by the Government implicates Fourth Amendment interests.

After all, the concept of a “reasonable expectation of privacy” as a talisman of Fourth Amendment protection is not found in the text of the Fourth Amendment itself, which says merely that “[t]he right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated.” It was only in 1967, in Katz, that the Supreme Court defined a search as the invasion of a “reasonable expectation of privacy.” Katz revisited Olmstead v. United States after 40 years; the accelerating pace of modern technological change suggests to me that fifty years is not too soon to revisit Katz. My proposal is that the law should focus on determining what is unreasonable rather than on what is a search.

What I have suggested, however, is that—at least in the area of government collection of digital data—we eliminate the preliminary analysis of whether someone has a reasonable expectation of privacy in the data and proceed directly to the issue of whether the collection is reasonable; that the privacy side of that analysis should be focused on concrete rather than theoretical invasions of privacy; and that courts in evaluating reasonableness should look at the entirety of the government’s activity, including the “back end” use, retention restrictions, and the degree of transparency, not just the “front end” activity of collection.

Categories
Links

Researchers Are Chipping and Surveilling NYC’s Rats

Researchers Are Chipping and Surveilling NYC’s Rats:

Parson’s and his team use traps baited with pheromones—not food—to capture the rats. They know where to place the traps because rats frequently navigate the dark tunnels where they live not with their eyes, but with their fur. Rubbing themselves against walls creates a trail that’s visible with an ultraviolet dark light. According to the study the trail glows blue–white if it’s fresh, yellow–white if old. The trap has a sensor attached to it that alerts the researcher by cell phone when a rat has been caught.

Once a rat has been caught, a mobile lab is deployed. Inside researchers wearing thick gloves render the rat unconscious by dipping the rat trap in a plastic induction container filled with isoflurane, a kind of ether. An unconscious rat is an easy rat to draw specimens from. Before it wakes up, the rat blood is drawn and an RFID chip is implanted.

An interesting bit of news in addition to previous writing on rats.

Categories
Links Writing

Rape Culture Is Surveillance Culture

Scaachi Koul has written a piece that draws on her own experiences of men attempting to prey on her because she is a woman and while she engages in socially normal behaviour. Men who sought to prey on her were explicit in attempting to determine how they could take advantage, drug, or otherwise use her body without attempting to secure her genuine consent.

Koul’s writing makes clear the very normal, human, experiences of being targeted by men and how the intent of those attackers and potential attacker is normalized in contemporary society. The result is that Koul — and other women just like her — must treat social scenarios as a possible environments for attack or abuse. Her lived reality thus turns even seemingly benign situations into ones filled with risk. Koul’s ability to write as clearly and powerfully as she does should make clear to anyone who absolves sexual abuse on grounds of drinking that alcohol is not the problem: men who have internalized their own privilege and power and treat women as objects around them to be used are the problem.

Categories
Aside Links

Meet Moxie Marlinspike, the Anarchist Bringing Encryption to All of Us

Meet Moxie Marlinspike, the Anarchist Bringing Encryption to All of Us:

In March, Brazilian police briefly jailed a Facebook exec after WhatsApp failed to comply with a surveillance order in a drug investigation. The same month, The New York Times revealed that WhatsApp had received a wiretap order from the US Justice Department. The company couldn’t have complied in either case, even if it wanted to. Marlin­spike’s crypto is designed to scramble communications in such a way that no one but the people on either end of the conversation can decrypt them (see sidebar). “Moxie has brought us a world-class, state-of-the-art, end-to-end encryption system,” WhatsApp cofounder Brian Acton says. “I want to emphasize: world-class.”

For Marlinspike, a failed wiretap can mean a small victory. A few days after Snowden’s first leaks, Marlin­spike posted an essay to his blog titled “We Should All Have Something to Hide,” emphasizing that privacy allows people to experi­ment with lawbreaking as a precursor for social progress. “Imagine if there were an alternate dystopian reality where law enforcement was 100 percent effective, such that any potential offenders knew they would be immediately identified, apprehended, and jailed,” he wrote. “How could people have decided that marijuana should be legal, if nobody had ever used it? How could states decide that same-sex marriage should be permitted?”

We live in a world where mass surveillance is a point of fact, not a fear linked with dystopic science fiction novels. Moxie’s work doesn’t blind the watchers but it has let massive portions of the world shield the content of their communications – if not the fact they are communicating in the first place – from third-parties seeking to access those communications. Now unauthorized parties such a government agencies are increasingly being forced to target specific devices, instead of the communications networks writ large, which may have the effects of shifting state surveillance from that which is mass to that which is targeted. Such a consequence would be a major victory for all persons, regardless of whether they live in a democratic state or not.

Categories
Links

Policy – Privacy Paranoia: Is Your Smartphone Spying On You?

Policy – Privacy Paranoia: Is Your Smartphone Spying On You?:

Privacy alarmism is one act in a bigger spectacle. In alarmists’ minds, something could go terribly wrong, and although it never has nor is it likely to happen, we should change the world and imposed new political and bureaucratic order to prepare for it. Privacy concerns in general are fertile breeders of this pattern, and have already inflicted on us useless and expensive laws like HIPPA and FERPA. Now, privacy alarmism has set its sights on the biggest prize: the shrinking of Big Data.

While I’m glad that the author has apparently never suffered an issue linked to a privacy infringement, the same cannot be said for an enormous percentage of the world’s population. Mass intrusion, with and without consent, into communications privacy is a prominent issue internationally because of how private and public bodies alike exploit information that is collected.

We are functionally experimenting on the entire population when collecting and applying math to enormous datasets: to say that there has been no harm, ever, to date is possible. But doing so functionally depends on ignoring the lived reality of many of the persons impacted by big data and digital technology.

Categories
Links

The RCMP Is Trying to Sneak Facial and Tattoo Recognition Into Canada

The RCMP Is Trying to Sneak Facial and Tattoo Recognition Into Canada:

“That the RCMP is looking at purchasing this kind of capability is in line with what the FBI and other [law enforcement agencies] around the world are doing,” said Christopher Parsons, a postdoctoral fellow at Toronto-based surveillance research hub Citizen Lab.

A previously published RCMP document notes that all of the new system’s scanners for fingerprints and facial images “must have undergone testing by the FBI and be listed on the FBI Certified Products List.”

“However,” Parsons continued, “in all of those jurisdictions there are significant privacy concerns, concerns about the general efficacy of the technology, concerns about whether too much data is collected in the first place, and concerns linked to the risks associated with information sharing between departments.”

The FBI’s biometric database, called the Next Generation Identification (NGI), has been widely criticized by civil rights groups such as the Electronic Frontier Foundation and the American Civil Liberties Union due to the potential for abuse by officers. As numerous incidents in the UK and US have shown, police are sometimes unable to resist the urge to dip into a database of personal information to settle their own very personal scores.

There may be an additional privacy risk in Canada, Parsons wrote, thanks to recent legislation that made it even easier for federal agencies to share information. A January 2016 email sent to S/Sgt. Michael Leben, manager of RCMP latent fingerprint operations in Ottawa, states that the force’s new AFIS system is part of a joint venture with Canada Border Services Agency to identify people entering Canada.

The RCMP has a bid out where companies would have to be able to add-on facial recognition capabilities to the primary fingerprint-biometric system. And the RCMP currently lacks the authority to engage in such facial and bodily recognition. But that’s not stopping it from planning for the future…

Categories
Links

Over 100 Snooping Tor Nodes Have Been Spying on Dark Web Sites

Interesting research:

By setting up honeypots in the Tor network, Guevara Noubir, a professor from the College of Computer and Information Science at Northeastern University, and Amirali Sanatinia, a PhD candidate also from Northeastern, discovered an armada of Tor hidden service directories that are spying on dark web sites. These modified nodes allow whoever is behind them—perhaps law enforcement, hackers or other researchers—to find the addresses of sites that are supposed to be secret. The pair will be presenting their research at the Def Con hacking conference in August.

People who want to hunt out dark web sites “go through the code and do the modifications to be able to log the .onions, and then visit them,” Noubir told Motherboard in a phone call.

Cops could do this to find new child pornography sites, or hackers to hunt fresh targets. Noubir pointed out that there are plenty of companies that sell dark web intelligence too, so perhaps they could be setting up HSDirs.

The Tor network is amongst the most secure ways of browsing the Internet anonymously. But this research demonstrates that using the service doesn’t guarantee your anonymity.