Edward Snowden’s E-Mail Provider Defied FBI Demands to Turn Over Crypto Keys, Documents Show

 http://www.wired.com/threatlevel/2013/10/lavabit_unsealed/

The U.S. government in July obtained a search warrant demanding that Edward Snowden’s e-mail provider, Lavabit, turn over the private SSL keys that protected all web traffic to the site, according to to newly unsealed documents.

The July 16 order came after Texas-based Lavabit refused to circumvent its own security systems to comply with earlier orders intended to monitor a particular Lavabit user’s metadata, defined as “information about each communication sent or received by the account, including the date and time of the communication, the method of communication, and the source and destination of the communication.”

The name of the target is redacted from the unsealed records, but the offenses under investigation are listed as violations of the Espionage Act and theft of government property — the exact charges that have been filed against NSA whistleblower Snowden in the same Virginia court.

The records in the case, which is now being argued at the 4th U.S. Circuit Court of Appeals, were unsealed today by a federal judge in Alexandria, Virginia. They confirm much of what had been suspected about the conflict between the pro-privacy e-mail company and the federal government, which led to Lavabit voluntarily closing in August rather than compromise the security it promised users.

The filings show that Lavabit was served on June 28 with a so-called “pen register” order requiring it to record, and provide the government with, the e-mail “from” and “to” lines on every e-mail, as well as the IP address used to access the mailbox. Because they provide only metadata, pen register orders can be obtained without “probable cause” that the target has committed a crime.

In the standard language for such an order, it required Lavabit to provide all “technical assistance necessary to accomplish the installation and use of the pen/trap device”

A conventional e-mail provider can easily funnel email headers to the government in response to such a request. But Lavabit offered paying customers a secure email service that stores incoming messages encrypted to a key known only to that user. Lavabit itself did not have access.

Lavabit founder Ladar Levison balked at the demand, and the government filed a motion to compel Lavabit to comply. Lavabit told the feds that the user had “enabled Lavabit’s encryption services, and thus Lavabit would not provide the requested information,” the government wrote.

“The representative of Lavabit indicated that Lavabit had the technical capability to decrypt the information, but that Lavabit did not want to ‘defeat [its] own system,’” the government complained.
U.S. Magistrate Judge Theresa Buchanan immediately ordered Lavabit to comply, threatening Levison with criminal contempt — which could have potentially put him in jail.

By July 9, Lavabit still hadn’t defeated its security for the government, and prosecutors asked for a summons to be served for Lavabit, and founder Ladar Levison, to be held in contempt “for its disobedience and resistance to these lawful orders.”

A week later, prosecutors upped the ante and obtained the search warrant demanding “all information necessary to decrypt communications sent to or from the Lavabit e-mail account [redacted] including encryption keys and SSL keys.”

With the SSL keys, and a wiretap, the FBI could have decrypted all web sessions between Lavabit users and the site, though the documents indicate the bureau still trying only to capture metadata on one user.

Levison went to court to fight the demand on August 1, in a closed-door hearing before Claude M. Hilton, Senior U. S. District Court Judge for the Eastern District of Virginia.

“The privacy of … Lavabit’s users are at stake,” Lavabit attorney Jesse Binnall told Hilton. “We’re not simply speaking of the target of this investigation. We’re talking about over 400,000 individuals and entities that are users of Lavabit who use this service because they believe their communications are secure. By handing over the keys, the encryption keys in this case, they necessarily become less secure.”

Courtroom sketch of Claude Hilton in federal court in Alexandria, Va. in 2004. Image: AP/Dana Verkouteren

By this point, Levison was evidently willing to comply with the original order, and modify his code to intercept the metadata on one user. But the government was no longer interested.

“Anything done by Mr. Levison in terms of writing code or whatever, we have to trust Mr. Levison that we have gotten the information that we were entitled to get since June 28th,” prosecutor James Trump told the judge. “He’s had every opportunity to propose solutions to come up with ways to address his concerns and he simply hasn’t.”

“We can assure the court that the way that this would operate, while the metadata stream would be captured by a device, the device does not download, does not store, no one looks at it,” Trump said. “It filters everything, and at the back end of the filter, we get what we’re required to get under the order.”

“So there’s no agents looking through the 400,000 other bits of information, customers, whatever,” Trump added. “No one looks at that, no one stores it, no one has access to it.”

“All right,” said Hilton. “Well, I think that’s reasonable.”

Hilton ruled for the government. “[The] government’s clearly entitled to the information that they’re seeking, and just because you-all have set up a system that makes that difficult, that doesn’t in any way lessen the government’s right to receive that
information just as they could from any telephone company or any other e-mail source that could provide it easily,” said Hilton.

The judge also rejected Lavabit’s motion to unseal the record. “This is an ongoing criminal investigation, and there’s no leeway to disclose any information about it.”

In an interesting work-around, Levison complied the next day by turning over the private SSL keys as an 11 page printout in 4-point type. The government, not unreasonably, called the printout “illegible.”

“To make use of these keys, the FBI would have to manually input all 2,560 characters, and one incorrect keystroke in this laborious process would render the FBI collection system incapable of collecting decrypted data,” prosecutors wrote.

The court ordered Levison to provide a more useful electronic copy. By August 5, Lavabit was still resisting the order, and the judge ordered that Levison would be fined $5,000 a day beginning August 6 until he handed over electronic copies of the keys.

On August 8, Levison shuttered Lavabit, making any attempt at surveillance moot. Still under a gag order, he posted an oblique message saying he’d been left with little choice in the matter.

“I have been forced to make a difficult decision: to become complicit in crimes against the American people or walk away from nearly 10 years of hard work by shutting down Lavabit,” Levison wrote at the time. “After significant soul searching, I have decided to suspend operations.”

Lavabit has raised approximately $30,000 in an online fundraising drive to finance its appeal to the 4th Circuit. Today the appeals court extended the deadline for opening briefs to October 10.
The complete document set follows.

Attacking Tor: how the NSA targets users' online anonymity

http://www.theguardian.com/world/2013/oct/04/tor-attacks-nsa-users-online-anonymity

The online anonymity network Tor is a high-priority target for the National Security Agency. The work of attacking Tor is done by the NSA's application vulnerabilities branch, which is part of the systems intelligence directorate, or SID. The majority of NSA employees work in SID, which is tasked with collecting data from communications systems around the world.

According to a top-secret NSA presentation provided by the whistleblower Edward Snowden, one successful technique the NSA has developed involves exploiting the Tor browser bundle, a collection of programs designed to make it easy for people to install and use the software. The trick identified Tor users on the internet and then executes an attack against their Firefox web browser.

The NSA refers to these capabilities as CNE, or computer network exploitation.

The first step of this process is finding Tor users. To accomplish this, the NSA relies on its vast capability to monitor large parts of the internet. This is done via the agency's partnership with US telecoms firms under programs codenamed Stormbrew, Fairview, Oakstar and Blarney.

The NSA creates "fingerprints" that detect http requests from the Tor network to particular servers. These fingerprints are loaded into NSA database systems like XKeyscore, a bespoke collection and analysis tool which NSA boasts allows its analysts to see "almost everything" a target does on the internet.

Using powerful data analysis tools with codenames such as Turbulence, Turmoil and Tumult, the NSA automatically sifts through the enormous amount of internet traffic that it sees, looking for Tor connections.

Last month, Brazilian TV news show Fantastico showed screenshots of an NSA tool that had the ability to identify Tor users by monitoring internet traffic.

The very feature that makes Tor a powerful anonymity service, and the fact that all Tor users look alike on the internet, makes it easy to differentiate Tor users from other web users. On the other hand, the anonymity provided by Tor makes it impossible for the NSA to know who the user is, or whether or not the user is in the US.

After identifying an individual Tor user on the internet, the NSA uses its network of secret internet servers to redirect those users to another set of secret internet servers, with the codename FoxAcid, to infect the user's computer. FoxAcid is an NSA system designed to act as a matchmaker between potential targets and attacks developed by the NSA, giving the agency opportunity to launch prepared attacks against their systems.

Once the computer is successfully attacked, it secretly calls back to a FoxAcid server, which then performs additional attacks on the target computer to ensure that it remains compromised long-term, and continues to provide eavesdropping information back to the NSA.
Exploiting the Tor browser bundle

Tor is a well-designed and robust anonymity tool, and successfully attacking it is difficult. The NSA attacks we found individually target Tor users by exploiting vulnerabilities in their Firefox browsers, and not the Tor application directly.

This, too, is difficult. Tor users often turn off vulnerable services like scripts and Flash when using Tor, making it difficult to target those services. Even so, the NSA uses a series of native Firefox vulnerabilities to attack users of the Tor browser bundle.

According to the training presentation provided by Snowden, EgotisticalGiraffe exploits a type confusion vulnerability in E4X, which is an XML extension for Javascript. This vulnerability exists in Firefox 11.0 – 16.0.2, as well as Firefox 10.0 ESR – the Firefox version used until recently in the Tor browser bundle. According to another document, the vulnerability exploited by EgotisticalGiraffe was inadvertently fixed when Mozilla removed the E4X library with the vulnerability, and when Tor added that Firefox version into the Tor browser bundle, but NSA were confident that they would be able to find a replacement Firefox exploit that worked against version 17.0 ESR.
The Quantum system

To trick targets into visiting a FoxAcid server, the NSA relies on its secret partnerships with US telecoms companies. As part of the Turmoil system, the NSA places secret servers, codenamed Quantum, at key places on the internet backbone. This placement ensures that they can react faster than other websites can. By exploiting that speed difference, these servers can impersonate a visited website to the target before the legitimate website can respond, thereby tricking the target's browser to visit a Foxacid server.

In the academic literature, these are called "man-in-the-middle" attacks, and have been known to the commercial and academic security communities. More specifically, they are examples of "man-on-the-side" attacks.

They are hard for any organization other than the NSA to reliably execute, because they require the attacker to have a privileged position on the internet backbone, and exploit a "race condition" between the NSA server and the legitimate website. This top-secret NSA diagram, made public last month, shows a Quantum server impersonating Google in this type of attack.

The NSA uses these fast Quantum servers to execute a packet injection attack, which surreptitiously redirects the target to the FoxAcid server. An article in the German magazine Spiegel, based on additional top secret Snowden documents, mentions an NSA developed attack technology with the name of QuantumInsert that performs redirection attacks. Another top-secret Tor presentation provided by Snowden mentions QuantumCookie to force cookies onto target browsers, and another Quantum program to "degrade/deny/disrupt Tor access".

This same technique is used by the Chinese government to block its citizens from reading censored internet content, and has been hypothesized as a probable NSA attack technique.
The FoxAcid system

According to various top-secret documents provided by Snowden, FoxAcid is the NSA codename for what the NSA calls an "exploit orchestrator," an internet-enabled system capable of attacking target computers in a variety of different ways. It is a Windows 2003 computer configured with custom software and a series of Perl scripts. These servers are run by the NSA's tailored access operations, or TAO, group. TAO is another subgroup of the systems intelligence directorate.

The servers are on the public internet. They have normal-looking domain names, and can be visited by any browser from anywhere; ownership of those domains cannot be traced back to the NSA.

However, if a browser tries to visit a FoxAcid server with a special URL, called a FoxAcid tag, the server attempts to infect that browser, and then the computer, in an effort to take control of it. The NSA can trick browsers into using that URL using a variety of methods, including the race-condition attack mentioned above and frame injection attacks.

FoxAcid tags are designed to look innocuous, so that anyone who sees them would not be suspicious. An example of one such tag [LINK REMOVED] is given in another top-secret training presentation provided by Snowden.

There is no currently registered domain name by that name; it is just an example for internal NSA training purposes.

The training material states that merely trying to visit the homepage of a real FoxAcid server will not result in any attack, and that a specialized URL is required. This URL would be created by TAO for a specific NSA operation, and unique to that operation and target. This allows the FoxAcid server to know exactly who the target is when his computer contacts it.

According to Snowden, FoxAcid is a general CNE system, used for many types of attacks other than the Tor attacks described here. It is designed to be modular, with flexibility that allows TAO to swap and replace exploits if they are discovered, and only run certain exploits against certain types of targets.

The most valuable exploits are saved for the most important targets. Low-value exploits are run against technically sophisticated targets where the chance of detection is high. TAO maintains a library of exploits, each based on a different vulnerability in a system. Different exploits are authorized against different targets, depending on the value of the target, the target's technical sophistication, the value of the exploit, and other considerations.

In the case of Tor users, FoxAcid might use EgotisticalGiraffe against their Firefox browsers.

FoxAcid servers also have sophisticated capabilities to avoid detection and to ensure successful infection of its targets. One of the top-secret documents provided by Snowden demonstrates how FoxAcid can circumvent commercial products that prevent malicious software from making changes to a system that survive a reboot process.

According to a top-secret operational management procedures manual provided by Snowden, once a target is successfully exploited it is infected with one of several payloads. Two basic payloads mentioned in the manual, are designed to collect configuration and location information from the target computer so an analyst can determine how to further infect the computer.

These decisions are made in part by the technical sophistication of the target and the security software installed on the target computer; called Personal Security Products or PSP, in the manual.

FoxAcid payloads are updated regularly by TAO. For example, the manual refers to version 8.2.1.1 of one of them.

FoxAcid servers also have sophisticated capabilities to avoid detection and to ensure successful infection of its targets. The operations manual states that a FoxAcid payload with the codename DireScallop can circumvent commercial products that prevent malicious software from making changes to a system that survive a reboot process.

The NSA also uses phishing attacks to induce users to click on FoxAcid tags.

TAO additionally uses FoxAcid to exploit callbacks – which is the general term for a computer infected by some automatic means – calling back to the NSA for more instructions and possibly to upload data from the target computer.

According to a top-secret operational management procedures manual, FoxAcid servers configured to receive callbacks are codenamed FrugalShot. After a callback, the FoxAcid server may run more exploits to ensure that the target computer remains compromised long term, as well as install "implants" designed to exfiltrate data.

By 2008, the NSA was getting so much FoxAcid callback data that they needed to build a special system to manage it all.

How To Remain Connected If Your Internet Gets Shut Off

http://www.movements.org/how-to/entry/how-to-prepare-for-an-internet-connection-cut-off/

Step 1. 

Keep all your outmoded technology - it may come in handy. If you live in a country likely to experience shut down of internet service providers at the behest of the government, keep in mind that tools like modems and even fax machines might be useful again. You can use a modem to access the web via dial-up provided you have a working telephone line. As in Egypt during the January 25 uprising, supporters can make available international numbers that you can dial into to avoid your local ISPs (since they will be shut down). You'll also need an international dial in number, a working phone line, and bluetooth equipped cell phone and computer.
Stay tuned to the Telecomix activists' network, which began providing disconnected people with dial up links to the WWW when Egypt lost its connection, and again in Libya a month later.

• Click here to see the Google Speak 2 Tweet number for Libya 
• Click here to see one free dialup number for Libya (note the username and password (they're the same))
• Click here to see another free dialup number for Libya (note the username and password (they're the same))

Share widely!

Step 2.

Take all your contacts out of the cloud. It's a good idea to make sure you have a list of your contacts' emails printed out and readily available. For example, the We Are All Khaled Said Facebook page prepared for a possible Facebook cut-off in Egypt by asking supporters to share their email addresses and other contact information on a Google spreadsheet.
Most email clients let you easily export and download your contacts. Learn how to export Gmail contacts and Yahoo! Mail contacts.

Step 3. 

Gather contacts' phone numbers and write them down. Make sure to have a phone tree prepared ahead of time. A phone tree is "a prearranged, pyramid-shaped system for activating a group of people by telephone." Your contacts are divided into different groups with each group having a coordinator. These coordinators will be responsible for calling other members.
Start with those in your network with the biggest reach, for example community leaders such as politicians, imams, priests or rabbis, and then contact supporters with smaller networks but who you can count on to take to the streets and contact others

Step 4.

CB Radio and ham radios can be used to communicate. A CB ("citizens band") two-way radio service allows for communication over short distances. You don't need a license to operate one.
Ham radios--or amateur radios--are non-commercial and use designated radio bands to transmit communications. They are commonly used for voice transmissions and morse code. The requirements for receiving an amateur radio license vary country to country, so you will need to check what type of license you need to obtain. Ham radio signals are harder for governments to track and block. Learn more about becoming a ham radio operator with Wired's how-to wiki.
There is an active ham radio community that you can tap into right now and work with to develop a contingency plan for getting information out of your country in the event of a net shut down.

Step 5.

Use a fax machine to send and receive documents. Many printers now also come with fax machines built in, or you can use a standalone machine. Both parties need working phone lines and fax machines.

Step 6. 

Prepare a local or "ad hoc" network connecting devices to each other even without the internet. Here are different ways to do this:

Turn to FidoNet, a networking system that can be used for communication between bulletin board systems. Mail and files can be exchanged via modems using a proprietary protocol. You must meet the technical requirements to join FidoNet. 

Check out Daihinia, an app that extends the range of a network of devices that aren't connected to the larger internet but are connected to each other. Adding a chat client, like Pidgin, to this allows activists to talk to one another.

Look into how you might be able to harness other chat clients as well. On a Mac you can use the "Rendezvous" feature in iChat to communicate with anyone on the network. In Windows use a third party app like Trillian, and Linux has a bunch of 3rd party apps you can use - note that this does require some technical knowledge, which is why it is all the more important to prepare in advance. 

Packet radio is a radio communications protocol that lets you create long distance wireless networks between devices like ham radios - if you look into this option before hand, you might be able to create a network using radios.

Get involved with OPENMESH, a new project launched by investor Shervin Pishevar. So far, the forum is working as a place for engineers to offer solutions for building a mesh network in Egypt. 

Step 7. 

Get Twitter messages redirected to your phone and send Tweets by text. Make sure to link your mobile phone to your Twitter account and locate the Twitter short code for your country. Then you can send a text message containing your Tweet to that short code and it will be posted to your profile.

Step 8.

Have a basic radio on hand so that you can still listen to news. Portable scanners are also helpful for receiving police, fire, and rescue reports. They can be purchased online or at specialty electronics stores and usually cost around $100 USD. Walkie-talkies are handheld, two-way portable radios that can be used to communicate between two people within a short distance (usually at a range around 15-20 miles). A basic walkie-talkie is pretty cheap to purchase.

Step 9. 

Check with neighbors and friends who may use different internet service providers (ISPs) and see if their connections are still up. For example, in Egypt one ISP (Noor) remained online when all other ISPs cut service.

Step 10. 

Did all this, but still no connection? Landlines might still work. If they do, as we've seen in Egypt and Libya during the spring of 2010, an activist network like Telecomix  may be providing dial up links to the global web

NSA masqueraded as Google to spy on web users - report

http://rt.com/news/nsa-disguised-google-spy-801/

The NSA used ‘man in the middle’ hack attacks to impersonate Google and fool web users, leaks have revealed. The technique circumvents encryption by redirecting users to a copycat site which relays all the data entered to NSA data banks.

Brazilian television network Globo News released a report based on classified data divulged by former CIA worker Edward Snowden on Sunday. The report itself blew the whistle on US government spying on Brazilian oil giant Petrobras, but hidden in amongst the data was information the NSA had impersonated Google to get its hands on user data.

Globo TV showed slides from a 2012 NSA presentation explaining how the organization intercepts data and re-routes it to NSA central. One of the convert techniques the NSA uses to do this is a ‘man in the middle’ (MITM) hack attack.

This particular method of intercepting internet communications is quite common among expert hackers as it avoids having to break through encryption. Essentially, NSA operatives log into a router used by an internet service provider and divert ‘target traffic’ to a copycat MITM site, whereupon all the data entered is relayed to the NSA. The data released by Edward Snowden and reported on by Globo News suggests the NSA carried out these attacks disguised as Google.

When the news broke about the NSA gathering information through internet browsers, tech giants such as Google and Yahoo denied complicity, maintaining they only handover data if a formal request is issued by the government.

"As for recent reports that the US government has found ways to circumvent our security systems, we have no evidence of any such thing ever occurring. We provide our user data to governments only in accordance with the law," said Google spokesperson Jay Nancarrow to news site Mother Jones.

Google, along with Microsoft, Facebook and Yahoo, has filed a lawsuit against the Foreign Intelligence Surveillance Court (FISA) to allow them to make public all the data requests made by the NSA.

“Given the important public policy issues at stake, we have also asked the court to hold its hearing in open rather than behind closed doors. It's time for more transparency," Google’s director of law enforcement and information security, Richard Salgado, and the director of public policy and government affairs, Pablo Chavez, wrote in a blog post on Monday.

The tech giants implicated in NSA’s global spying program have denied criticism that they could have done more to resist NSA spying. Marissa Mayer, CEO of Yahoo, claimed that speaking out about the NSA’s activities would have amounted to ‘treason’ at a press conference in San Francisco on Wednesday.

In Yahoo’s defense, she argued that the company had been very skeptical of the NSA’s requests to disclose user data and had resisted whenever possible. Mayer concluded that it was more realistic to work within the system,” rather than fight against it.

Twitter user arrested after allegedly tweeting identity of sex abuse victim in relation to Michael Le Vell trial

 http://mancunianmatters.co.uk/content/050912343-twitter-user-arrested-after-allegedly-tweeting-identity-sex-abuse-victim-relation-

A tweeter was arrested last night on suspicion of using the social media site Twitter to reveal the identity of the alleged sex abuse victim in the Michael Le Vell trial.

A 43-year-old man from the Gloucester area was arrested on suspicion of breaching the Sexual Offences Act in relation to publically identifying a victim of alleged sex abuse. He has since been released on bail.

Le Vell, whose real name is Michael Turner and plays Kevin Webster in Coronation Street, is facing charges of 12 sexual abuse charges spanning eight years.

Superintendent Phil Davies from Greater Manchester Police, said: “Public identification of victims of sex abuse, in particular child victims engaged in court proceedings, can cause both immediate and long term distress and harm, especially in cases as serious as this. 

“The same principles apply to social media as they do to the mainstream media, and we are investigating this matter robustly.”

Under the Sexual Offences Amendment Act 1992, all victims of sex abuse are automatically granted anonymity for life. 

Le Vell, a 48-year-old father of two, is accused of five counts of rape, three of indecent assault, two counts of sexual activity with a child and two of causing a child to engage in sexual activity. 

The alleged abuse of a minor, who cannot be named for legal reasons, is said to have taken place between September 2002 and September 2010. He has pleaded not guilty to all charges.

Superintendent Davies warned of the dangers of using social media without thinking beforehand.

“Social media is a fantastic tool for self-expression and part of modern life, but users should ask themselves whether they would want their own child subject to a Twitter feed,” he said.

“People may not understand that when they use social media they are required by the law to keep victims anonymous in exactly the same way as people who work in main stream media. The rule of law and consciousness of a sex abuse victim's anonymity should be considered by all who follow these types of cases."

Self-described furry Ryan Havens Tannenholz arrested after dressing up as a dog and having sex with a cat

 http://www.dailymail.co.uk/news/article-2393371/Man-28-likes-dressing-dog-arrested-having-sex-cat.html

A man who enjoys dressing up as a dog has been arrested for having sex with a cat in Idaho.

Ryan Havens Tannenholz, 28, is accused of sexually abusing the pet several times over the course of a year.

Police arrested the man from Boise, Idaho, on August 1st, on six felony counts of crimes against nature and one misdemeanor count of cruelty to an animal.

Tannenholz is said to be a 'furry' - the name given to a member of a community of people who dress as animals.

According to Flayrah, a site dedicated to furries, he had a number of animal alter-egos including a dog, a wolf, a white husky and a fox.

Photos on a social media site posted by Tannenholz appear to show him in character as a creature called Bubblegum.

He is currently being held in custody in lieu of a $250,000 bond and faces up to five years in prison if convicted.

 

An arrest warrant was issued on July 31, and he was arrested on August 1. Police did not specify how the alleged activities came to light.

On Tannenholz's Bubblegum Husky website, he describes his interest in cats and reveals his own pet cat named Einstein.

He writes: 'Have you ever been on the internet and seen one of those cat videos? Bubblegum Husky sure has and man, I'll tell you what, they really get me going!

'Cats are so furry, soft plush and loving. Plus, only Bubblegum Husky can REALLY appreciate how truly great these furry felines truly are.'

In costume: Ryan Tannenholz dressed as his alter ego 'Bubblegum Husky' (left) and his pet cat Einstein (right)

Bubblegum Husky: Ryan Tannenholz created a website around his love for cats under his alter ego's name

iamyourprince01 aka Robert James Tyndall of Airdrie, Alberta, Canada arrested for pedophilia

 http://calgary.ctvnews.ca/airdrie-man-charged-with-numerous-child-porn-offences-1.1402697

An Airdrie man is facing several child pornography charges after a tip in the United States prompted an investigation in Alberta by ALERT’s Internet Child Exploitation (ICE) Unit.

In June 2013, ICE received information from the FBI about a suspect who police believed convinced a nine-year-old American girl to make sexually explicit videos on her webcam.

"The gaurdian of the child noticed some chat and contacted the FBI," said Acting Staff Sergeant Dean Jacobs of the ICE Unit.

Photos

The investigation prodeced an IP address and led ICE to a home in Airdrie.

On August 1, a search warrant was executed at the home and police seized computers and electronic devices. Those items are still waiting for analysis by investigators.

The suspect was not found inside the home at the time of the initial warrant but was arrested on August 6.
Robert James Tyndall, 42, is charged with:

• One count each of accessing, possessing, and making child pornography
• Sexual interference
• Sending sexually explicit material to a person under the age of 16
• Two counts of luring

“This is a happy day, not just because we arrested someone, but most importantly because we saved a nine-year-old girl from repeated sexual abuse,” said Jacobs. “Now this young girl can get back to being a child and focus on recovering from this abuse.”

Tyndall was released on bail and has been ordered not to have contact with anyone under the age of 16.

He is also not allowed to possess electronic devices that access the Internet.

During the course of the investigation, police learned that Tyndall used the names “Rob Williams” and “Rob Williams 91” on various social networking sites.

He also used the following email addresses:

• doughboysrevenge95@gmail.com
• doughboyprince96@gmail.com
• canadianprince95@gmail.com
• canadianbaconprince@gmail.com

Tyndall is expected to appear in court again on August 22.
Investigators are encouraging anyone with information pertaining to this investigation to contact Acting Staff Sergeant Dean Jacobs of the southern Alberta ICE unit at 403-428-4905.
"With Internet your wide-spread is going to be global so he could reach anywhere throughout the world so we gotta do some more investigation and we'll figure out if there's any more people that we need to speak to," said jacobs.
Suspected child sexual exploitation or suspicious online activity may be reported online at www.cybertip.ca.

Modern art of peace: Blue painting with white line sells for nearly $44 million in US dollars

http://news.insing.com/tabloid/blue-painting-with-white-line-sells-for-nearly-us44-million/id-f4743f00

Barnett Newman painted this masterpiece, ‘Onement VI’, in 1953. It sold for close to US$44 million (S$55 million) this week at an auction (Photo: Barnett Newman Facebook page)

A blue painting with a white line down the middle of it sold for nearly US$44 million (S$55 million) at a Sotheby’s contemporary art evening sale in New York this week.

 ‘Onement VI’, an abstract work in dark blue done in 1953 by American artist Barnett Newman, sets an artist record for the most expensive Newman painting ever – eclipsing the painter’s previous auction record by a margin of more than US$20 million, a press release from the auction house stated.

It had earlier estimated that the painting would be sold between US$30 and 40 million.

Newman, who died in 1970 at the age of 65, is considered to be one of the major figures of the American post-World War II abstract expressionism movement.

Sotheby’s said the painting is the most important work by the artist ever to appear at an auction, and “stands as a masterwork not only of Newman’s artistic enterprise, but of the entire Abstract Expressionist movement”.

In the Sotheby’s catalogue notes, it described that the painting “overwhelms and seduces the viewer with the totality of its sensual, cascading washes of vibrant blue coexisting with Newman’s vertical ‘Sign’ of the human presence, his iconic and revolutionary ‘zip’ (stripe down the canvas).”

The sale was part of a larger auction of contemporary art that brought in a total of US$293.6 million.

The sale included an auction record for German visual artist Gerhard Richter, whose photo-painting ‘Domplatz, Mailand’ fetched US$37.1 million.

How Unmanned Surveillance/Predator Drone Aircraft Work (Infographic)

http://www.livescience.com/37815-how-unmanned-drone-aircraft-work-infographic.html
; Unmanned Aerial Vehicles (UAVs) are remote-controlled aircraft that can carry cameras, sensors and weapons over enemy territory. The decade since 9/11 has seen these remote aircraft increase in prominence from speculative prototypes to America’s primary counterterrorism weapon.

With a range of 10,000 miles (16,000 kilometers), the largest drone, Northrop Grumman’s RQ-4 Global Hawk, cruises at high altitude, loitering over an area for up to 30 hours. The drone produces high-quality surveillance images using its suite of sensors.

The Global Hawk’s Allison Rolls-Royce turbofan engine has 7,050 lb (3,200 kg) thrust. A sensor suite includes synthetic aperture radar, electro-optical sensors and infrared sensors.

At the other end of the size spectrum, the RQ-11 Raven is so tiny, a soldier can heave it into the air one-handed. Once airborne, the Raven has a range of 7.45 miles (12 km). Future drones could be the size of a hummingbird or even an insect.

Drone Timeline:

Oct. 7, 2001: The first armed Predator drones begin flying missions over Afghanistan less than a month after 9/11. By March 2002, Drones would begin providing close air support for troops on the ground.



Nov. 3, 2002: A CIA-operated Predator drone launched a Hellfire missile at a car carrying five al-Qaida members. It was the first drone assassination in what would become a decadelong campaign.

Dec. 23, 2002: A Predator drone fires a sidewinder missile at an Iraqi fighter plane in the No Fly Zone. This is the first instance of air-to-air combat with a drone. During the surge in 2007, drone surveillance would significantly reduce the number of roadside bomb attacks.

May 7, 2004: The CIA begins a covert drone bombing campaign in Pakistan’s tribal regions. Over the next four years, President George Bush would order 42 more drone strikes in the region. From 2008 to 2011, President Barack Obama has ordered at least 180 strikes. Some estimates put the death toll from the campaign at close to 2,000.

Late 2004: The U.S. Border Patrol begins testing UAVs for patrolling the U.S./Mexico border. In 2009, the U.S. begins flying drones inside of Mexican airspace in support of Mexican government antidrug cartel operations.

Late 2009: U.S. begins drone flights off of Somalia to monitor and deter pirates. In June 2011, the U.S. begins basing drones at the Mogadishu airport and launching drone missile strikes within Somalia against al-Shabab militants linked to al-Qaida.

April 21, 2011: President Obama approves the use of drones in support of the Libyan rebels. The drones destroy Qaddafi air defenses in advance of the NATO bombing campaign, and provide targeting and support for NATO allies during the war. Operations in Libya also feature the first use of drone helicopters in combat.

Jan. 25, 2011: A Texas Department of Public Safety SWAT team deploys a small drone during a raid on a drug stash house. This marks the first use of UAVs for domestic surveillance.

FAQ: What You Need to Know About the NSA’s Surveillance Programs

 http://www.propublica.org/article/nsa-data-collection-faq

There have been a lot of news stories about NSA surveillance programs following the leaks of secret documents by Edward Snowden. But it seems the more we read, the less clear things are. We've put together a detailed snapshot of what's known and what's been reported where.

What information does the NSA collect and how?

We don’t know all of the different types of information the NSA collects, but several secret collection programs have been revealed:

A record of most calls made in the U.S., including the telephone number of the phones making and receiving the call, and how long the call lasted. This information is known as “metadata” and doesn’t include a recording of the actual call (but see below). This program was revealed through a leaked secret court order instructing Verizon to turn over all such information on a daily basis. Other phone companies, including AT&T and Sprint, also reportedly give their records to the NSA on a continual basis. All together, this is several billion calls per day.

Email, Facebook posts and instant messages for an unknown number of people, via PRISM, which involves the cooperation of at least nine different technology companies. Google, Facebook, Yahoo and others have denied that the NSA has “direct access” to their servers, saying they only release user information in response to a court order. Facebook has revealed that, in the last six months of 2012, they handed over the private data of between 18,000 and 19,000 users to law enforcement of all types -- including local police and federal agencies, such as the FBI, Federal Marshals and the NSA.

Massive amounts of raw Internet traffic Much of the world’s Internet traffic passes through the U.S. even when the sender and receiver are both outside the country. A recently revealed presentation slide notes the U.S.’s central role in internet traffic and suggests domestic taps can be used to monitor foreign targets. A whistleblower claimed that he helped install a network tap in an AT&T facility in San Francisco on NSA orders in 2003. The tap sent the entire contents of high capacity fiber optic cables into a secret room filled with monitoring equipment. An unknown fraction of the intercepted data is stored in massive databases in case it is useful in the future.

Because there is no automatic way to separate domestic from international communications, this program also captures U.S. citizens’ internet activity, such as emails, social media posts, instant messages, the sites you visit and online purchases you make.

The contents of an unknown number of phone calls The details are sketchy, but there are several reports that the NSA records the audio contents of some phone calls. This reportedly happens “on a much smaller scale” than the programs above, after analysts select specific people as “targets.” There does not seem to be any public information about the collection of text messages, which would be much more practical to collect in bulk because of their smaller size.

The NSA has been prohibited from recording domestic communications since the passage of the Foreign Intelligence Surveillance Act but at least two of these programs -- phone records collection and Internet cable taps -- involve huge volumes of Americans’ data.

Does the NSA record everything about everyone, all the time?

No. The NSA routinely obtains and stores as much as it can of certain types of information, such as the metadata from telephone calls made in the U.S. (but not their content) and some fraction of the massive amount of raw data flowing through major internet cables. It is also possible for the NSA to collect more detailed information on specific people, such as the actual audio of phone calls and the entire content of email accounts. NSA analysts can submit a request to obtain these types of more detailed information about specific people.

Watching a specific person like this is called "targeting" by the Foreign Intelligence Surveillance Act, the law which authorizes this type of individual surveillance. The NSA is allowed to record the conversations of non-Americans without a specific warrant for each person monitored, if at least one end of the conversation is outside of the U.S. It is also allowed to record the communications of
Americans if they are outside the U.S. and the NSA first gets a warrant for each case. It’s not known exactly how many people the NSA is currently targeting.

How the NSA actually gets the data depends on the type of information requested. If the analyst wants someone's private emails or social media posts, the NSA must request that specific data from companies such as Google and Facebook. For information that is already flowing through Internet cables that the NSA is monitoring, or the audio of phone calls, a targeting request instructs automatic systems to watch for the communications of a specific person and save them.

It’s important to note that the NSA probably has information about you even if you aren’t on this target list. If you have previously communicated with someone who has been targeted, then the NSA already has the content of any emails, instant messages, phone calls, etc. you exchanged with the targeted person. Also, your data is likely in bulk records such as phone metadata and internet traffic recordings.

This is what makes these programs “mass surveillance,” as opposed to traditional wiretaps, which are authorized by individual, specific court orders.

What does phone call metadata information reveal, if it doesn’t include the content of the calls?

Even without the content of all your conversations and text messages, so-called “metadata” can reveal a tremendous amount about you. If they have your metadata, the NSA would have a record of your entire address book, or at least every person you’ve called in the last several years. They can guess who you are close to by how often you call someone, and when. By correlating the information from multiple people, they can do sophisticated “network analysis” of communities of many different kinds, personal or professional -- or criminal.

Phone company call records reveal where you were at the time that a call was made, because they include the identifier of the radio tower that transmitted the call to you. The government has denied that it collects this information, but former NSA employee Thomas Drake said they do. For a sense of just how powerful location data can be, see this visualization following a German politician everywhere he goes for months, based on his cellphone’s location information.

The type of data can be used to discover the structure of groups planning terrorism. But metadata is a sensitive topic because there is great potential for abuse. While no one has claimed the NSA is doing this, it would be possible to use metadata to algorithmically identify, with some accuracy, members of other types of groups like the Tea Party or Occupy Wall Street, gun owners, undocumented immigrants, etc. An expert in network analysis could start with all of the calls made from the time and place of a protest, and trace the networks of associations out from there.
Phone metadata is also not “anonymous” in any real sense. The NSA already maintains a database of the phone numbers of all Americans for use in determining whether someone is a “U.S. person” (see below), and there are several commercial number-to-name services in any case. Phone records become even more powerful when they are correlated with other types of data, such as social media posts, local police records and credit card purchase information, a process known as intelligence fusion.

Does the NSA need an individualized warrant to listen to my calls or look at my emails?

It’s complicated, but not in all cases. Leaked court orders set out the "minimization" procedures that govern what the NSA can do with the domestic information it has intercepted. The NSA is allowed to store this domestic information because of the technical difficulties in separating foreign from domestic communications when large amounts of data are being captured.

These documents show that individual intelligence analysts make the decision to look at previously collected bulk information. The analyst must document why they believe the information belongs to someone who is not a “U.S. person” (roughly, a U.S. citizen or permanent resident) but they do not need to ask anyone’s permission before looking at intercepted information or asking for additional information to be collected. If the analyst later discovers that they are looking at the communications of a U.S. person, they must destroy the data.

However, if the intercepted information is “reasonably believed to contain evidence of a crime” then the NSA is allowed to turn it over to federal law enforcement. Unless there are other (still secret) restrictions on how the NSA can use this data this means the police might end up with your private communications without ever having to get approval from a judge, effectively circumventing the whole notion of probable cause.

This is significant because it is not always possible to determine whether someone is a U.S. person before looking at their data. For example, it’s not usually possible to tell just from someone’s email address, which is why the NSA maintains a database of known U.S. email addresses and phone numbers. If the NSA does not have “specific information” about someone, that person is “presumed to be a non-United States person.”

Also, the NSA is allowed to provide any of its recorded information to the FBI, if the FBI specifically asks for it.

Is all of this legal?

Yes, assuming the NSA adheres to the restrictions set out in recently leaked court orders. By definition, the Foreign Intelligence Surveillance Court decides what it is legal for the NSA to do.
But this level of domestic surveillance wasn’t always legal, and the NSA has been found to violate legal standards on more than one occasion. Although the NSA’s broad data collection programs appear to have started shortly after September 11, 2001, the NSA was gradually granted authority to collect domestic information on this scale through a series of legislative changes and court decisions over the next decade. See this timeline of loosening laws. The Director of National Intelligence says that authority for PRISM programs comes from section 702 of the Foreign Intelligence Surveillance Act and the Verizon metadata collection order cites section 215 of the Patriot Act. The author of the Patriot Act disagrees that the act justifies the Verizon metadata collection program.
In March 2004, acting Attorney General James Comey ordered a stop to some parts of the secret domestic surveillance programs, but President Bush signed an order re-authorizing it anyway. In response, several top Justice Department officials threatened to resign, including Comey and FBI director Robert Mueller. Bush backed down, and the programs were at least partially suspended for several months.
In 2009, the Justice Department acknowledged that the NSA had collected emails and phone calls of Americans in a way that exceeded legal limitations.
In October 2011, the Foreign Intelligence Surveillance Court ruled that the NSA violated the Fourth Amendment at least once. The Justice Department has said that this ruling must remain secret, but we know it concerned some aspect of the "minimization" rules the govern what the NSA can do with domestic communications. The Foreign Intelligence Surveillance Court recently decided that this ruling can be released, but Justice Department has not yet done so.
Civil liberties groups including the EFF and the ACLU dispute the constitutionality of these programs and have filed lawsuits to challenge them.

How long can the NSA keep information on Americans?

The NSA can generally keep intercepted domestic communications for up to five years. It can keep them indefinitely under certain circumstances, such as when the communication contains evidence of a crime or when it’s “foreign intelligence information,” a broad legal term that includes anything relevant to “the conduct of the foreign affairs of the United States.” It can also keep encrypted communications indefinitely.

Does the NSA do anything to protect Americans’ privacy?

Yes. First, the NSA is only allowed to intercept communications if at least one end of the conversation is outside of the U.S. -- though it doesn't have to distinguish domestic from foreign communication until the "earliest practicable point" which allows the NSA to record bulk information from internet cables and sort it out later. When the NSA discovers that previously intercepted information belongs to an American, it must usually destroy that information. Because this determination cannot always be made by computer, this sometimes happens only after a human analyst has already looked at it.

The NSA also must apply certain safeguards. For example, the NSA must withhold the names of U.S. persons who are not relevant to ongoing investigations when they distribute information -- unless that person’s communications contain evidence of a crime or are relevant to a range of national security and foreign intelligence concerns.

Also, analysts must document why they believe someone is outside of the U.S. when they ask for addition information to be collected on that person. An unknown number of these cases are audited internally. If the NSA makes a mistake and discovers that it has targeted someone inside the U.S., it has five days to submit a report to the Department of Justice and other authorities.

What if I’m not an American?

All bets are off. There do not appear to be any legal restrictions on what the NSA can do with the communications of non-U.S. persons. Since a substantial fraction of the world’s Internet data passes through the United States, or its allies, the U.S. has the ability to observe and record the communications of much of the world’s population. The European Union has already complained to the U.S. Attorney General.

The U.S. is hardly the only country doing mass surveillance, though its program is very large. GCHQ, which is the British counterpart to the NSA, has a similar surveillance program and shares data with the NSA. Many countries now have some sort of mass internet surveillance now in place. Although passive surveillance is often hard to detect, more aggressive governments use intercepted information to intimidate or control their citizens, including Syria, Iran, Egypt, Bahrain and China. Much of the required equipment is sold to these governments by American companies.

2007 Recently Deleted ZDNet News Article: Will security firms detect police spyware?

Will security firms detect police spyware?

By Declan McCullagh, News.com
Published on ZDNet News: Jul 17, 2007 11:00:00 AM
----------------------------------------------------------------------------------
* This article is being archived on pastebins because it is not available at the original location where it was published. This copy/paste does not include the links (urls) within the article.

original story url: http://news.zdnet.com/2100-1009_22-6197020.html

* Attention ZDNet News: Please do not move or expire articles as they age.

"The New Zealand Copyright Act 1994 specifies certain circumstances where all or a substantial part of a copyright work may be used without the copyright owner's permission. A "fair dealing" with copyright material does not infringe copyright if it is for the following purposes: research or private study; criticism or review; or reporting current events."
----------------------------------------------------------------------------------

"A recent federal court decision raises the question of whether antivirus companies may intentionally overlook spyware that is secretly placed on computers by police.

In the case decided earlier this month by the 9th U.S. Circuit Court of Appeals, federal agents used spyware with a keystroke logger--call it fedware--to record the typing of a suspected Ecstasy manufacturer who used encryption to thwart the police.

A CNET News.com survey of 13 leading antispyware vendors found that not one company acknowledged cooperating unofficially with government agencies. Some, however, indicated that they would not alert customers to the presence of fedware if they were ordered by a court to remain quiet.
Spyware survey

Most of the companies surveyed, which covered the range from tiny firms to Symantec and IBM, said they never had received such a court order. The full list of companies surveyed: AVG/Grisoft, Computer Associates, Check Point, eEye, IBM, Kaspersky Lab, McAfee, Microsoft, Sana Security, Sophos, Symantec, Trend Micro and Websense. Only McAfee and Microsoft flatly declined to answer that question. (Click here for the verbatim responses to the survey.)

Because only two known criminal prosecutions in the United States involve police use of key loggers, important legal rules remain unsettled. But key logger makers say that police and investigative agencies are frequent customers, in part because recording keystrokes can bypass the increasingly common use of encryption to scramble communications and hard drives. Microsoft's Windows Vista and Apple's OS X include built-in encryption.

Some companies that responded to the survey were vehemently pro-privacy. "Our customers are paying us for a service, to protect them from all forms of malicious code," said Marc Maiffret, eEye Digital Security's co-founder and chief technology officer. "It is not up to us to do law enforcement's job for them so we do not, and will not, make any exceptions for law enforcement malware or other tools." eEye sells Blink Personal for $25, which includes antivirus and antispyware features.

Others were more conciliatory. Check Point, which makes the popular ZoneAlarm utility, said it would offer federal police the "same courtesy" that it extends to legitimate third-party vendors that request to be whitelisted. A Check Point representative said, though, that the company had "never been" in that situation.

This isn't exactly a new question. After the last high-profile case in which federal agents turned to a key logger, some security companies allegedly volunteered to ignore fedware. The Associated Press reported in 2001 that "McAfee Corp. contacted the FBI... to ensure its software wouldn't inadvertently detect the bureau's snooping software." McAfee subsequently said the report was inaccurate.

=

Later that year, the FBI confirmed that it was creating spy software called "Magic Lantern" that would allow agents to inject keystroke loggers remotely through a virus without having physical access to the computer. (In both the recent Ecstasy case and the earlier key logging case involving an alleged mobster, federal agents obtained court orders authorizing them to break into buildings to install key loggers.)

Government agencies and backdoors in technology products have a long and frequently clandestine relationship. One 1995 expose by the Baltimore Sun described how the National Security Agency persuaded a Swiss firm, Crypto, to build backdoors into its encryption devices. In his 1982 book, The Puzzle Palace, author James Bamford described how the NSA's predecessor in 1945 coerced Western Union, RCA and ITT Communications to turn over telegraph traffic to the feds.

More recently, after the BBC reported last year on supposed talks between the British government and Microsoft, the software maker pledged not to build backdoors into Windows Vista's encryption functions.

A recent federal court decision raises the question of whether antivirus companies may intentionally overlook spyware that is secretly placed on computers by police.

In the case decided earlier this month by the 9th U.S. Circuit Court of Appeals, federal agents used spyware with a keystroke logger--call it fedware--to record the typing of a suspected Ecstasy manufacturer who used encryption to thwart the police.

A CNET News.com survey of 13 leading antispyware vendors found that not one company acknowledged cooperating unofficially with government agencies. Some, however, indicated that they would not alert customers to the presence of fedware if they were ordered by a court to remain quiet.
Spyware survey

Most of the companies surveyed, which covered the range from tiny firms to Symantec and IBM, said they never had received such a court order. The full list of companies surveyed: AVG/Grisoft, Computer Associates, Check Point, eEye, IBM, Kaspersky Lab, McAfee, Microsoft, Sana Security, Sophos, Symantec, Trend Micro and Websense. Only McAfee and Microsoft flatly declined to answer that question. (Click here for the verbatim responses to the survey.)

Because only two known criminal prosecutions in the United States involve police use of key loggers, important legal rules remain unsettled. But key logger makers say that police and investigative agencies are frequent customers, in part because recording keystrokes can bypass the increasingly common use of encryption to scramble communications and hard drives. Microsoft's Windows Vista and Apple's OS X include built-in encryption.

Some companies that responded to the survey were vehemently pro-privacy. "Our customers are paying us for a service, to protect them from all forms of malicious code," said Marc Maiffret, eEye Digital Security's co-founder and chief technology officer. "It is not up to us to do law enforcement's job for them so we do not, and will not, make any exceptions for law enforcement malware or other tools." eEye sells Blink Personal for $25, which includes antivirus and antispyware features.

Others were more conciliatory. Check Point, which makes the popular ZoneAlarm utility, said it would offer federal police the "same courtesy" that it extends to legitimate third-party vendors that request to be whitelisted. A Check Point representative said, though, that the company had "never been" in that situation.

This isn't exactly a new question. After the last high-profile case in which federal agents turned to a key logger, some security companies allegedly volunteered to ignore fedware. The Associated Press reported in 2001 that "McAfee Corp. contacted the FBI... to ensure its software wouldn't inadvertently detect the bureau's snooping software." McAfee subsequently said the report was inaccurate.

=

 Later that year, the FBI confirmed that it was creating spy software called "Magic Lantern" that would allow agents to inject keystroke loggers remotely through a virus without having physical access to the computer. (In both the recent Ecstasy case and the earlier key logging case involving an alleged mobster, federal agents obtained court orders authorizing them to break into buildings to install key loggers.)

Government agencies and backdoors in technology products have a long and frequently clandestine relationship. One 1995 expose by the Baltimore Sun described how the National Security Agency persuaded a Swiss firm, Crypto, to build backdoors into its encryption devices. In his 1982 book, The Puzzle Palace, author James Bamford described how the NSA's predecessor in 1945 coerced Western Union, RCA and ITT Communications to turn over telegraph traffic to the feds.

More recently, after the BBC reported last year on supposed talks between the British government and Microsoft, the software maker pledged not to build backdoors into Windows Vista's encryption functions.

Even if the FBI, the Drug Enforcement Administration or other federal police haven't tried to compel security companies to whitelist fedware, security experts predict that such a court order is just a matter of time.

What remains unclear, however, is whether police have the legal authority to do so under current law. "The government would be pushing the boundaries of the law if it attempted to obtain such an order," said Kevin Bankston, an attorney with the Electronic Frontier Foundation who has litigated wiretapping cases. "There's simply no precedent for this sort of thing."

One possibility is a section of the Wiretap Act that says courts can "direct that a provider of wire or electronic communication service, landlord, custodian or other person" to help with electronic surveillance.

"There is some breadth in that language that is of concern and that the Justice Department may attempt to exploit," Bankston said.

In theory, government agencies could even seek a court order requiring security companies to deliver spyware to their customers as part of an auto-update feature. Most modern security companies, including operating system makers such as Microsoft and Apple, offer regular patches and bug fixes. Although it would be technically tricky, it would be possible to send an infected update to a customer if the vendor were ordered to do so.

When asked if it had ever received such a court order, Microsoft demurred. "Microsoft frequently has confidential conversations with both customers and government agencies and does not comment on those conversations," a company representative said. Of the 13 companies surveyed, McAfee was the other company that declined to answer. (Two others could not be reached as of Tuesday morning.)

Some security companies refused to reply to the initial version of our survey, which broadly asked about fedware whitelisting. In response, we revised the question to ask if they would alert a customer to the presence of keystroke loggers installed by a police or intelligence agency "in the absence of a lawful court order signed by a judge."

Cris Paden, Symantec's manger of corporate public relations, initially declined to reply. "There are legitimate reasons for not giving blanket guarantees--one of those is a court order," he said at first. "There are extenuating circumstances and gray issues."

But after we altered the question, Paden replied: "Barring a court order to cooperate with law enforcement authorities, Symantec would definitely alert our customers to the presence of any malicious code or programs that we detect on their systems." He added that Symantec had "absolutely not" received any such a court order.

One danger with whitelisting fedware is that it creates a potentially serious vulnerability in security software. If a malicious vendor of spyware were clever enough to mimic the whitelisted government spyware, it would also go undetected.

But if fedware becomes more common, savvy criminals could simply turn to open-source software that's less likely to have backdoors for police. ClamAV and OpenAntiVirus.org both offer open-source security software, and it's also possible to boot off of a CD-ROM and inspect the hard drive for malicious tampering.

At the moment, at least, there aren't any industry standards about detecting fedware. "CSIA does not currently have a position on this issue nor has the issue ever been addressed by its board of directors," said Tim Bennett, president of the Cyber Security Industry Alliance.
Even if the FBI, the Drug Enforcement Administration or other federal police haven't tried to compel security companies to whitelist fedware, security experts predict that such a court order is just a matter of time.

What remains unclear, however, is whether police have the legal authority to do so under current law. "The government would be pushing the boundaries of the law if it attempted to obtain such an order," said Kevin Bankston, an attorney with the Electronic Frontier Foundation who has litigated wiretapping cases. "There's simply no precedent for this sort of thing."

One possibility is a section of the Wiretap Act that says courts can "direct that a provider of wire or electronic communication service, landlord, custodian or other person" to help with electronic surveillance.

"There is some breadth in that language that is of concern and that the Justice Department may attempt to exploit," Bankston said.

In theory, government agencies could even seek a court order requiring security companies to deliver spyware to their customers as part of an auto-update feature. Most modern security companies, including operating system makers such as Microsoft and Apple, offer regular patches and bug fixes. Although it would be technically tricky, it would be possible to send an infected update to a customer if the vendor were ordered to do so.

When asked if it had ever received such a court order, Microsoft demurred. "Microsoft frequently has confidential conversations with both customers and government agencies and does not comment on those conversations," a company representative said. Of the 13 companies surveyed, McAfee was the other company that declined to answer. (Two others could not be reached as of Tuesday morning.)

Some security companies refused to reply to the initial version of our survey, which broadly asked about fedware whitelisting. In response, we revised the question to ask if they would alert a customer to the presence of keystroke loggers installed by a police or intelligence agency "in the absence of a lawful court order signed by a judge."

Cris Paden, Symantec's manger of corporate public relations, initially declined to reply. "There are legitimate reasons for not giving blanket guarantees--one of those is a court order," he said at first. "There are extenuating circumstances and gray issues."

But after we altered the question, Paden replied: "Barring a court order to cooperate with law enforcement authorities, Symantec would definitely alert our customers to the presence of any malicious code or programs that we detect on their systems." He added that Symantec had "absolutely not" received any such a court order.

One danger with whitelisting fedware is that it creates a potentially serious vulnerability in security software. If a malicious vendor of spyware were clever enough to mimic the whitelisted government spyware, it would also go undetected.

But if fedware becomes more common, savvy criminals could simply turn to open-source software that's less likely to have backdoors for police. ClamAV and OpenAntiVirus.org both offer open-source security software, and it's also possible to boot off of a CD-ROM and inspect the hard drive for malicious tampering.

At the moment, at least, there aren't any industry standards about detecting fedware. "CSIA does not currently have a position on this issue nor has the issue ever been addressed by its board of directors," said Tim Bennett, president of the Cyber Security Industry Alliance."

US Department of Justice: We don't need warrants for email, Facebook chats

 http://news.cnet.com/8301-13578_3-57583395-38/doj-we-dont-need-warrants-for-e-mail-facebook-chats/

The U.S. Department of Justice and the FBI believe they don't need a search warrant to review Americans' e-mails, Facebook chats, Twitter direct messages, and other private files, internal documents reveal.

Government documents obtained by the American Civil Liberties Union and provided to CNET show a split over electronic privacy rights within the Obama administration, with Justice Department prosecutors and investigators privately insisting they're not legally required to obtain search warrants for e-mail. The IRS, on the other hand, publicly said last month that it would abandon a controversial policy that claimed it could get warrantless access to e-mail correspondence.

The U.S. attorney for Manhattan circulated internal instructions, for instance, saying a subpoena -- a piece of paper signed by a prosecutor, not a judge -- is sufficient to obtain nearly "all records from an ISP." And the U.S. attorney in Houston recently obtained the "contents of stored communications" from an unnamed Internet service provider without securing a warrant signed by a judge first.

"We really can't have this patchwork system anymore, where agencies get to decide on an ad hoc basis how privacy-protective they're going to be," says Nathan Wessler, an ACLU staff attorney specializing in privacy topics who obtained the documents through open government laws. "Courts and Congress need to step in."

The Justice Department's disinclination to seek warrants for private files stored on the servers of companies like Apple, Google, and Microsoft continued even after a federal appeals court in 2010 ruled that warrantless access to e-mail violates the Fourth Amendment. A previously unreleased version of an FBI manual (PDF), last updated two-and-a-half years after the appellate ruling, says field agents "may subpoena" e-mail records from companies "without running afoul of" the Fourth Amendment.
The department did not respond to queries from CNET Tuesday. The FBI said in a statement that:

In all investigations, the FBI obtains evidence in accordance with the laws and Constitution of the United States, and consistent with Attorney General guidelines. Our field offices work closely with U.S. Attorney's Office to adhere to the legal requirements of their particular districts as set forth in case law or court decisions/precedent.

Not all U.S. attorneys have attempted to obtain Americans' stored e-mail correspondence without a warrant. The ACLU persuaded a judge to ask whether warrantless e-mail access has taken place in six of the 93 U.S. Attorneys' offices -- including the northern California office that's prosecuted an outsize share of Internet cases. The answer, according to assistant U.S. attorney Christopher Hardwood, was "no."

Still, the position taken by other officials -- including the authors of the FBI's official surveillance manual -- puts the department at odds with a growing sentiment among legislators who insist that Americans' private files should be protected from warrantless search and seizure. They say the same Fourth Amendment privacy standards that require police to obtain search warrants before examining hard drives in someone's living room, or a physical letter stored in a filing cabinet, should apply.

In response to prodding from Sen. Ron Wyden (left), acting IRS commissioner Steven Miller (right) said last month that the agency would change its written policies.

(Credit: U.S. Senate) 

 

After the IRS's warrantless e-mail access policy came to light last month, a dozen Republican and Democratic senators rebuked the agency. Their letter (PDF) opposing warrantless searches by the IRS and signed by senators including Mark Udall (D-Colo.), Mike Lee (R-Utah), Rand Paul (R-Ky.), and Ron Wyden (D-Ore.) said: "We believe these actions are a clear violation of the Fourth Amendment's prohibition against unreasonable searches and seizures."

Steven Miller, the IRS' acting commissioner, said during a Senate hearing that the policy would be changed for e-mail. But he left open the possibility that non-email data -- Google Drive and Dropbox files, private Facebook and Twitter messages, and so on -- could be accessed without a warrant.

Albert Gidari, a partner at the Perkins Coie law firm who represents technology companies, said since the Sixth Circuit Court of Appeals' 2010 ruling in U.S. v. Warshak, the Justice Department has generally sought court warrants for the content of e-mail messages, but is far less inclined to take that step for non-email files.

Before the Warshak decision, the general rule since 1986 had been that police could obtain Americans' e-mail messages that were more than 180 days old with an administrative subpoena or what's known as a 2703(d) order, both of which lack a warrant's probable cause requirement and are less privacy protective. Some e-mail providers, including Google, Microsoft, Yahoo, and Facebook, but not all, have taken the position after Warshak that the Fourth Amendment mandates warrants for e-mail all over the country.

The 180-day rule stems from the Electronic Communications Privacy Act, which was adopted in the era of telephone modems, BBSs, and UUCP links, and long before gigabytes of e-mail stored in the cloud was ever envisioned. Since then, the appeals court ruled in Warshak, technology had changed dramatically: "Since the advent of e-mail, the telephone call and the letter have waned in importance, and an explosion of Internet-based communication has taken place. People are now able to send sensitive and intimate information, instantaneously, to friends, family, and colleagues half a world away... By obtaining access to someone's e-mail, government agents gain the ability to peer deeply into his activities."

A phalanx of companies, including Amazon, Apple, AT&T, eBay, Google, Intel, Microsoft, and Twitter, as well as liberal, conservative, and libertarian advocacy groups, have asked Congress to update ECPA to make it clear that law enforcement needs a warrant to access private communications and the locations of mobile devices.

In November, a Senate panel approved the e-mail warrant requirement, and acted again last month. Rep. Zoe Lofgren, a Democrat whose district includes the heart of Silicon Valley, introduced similar legislation in the House of Representatives.

The political pressure, coupled with public petitions and increased adoption of cloud-based services, has had an effect. In 2011, James Baker, the associate deputy attorney general, warned that requiring search warrants to obtain stored e-mail could have an "adverse impact" on criminal investigations. By March 2013, however, Elana Tyrangiel, an acting assistant attorney general, indicated that the department would acquiesce on some privacy reforms.

"They dropped their opposition in Congress, but they're going to try to wiggle out from under the Fourth Amendment whenever possible," says the ACLU's Wessler. "They probably realize that they couldn't figure out a way to respond to hard questions from Congress anymore."

Separately, the New York Times reported Tuesday evening that the Obama administration may embrace the FBI's proposal for a federal law mandating that tech companies build in backdoors for surveillance. CNET reported last year that the FBI has asked the companies not to oppose such legislation, and that the FBI has been building a case for a new law by collecting examples of how communications companies have stymied government agencies.

Last week, FBI former counterterrorism agent Tim Clemente told CNN that, in national security investigations, the bureau can access records of a previously-made telephone call. "All of that stuff is being captured as we speak whether we know it or like it or not," he said. Clemente added in an appearance the next day that, thanks to the "intelligence community" -- a likely reference to the National Security Agency -- "there's a way to look at digital communications in the past."