On the 21st floor of a high-rise hotel in Cleveland, in a room full of political operatives, Microsoft’s Research Division was advertising a technology that could read each facial expression in a massive crowd, analyze the emotions, and report back in real time. “You could use this at a Trump rally,” a sales representative told me.
At both the Republican and Democratic conventions, Microsoft sponsored event spaces for the news outlet Politico. Politico, in turn, hosted a series of Microsoft-sponsored discussions about the use of data technology in political campaigns. And throughout Politico’s spaces in both Philadelphia and Cleveland, Microsoft advertised an array of products from “Microsoft Cognitive Services,” its artificial intelligence and cloud computing division.
At one exhibit, titled “Realtime Crowd Insights,” a small camera scanned the room, while a monitor displayed the captured image. Every five seconds, a new image would appear with data annotated for each face — an assigned serial number, gender, estimated age, and any emotions detected in the facial expression. When I approached, the machine labeled me “b2ff” and correctly identified me as a 23-year-old male.
1More
2More
'Pirate' Site ISP Blockades Reversed By Court | TorrentFreak - 0 views
-
" Andy on July 17, 2014 C: 0 Breaking As Spain struggles with its continuing online piracy problems, a local court has issued an order for several file-sharing sites to be unblocked by ISPs. The decision overturns a ruling in May which required the service providers to censor torrent and download sites on copyright infringement grounds."
-
" Andy on July 17, 2014 C: 0 Breaking As Spain struggles with its continuing online piracy problems, a local court has issued an order for several file-sharing sites to be unblocked by ISPs. The decision overturns a ruling in May which required the service providers to censor torrent and download sites on copyright infringement grounds."
4More
shared by Gonzalo San Gil, PhD. on 07 Nov 14
- No Cached
Carriers Tell U.S. 'No' to Plans for Internet Fast Lanes - 1 views
www.eweek.com/...s-for-internet-fast-lanes.html
AT&T Verizon Comcast carriers u s no plans internet fast lanes balance citizens action victory if true struggle
![](/images/link.gif)
-
[# Another little freedom battle won by citizens...] "In recent letters, AT&T, Comcast and Verizon said they have no plans to seek deals with content providers that would give faster Internet performance in exchange for special payments."
- ...1 more comment...
-
[# Another little freedom battle won by citizens...] "In recent letters, AT&T, Comcast and Verizon said they have no plans to seek deals with content providers that would give faster Internet performance in exchange for special payments."
-
"In recent letters, AT&T, Comcast and Verizon said they have no plans to seek deals with content providers that would give faster Internet performance in exchange for special payments." [ # How Good it would be # ! ... if it were #true... # ! #Time Will '#Tell' # ! And, if real, it will be thanks to citizens' #coordinated #struggle...]
-
Too early to declare victory. The battle isn't over until FCC adopts regulations *forbidding* the carriers from charging extra for faster data transmission. Company statements using weasel words like they "have no plans" leave a wide open door to change their minds after a regulation is adopted that permits the surcharges to be made. It could be a ploy to dampen the number of emails the FCC, the White House, and Congress are receiving. In matters of the public interest law type, what the corporate side says is irrelevant and frequently is a lie. What matters is the wording of the final rule.
2More
shared by Gonzalo San Gil, PhD. on 07 Apr 15
- No Cached
The new struggles facing open source | ITworld - 0 views
www.itworld.com/...uggles-facing-open-source.html
new struggles open source faces facing control code sharecropping fauxpen source n00b-sniping
![](/images/link.gif)
1More
7 Truths that Open Source Struggles With - Datamation - 0 views
1More
Fcforum 2013 | Free Culture Forum 2013 - 0 views
-
[ "Once again this year we gather at the FCForum in Barcelona, ready to analyse the advances of the past twelve months and consider the future outlook in the struggle for democracy in the digital era, free culture and net neutrality. For several years at the FCForum we've worked tirelessly around the tools and problems of network democracy. Since the emergence of Web 2.0, user-generated content has gone from being an interesting social experiment to the digital reality that we immerse ourselves in each day. Meanwhile, the content generated by former "big" media outlets makes up less than 5% of Internet traffic in societies such as Spain." ...]
1More
Can Mozilla Halt Firefox's Slide and Break Up the Mobile Internet Duopoly? | MIT Techno... - 0 views
1More
shared by Gary Edwards on 02 Jan 09
- Cached
AppleInsider | Intel says iPhone not capable of 'full Internet' - 0 views
www.appleinsider.com/..._capable_of_full_internet.html
x86 wintel powerpv atom arm apple intel openCL openGL
![](/images/link.gif)
-
"If you want to run full internet, you're going to have to run an Intel-based architecture," Wall told the gathering of engineers. He said the "iPhone struggles" when tasked with running "any sort of application that requires any horse power." When i read this, the proverbial light went on. The WinTel empire was based on business software applications requiring a DOS-Windows OS running on Intel x86 architecture. The duopoly became legendary for it's efforts to maintain control over all things software. This statement however says something else. Intel believes that the Web platform is the platform of the future; not Windows! Intel is determined to promote this idea that the Web runs best on an Intel architecture. Interesting change of perspective for partner Microsoft.
1More
shared by Gary Edwards on 19 Feb 09
- Cached
Desktop Web Applications using Sproutcore | rapid apps group - low cost, ethical web de... - 0 views
rapidappsgroup.com/...-applications-using-sproutcore
desktop webos webkit sproutcore javascript ruby
![](/images/link.gif)
-
Good article discussing the rapid advance of a WebOS for Web Applications based on the WebKit JavaScript model. Author focuses on Apple's SproutCore - Object C framework, but provides a very broad scope of discussion. Interesting stuff concerning the relationship between JavaScript, the SproutCore Framework, and Ruby. I found the link to this at the ReadWriteWeb story, "The Future of the Desktop" ........ "Desktop web applications offer the convenience of desktop applications and the interconnected power of web applications. This article looks at what they are, how they may evolve and focuses on Sproutcore, an open source framework for building them: The Internet is still evolving and the familiar struggle over who will control the platform of future web applications is still ongoing. Companies like Microsoft and Adobe provide platforms that build slick web applications but their aim is to dominate with proprietary systems that will effectively replace the browser. On the other side you have Google and Apple who have developed or support open web standards for developing web applications. If the proprietary companies win, future web applications could be locked into their systems and the incredible innovation that has driven the web to date may begin to falter.
1More
An Enterprise Content Breakthrough? : InternetNews Realtime IT News - 0 views
-
The hope is that a new specification will help companies finally handle and manage all the information stored in different repositories throughout the enterprise. Enterprises have been struggling for years to leverage all the information on business processes they have stored away in order to conduct business better. The problem is much of this information is created in unstructured documents, such as spreadsheets and word processing documents, rather than in a database, making it difficult to control and manage. Several vendors offer enterprise content management (ECM) solutions to deal with unstructured documents, but different vendors' solutions do not talk to each other. Businesses store their unstructured documents in multiple repositories from different vendors, so they have to spend a great deal of time and money to integrate these repositories so they can communicate with one another. A potential solution, the Content Management Interoperability Services (CMIS) specification, was announced today by tech heavyweights Microsoft, IBM and EMC.
1More
Cloud computing and the return of the platform wars | The Open Web takes on the Open Cl... - 0 views
-
Excellent article on Cloud Computing and the need for an Open API from Dion Hinchcliffe. Solid analysis, deeply linked, with some good graphics: "....The final outcome of this struggle, as it's been in many earlier platform battles over personal computer hardware, operating systems, databases, and even the Web itself, will be the result of a fairly predictable and oft-repeated cycle of events (see diagram below) for which a small number of large winners are likely to emerge victorious...." "When we look back many years from now, it's probable that cloud computing will be regarded as both a momentous and major change of course in the history of software; many future computing platforms will be created and operated by what seemingly amount to utility companies. While this might seem like a boring future for computing, it's a necessarily pragmatic evolution as the very size and scope of modern software requires new economic models in order to remain cost effective. Virtually any online application these days has to scale to a few million users as quickly and inexpensively as possible....."
1More
RDFa, Drupal and a Practical Semantic Web - 1 views
-
CMSWire has a brief explanation of RDFa and why it's important. RDFa is also finding it's way into the Drupal CMS, which could be a game changer. Timothy Berners-Lee vision of a "Semantic Web" where the meaning of content is understood by both humans and machines depends on the emergence of capable information systems that make it transparently easy to add semantic markup. I'm not surprised that Drupal is jumping with both feet.
"... In the march toward creating the semantic web, web content management systems such as Drupal (news, site) and many proprietary vendors struggle with the goal of emitting structured information that other sites and tools can usefully consume. There's a balance to be struck between human and machine utility, not to mention simplicity of instrumentation.
With RDFa (see W3C proposal), software and web developers have the specification they need to know how to structure data in order to lend meaning both to machines and to humans, all in a single file. And from what we've seen recently, the Drupal community is making the best of it.
1More
shared by Gonzalo San Gil, PhD. on 01 Dec 14
- No Cached
Hollywood vs. Silicon Valley: Call in the Celebrities! Or Not. | Re/code - 0 views
recode.net/...call-in-the-celebrities-or-not
Hollywood vs. Silicon Valley alieanation entertainment empowering technology clash or conspiration
![](/images/link.gif)
6More
shared by Paul Merrell on 07 Aug 16
- No Cached
Microsoft Pitches Technology That Can Read Facial Expressions at Political Rallies - 1 views
theintercept.com/...pressions-at-political-rallies
facial-recognition emotion-recognition cloud computing Microsoft
![](/images/link.gif)
-
“Realtime Crowd Insights” is an Application Programming Interface (API), or a software tool that connects web applications to Microsoft’s cloud computing services. Through Microsoft’s emotional analysis API — a component of Realtime Crowd Insights — applications send an image to Microsoft’s servers. Microsoft’s servers then analyze the faces and return emotional profiles for each one. In a November blog post, Microsoft said that the emotional analysis could detect “anger, contempt, fear, disgust, happiness, neutral, sadness or surprise.” Microsoft’s sales representatives told me that political campaigns could use the technology to measure the emotional impact of different talking points — and political scientists could use it to study crowd response at rallies.
-
Facial recognition technology — the identification of faces by name — is already widely used in secret by law enforcement, sports stadiums, retail stores, and even churches, despite being of questionable legality. As early as 2002, facial recognition technology was used at the Super Bowl to cross-reference the 100,000 attendees to a database of the faces of known criminals. The technology is controversial enough that in 2013, Google tried to ban the use of facial recognition apps in its Google glass system. But “Realtime Crowd Insights” is not true facial recognition — it could not identify me by name, only as “b2ff.” It did, however, store enough data on each face that it could continuously identify it with the same serial number, even hours later. The display demonstrated that capability by distinguishing between the number of total faces it had seen, and the number of unique serial numbers. Photo: Alex Emmons
- ...2 more annotations...
-
Instead, “Realtime Crowd Insights” is an example of facial characterization technology — where computers analyze faces without necessarily identifying them. Facial characterization has many positive applications — it has been tested in the classroom, as a tool for spotting struggling students, and Microsoft has boasted that the tool will even help blind people read the faces around them. But facial characterization can also be used to assemble and store large profiles of information on individuals, even anonymously.
-
Alvaro Bedoya, a professor at Georgetown Law School and expert on privacy and facial recognition, has hailed that code of conduct as evidence that Microsoft is trying to do the right thing. But he pointed out that it leaves a number of questions unanswered — as illustrated in Cleveland and Philadelphia. “It’s interesting that the app being shown at the convention ‘remembered’ the faces of the people who walked by. That would seem to suggest that their faces were being stored and processed without the consent that Microsoft’s policy requires,” Bedoya said. “You have to wonder: What happened to the face templates of the people who walked by that booth? Were they deleted? Or are they still in the system?” Microsoft officials declined to comment on exactly what information is collected on each face and what data is retained or stored, instead referring me to their privacy policy, which does not address the question. Bedoya also pointed out that Microsoft’s marketing did not seem to match the consent policy. “It’s difficult to envision how companies will obtain consent from people in large crowds or rallies.”
-
But nobody is saying that the output of this technology can't be combined with the output of facial recognition technology to let them monitor you individually AND track your emotions. Fortunately, others are fighting back with knowledge and tech to block facial recognition. http://goo.gl/JMQM2W
10More
BitTorrent Sync creates private, peer-to-peer Dropbox, no cloud required | Ars Technica - 6 views
-
BitTorrent today released folder syncing software that replicates files across multiple computers using the same peer-to-peer file sharing technology that powers BitTorrent clients. The free BitTorrent Sync application is labeled as being in the alpha stage, so it's not necessarily ready for prime-time, but it is publicly available for download and working as advertised on my home network. BitTorrent, Inc. (yes, there is a legitimate company behind BitTorrent) took to its blog to announce the move from a pre-alpha, private program to the publicly available alpha. Additions since the private alpha include one-way synchronization, one-time secrets for sharing files with a friend or colleague, and the ability to exclude specific files and directories.
-
BitTorrent Sync provides "unlimited, secure file-syncing," the company said. "You can use it for remote backup. Or, you can use it to transfer large folders of personal media between users and machines; editors and collaborators. It’s simple. It’s free. It’s the awesome power of P2P, applied to file-syncing." File transfers are encrypted, with private information never being stored on an external server or in the "cloud." "Since Sync is based on P2P and doesn’t require a pit-stop in the cloud, you can transfer files at the maximum speed supported by your network," BitTorrent said. "BitTorrent Sync is specifically designed to handle large files, so you can sync original, high quality, uncompressed files."
-
Direct P2P encrypted file syncing, no cloud intermediate, which should translate to far more secure exchange of files, with less opportunity for snooping by governments or others, than with cloud-based services.
- ...5 more comments...
-
Hey Paul, is there an open source document management system that I could hook the BitTorrent Sync to?
-
More detail please. What do you want to do with the doc management system? Platform? Server-side or stand-alone? Industrial strength and highly configurable or lightweight and simple? What do you mean by "hook?" Not that I would be able to answer anyway. I really know very little about BitTorrent Sync. In fact, as far as I'd gone before your question was to look at the FAQ. It's linked from . But there's a link to a forum on the same page. Giving the first page a quick scan confirms that this really is alpha-state software. But that would probably be a better place to ask. (Just give them more specific information of what you'd like to do.) There are other projects out there working on getting around the surveillance problem. I2P is one that is a farther along than BitTorrent Sync and quite a bit more flexible. See . (But I haven't used it, so caveat emptor.)
-
There is a great list of PRISM Proof software at http://prism-break.org/. Includes a link to I2P. I want to replace gmail though, but would like another Web based system since I need multi device access. Of course, I need to replace my Google Apps / Google Docs system. That's why I asked about a PRISM Proof sync-share-store DMS. My guess is that there are many users similarly seeking a PRISM Proof platform of communications, content and collaborative computing systems. BusinessIndiser.com is crushed with articles about Google struggling to squirm out from under the NSA PRISM boot-on-the-back-of-their-neck situation. As if blaming the NSA makes up for the dragnet that they consented/allowed/conceded to cover their entire platform. Perhaps we should be watching Germany? There must be tons of startup operations underway, all seeking to replace Google, Amazon, FaceBook, Microsoft, Skype and so many others. It's a great day for Libertyware :)
-
Is the NSA involvement the "Kiss of Death"? Google seems to think so. I'm wondering what the impact would be if ZOHO were to announce a PRISM Proof productivity platform?
-
It is indeed. The E.U. has far more protective digital privacy rights than we do (none). If you're looking for a Dropbox replacement (you should be), for a cloud-based solution take a look at . Unlike Dropbox, all of the encryption/decryption happens on your local machine; Wuala never sees your files unencrypted. Dropbox folks have admitted that there's no technical barrier to them looking at your files. Their encrypt/decrypt operations are done in the cloud (if they actually bother) and they have the key. Which makes it more chilling that the PRISM docs Snowden link make reference to Dropbox being the next cloud service NSA plans to add to their collection. Wuala also is located (as are its servers) in Switzerland, which also has far stronger digital data privacy laws than the U.S. Plus the Swiss are well along the path to E.U. membership; they've ratified many of the E.U. treaties including the treaty on Human Rights, which as I recall is where the digital privacy sections are. I've begun to migrate from Dropbox to Wuala. It seems to be neck and neck with Dropbox on features and supported platforms, with the advantage of a far more secure approach and 5 GB free. But I'd also love to see more approaches akin to IP2 and Bittorrent Sync that provide the means to bypass the cloud. Don't depend on government to ensure digital privacy, route around the government voyeurs. Hmmm ... I wonder if the NSA has the computer capacity to handle millions of people switching to encrypted communication? :-) Thanks for the link to the software list.
-
Re: Google. I don't know if it's the 'kiss of death" but they're definitely going to take a hit, particularly outside the U.S. BTW, I'm remembering from a few years back when the ODF Foundation was still kicking. I did a fair bit of research on the bureaucratic forces in the E.U. that were pushing for the Open Document Exchange Formats. That grew out of a then-ongoing push to get all of the E.U. nations connected via a network that is not dependent on the Internet. It was fairly complete at the time down to the national level and was branching out to the local level and the plan from there was to push connections to business and then to Joe Sixpack and wife. Interop was key, hence ODEF. The E.U. might not be that far away from an ability to sever the digital connections with the U.S. Say a bunch of daisy-chained proxy anonymizers for communications with the U.S. Of course they'd have to block the UK from the network and treat it like it is the U.S. There's a formal signals intelligence service collaboration/integration dating back to WW 2, as I recall, among the U.S., the U.K., Canada, Australia, and New Zealand. Don't remember its name. But it's the same group of nations that were collaborating on Echelon. So the E.U. wouldn't want to let the UK fox inside their new chicken coop. Ah, it's just a fantasy. The U.S. and the E.U. are too interdependent. I have no idea hard it would be for the Zoho folk to come up with desktop/side encryption/decryption. And I don't know whether their servers are located outside the reach of a U.S. court's search warrant. But I think Google is going to have to move in that direction fast if it wants to minimize the damage. Or get way out in front of the hounds chomping at the NSA's ankles and reduce the NSA to compost. OTOH, Google might be a government covert op. for all I know. :-) I'm really enjoying watching the NSA show. Who knows what facet of their Big Brother operation gets revealed next?
-
ZOHO is an Indian company with USA marketing offices. No idea where the server farm is located, but they were not on the NSA list. I've known Raju Vegesna for years, mostly from the old Web 2.0 and Office 2.0 Conferences. Raju runs the USA offices in Santa Clara. I'll try to catch up with him on Thursday. How he could miss this once in a lifetime moment to clean out Google, Microsoft and SalesForce.com is something I'd like to find out about. Thanks for the Wuala tip. You sent me that years ago, when i was working on research and design for the SurDocs project. Incredible that all our notes, research, designs and correspondence was left to rot in Google Wave! Too too funny. I recall telling Alex from SurDocs that he had to use a USA host, like Amazon, that could be trusted by USA customers to keep their docs safe and secure. Now look what i've done! I've tossed his entire company information set into the laps of the NSA and their cabal of connected corporatists :)
11More
shared by Paul Merrell on 08 Jun 14
- No Cached
Internet Giants Erect Barriers to Spy Agencies - NYTimes.com - 0 views
www.nytimes.com/...-barriers-to-spy-agencies.html
surveillance-state NSA-reform DIY-reform internet-hardening digital-privacy
![](/images/link.gif)
-
As fast as it can, Google is sealing up cracks in its systems that Edward J. Snowden revealed the N.S.A. had brilliantly exploited. It is encrypting more data as it moves among its servers and helping customers encode their own emails. Facebook, Microsoft and Yahoo are taking similar steps.
-
After years of cooperating with the government, the immediate goal now is to thwart Washington — as well as Beijing and Moscow. The strategy is also intended to preserve business overseas in places like Brazil and Germany that have threatened to entrust data only to local providers. Google, for example, is laying its own fiber optic cable under the world’s oceans, a project that began as an effort to cut costs and extend its influence, but now has an added purpose: to assure that the company will have more control over the movement of its customer data.
-
A year after Mr. Snowden’s revelations, the era of quiet cooperation is over. Telecommunications companies say they are denying requests to volunteer data not covered by existing law. A.T.&T., Verizon and others say that compared with a year ago, they are far more reluctant to cooperate with the United States government in “gray areas” where there is no explicit requirement for a legal warrant.
- ...8 more annotations...
-
Eric Grosse, Google’s security chief, suggested in an interview that the N.S.A.'s own behavior invited the new arms race.“I am willing to help on the purely defensive side of things,” he said, referring to Washington’s efforts to enlist Silicon Valley in cybersecurity efforts. “But signals intercept is totally off the table,” he said, referring to national intelligence gathering.“No hard feelings, but my job is to make their job hard,” he added.
-
In Washington, officials acknowledge that covert programs are now far harder to execute because American technology companies, fearful of losing international business, are hardening their networks and saying no to requests for the kind of help they once quietly provided.Continue reading the main story Robert S. Litt, the general counsel of the Office of the Director of National Intelligence, which oversees all 17 American spy agencies, said on Wednesday that it was “an unquestionable loss for our nation that companies are losing the willingness to cooperate legally and voluntarily” with American spy agencies.
-
Many point to an episode in 2012, when Russian security researchers uncovered a state espionage tool, Flame, on Iranian computers. Flame, like the Stuxnet worm, is believed to have been produced at least in part by American intelligence agencies. It was created by exploiting a previously unknown flaw in Microsoft’s operating systems. Companies argue that others could have later taken advantage of this defect.Worried that such an episode undercuts confidence in its wares, Microsoft is now fully encrypting all its products, including Hotmail and Outlook.com, by the end of this year with 2,048-bit encryption, a stronger protection that would take a government far longer to crack. The software is protected by encryption both when it is in data centers and when data is being sent over the Internet, said Bradford L. Smith, the company’s general counsel.
-
Mr. Smith also said the company was setting up “transparency centers” abroad so that technical experts of foreign governments could come in and inspect Microsoft’s proprietary source code. That will allow foreign governments to check to make sure there are no “back doors” that would permit snooping by United States intelligence agencies. The first such center is being set up in Brussels.Microsoft has also pushed back harder in court. In a Seattle case, the government issued a “national security letter” to compel Microsoft to turn over data about a customer, along with a gag order to prevent Microsoft from telling the customer it had been compelled to provide its communications to government officials. Microsoft challenged the gag order as violating the First Amendment. The government backed down.
-
Hardware firms like Cisco, which makes routers and switches, have found their products a frequent subject of Mr. Snowden’s disclosures, and their business has declined steadily in places like Asia, Brazil and Europe over the last year. The company is still struggling to convince foreign customers that their networks are safe from hackers — and free of “back doors” installed by the N.S.A. The frustration, companies here say, is that it is nearly impossible to prove that their systems are N.S.A.-proof.
-
In one slide from the disclosures, N.S.A. analysts pointed to a sweet spot inside Google’s data centers, where they could catch traffic in unencrypted form. Next to a quickly drawn smiley face, an N.S.A. analyst, referring to an acronym for a common layer of protection, had noted, “SSL added and removed here!”
-
Facebook and Yahoo have also been encrypting traffic among their internal servers. And Facebook, Google and Microsoft have been moving to more strongly encrypt consumer traffic with so-called Perfect Forward Secrecy, specifically devised to make it more labor intensive for the N.S.A. or anyone to read stored encrypted communications.One of the biggest indirect consequences from the Snowden revelations, technology executives say, has been the surge in demands from foreign governments that saw what kind of access to user information the N.S.A. received — voluntarily or surreptitiously. Now they want the same.
-
The latest move in the war between intelligence agencies and technology companies arrived this week, in the form of a new Google encryption tool. The company released a user-friendly, email encryption method to replace the clunky and often mistake-prone encryption schemes the N.S.A. has readily exploited.But the best part of the tool was buried in Google’s code, which included a jab at the N.S.A.'s smiley-face slide. The code included the phrase: “ssl-added-and-removed-here-; - )”
1More
No Fake Internet - 0 views
-
Zuckerberg's Internet.org will control what billions do online People in countries like India,1,2,3 Zimbabwe,4 Brazil,5 and Paraguay6 are speaking out about Facebook's so-called Internet.org platform and its ability to control what billions of Internet users can do online.7,8 Zuckerberg's partnership with telecom giants, Internet.org, provides access to a fake Internet where selected services are prioritized over others.9 This scheme threatens innovation,10 free expression,11 and privacy online12 It blocks many of the websites, apps, and services the world loves from being made available on equal terms.13 The fake Internet will also restrict access to local service providers struggling to get a foothold online.14 We all deserve access to the real open Internet. Stand with people around the world demanding Zuckerberg stops restricting access to the open Internet.
1More
The Struggle for the Soul of the Web: Flash and Silverlight challenge the Open Web - 0 views
-
Just because the web has been open so far doesn't mean that it will stay that way. Flash and Silverlight, arguably the two market-leading technology toolkits for rich media applications are not open. Make no mistake - Microsoft and Adobe aim to have their proprietary plug-ins, aka pseudo-browsers, become the rendering engines for the next generation of the Web.
10More
shared by Paul Merrell on 26 Jan 15
- No Cached
The Latest Rules on How Long NSA Can Keep Americans' Encrypted Data Look Too Familiar |... - 0 views
justsecurity.org/...s-hold-encrypted-data-familiar
surveillance state NSA IAA-2015 Sect-309 legislation
![](/images/link.gif)
-
Does the National Security Agency (NSA) have the authority to collect and keep all encrypted Internet traffic for as long as is necessary to decrypt that traffic? That was a question first raised in June 2013, after the minimization procedures governing telephone and Internet records collected under Section 702 of the Foreign Intelligence Surveillance Act were disclosed by Edward Snowden. The issue quickly receded into the background, however, as the world struggled to keep up with the deluge of surveillance disclosures. The Intelligence Authorization Act of 2015, which passed Congress this last December, should bring the question back to the fore. It established retention guidelines for communications collected under Executive Order 12333 and included an exception that allows NSA to keep ‘incidentally’ collected encrypted communications for an indefinite period of time. This creates a massive loophole in the guidelines. NSA’s retention of encrypted communications deserves further consideration today, now that these retention guidelines have been written into law. It has become increasingly clear over the last year that surveillance reform will be driven by technological change—specifically by the growing use of encryption technologies. Therefore, any legislation touching on encryption should receive close scrutiny.
-
Section 309 of the intel authorization bill describes “procedures for the retention of incidentally acquired communications.” It establishes retention guidelines for surveillance programs that are “reasonably anticipated to result in the acquisition of [telephone or electronic communications] to or from a United States person.” Communications to or from a United States person are ‘incidentally’ collected because the U.S. person is not the actual target of the collection. Section 309 states that these incidentally collected communications must be deleted after five years unless they meet a number of exceptions. One of these exceptions is that “the communication is enciphered or reasonably believed to have a secret meaning.” This exception appears to be directly lifted from NSA’s minimization procedures for data collected under Section 702 of FISA, which were declassified in 2013.
-
While Section 309 specifically applies to collection taking place under E.O. 12333, not FISA, several of the exceptions described in Section 309 closely match exceptions in the FISA minimization procedures. That includes the exception for “enciphered” communications. Those minimization procedures almost certainly served as a model for these retention guidelines and will likely shape how this new language is interpreted by the Executive Branch. Section 309 also asks the heads of each relevant member of the intelligence community to develop procedures to ensure compliance with new retention requirements. I expect those procedures to look a lot like the FISA minimization guidelines.
- ...6 more annotations...
-
This language is broad, circular, and technically incoherent, so it takes some effort to parse appropriately. When the minimization procedures were disclosed in 2013, this language was interpreted by outside commentators to mean that NSA may keep all encrypted data that has been incidentally collected under Section 702 for at least as long as is necessary to decrypt that data. Is this the correct interpretation? I think so. It is important to realize that the language above isn’t just broad. It seems purposefully broad. The part regarding relevance seems to mirror the rationale NSA has used to justify its bulk phone records collection program. Under that program, all phone records were relevant because some of those records could be valuable to terrorism investigations and (allegedly) it isn’t possible to collect only those valuable records. This is the “to find a needle a haystack, you first have to have the haystack” argument. The same argument could be applied to encrypted data and might be at play here.
-
This exception doesn’t just apply to encrypted data that might be relevant to a current foreign intelligence investigation. It also applies to cases in which the encrypted data is likely to become relevant to a future intelligence requirement. This is some remarkably generous language. It seems one could justify keeping any type of encrypted data under this exception. Upon close reading, it is difficult to avoid the conclusion that these procedures were written carefully to allow NSA to collect and keep a broad category of encrypted data under the rationale that this data might contain the communications of NSA targets and that it might be decrypted in the future. If NSA isn’t doing this today, then whoever wrote these minimization procedures wanted to at least ensure that NSA has the authority to do this tomorrow.
-
There are a few additional observations that are worth making regarding these nominally new retention guidelines and Section 702 collection. First, the concept of incidental collection as it has typically been used makes very little sense when applied to encrypted data. The way that NSA’s Section 702 upstream “about” collection is understood to work is that technology installed on the network does some sort of pattern match on Internet traffic; say that an NSA target uses example@gmail.com to communicate. NSA would then search content of emails for references to example@gmail.com. This could notionally result in a lot of incidental collection of U.S. persons’ communications whenever the email that references example@gmail.com is somehow mixed together with emails that have nothing to do with the target. This type of incidental collection isn’t possible when the data is encrypted because it won’t be possible to search and find example@gmail.com in the body of an email. Instead, example@gmail.com will have been turned into some alternative, indecipherable string of bits on the network. Incidental collection shouldn’t occur because the pattern match can’t occur in the first place. This demonstrates that, when communications are encrypted, it will be much harder for NSA to search Internet traffic for a unique ID associated with a specific target.
-
This lends further credence to the conclusion above: rather than doing targeted collection against specific individuals, NSA is collecting, or plans to collect, a broad class of data that is encrypted. For example, NSA might collect all PGP encrypted emails or all Tor traffic. In those cases, NSA could search Internet traffic for patterns associated with specific types of communications, rather than specific individuals’ communications. This would technically meet the definition of incidental collection because such activity would result in the collection of communications of U.S. persons who aren’t the actual targets of surveillance. Collection of all Tor traffic would entail a lot of this “incidental” collection because the communications of NSA targets would be mixed with the communications of a large number of non-target U.S. persons. However, this “incidental” collection is inconsistent with how the term is typically used, which is to refer to over-collection resulting from targeted surveillance programs. If NSA were collecting all Tor traffic, that activity wouldn’t actually be targeted, and so any resulting over-collection wouldn’t actually be incidental. Moreover, greater use of encryption by the general public would result in an ever-growing amount of this type of incidental collection.
-
This type of collection would also be inconsistent with representations of Section 702 upstream collection that have been made to the public and to Congress. Intelligence officials have repeatedly suggested that search terms used as part of this program have a high degree of specificity. They have also argued that the program is an example of targeted rather than bulk collection. ODNI General Counsel Robert Litt, in a March 2014 meeting before the Privacy and Civil Liberties Oversight Board, stated that “there is either a misconception or a mischaracterization commonly repeated that Section 702 is a form of bulk collection. It is not bulk collection. It is targeted collection based on selectors such as telephone numbers or email addresses where there’s reason to believe that the selector is relevant to a foreign intelligence purpose.” The collection of Internet traffic based on patterns associated with types of communications would be bulk collection; more akin to NSA’s collection of phone records en mass than it is to targeted collection focused on specific individuals. Moreover, this type of collection would certainly fall within the definition of bulk collection provided just last week by the National Academy of Sciences: “collection in which a significant portion of the retained data pertains to identifiers that are not targets at the time of collection.”
-
The Section 702 minimization procedures, which will serve as a template for any new retention guidelines established for E.O. 12333 collection, create a large loophole for encrypted communications. With everything from email to Internet browsing to real-time communications moving to encrypted formats, an ever-growing amount of Internet traffic will fall within this loophole.
-
Tucked into a budget authorization act in December without press notice. Section 309 (the Act is linked from the article) appears to be very broad authority for the NSA to intercept any form of telephone or other electronic information in bulk. There are far more exceptions from the five-year retention limitation than the encrypted information exception. When reading this, keep in mind that the U.S. intelligence community plays semantic games to obfuscate what it does. One of its word plays is that communications are not "collected" until an analyst looks at or listens to partiuclar data, even though the data will be searched to find information countless times before it becomes "collected." That searching was the major basis for a decision by the U.S. District Court in Washington, D.C. that bulk collection of telephone communications was unconstitutional: Under the Fourth Amendment, a "search" or "seizure" requiring a judicial warrant occurs no later than when the information is intercepted. That case is on appeal, has been briefed and argued, and a decision could come any time now. Similar cases are pending in two other courts of appeals. Also, an important definition from the new Intelligence Authorization Act: "(a) DEFINITIONS.-In this section: (1) COVERED COMMUNICATION.-The term ''covered communication'' means any nonpublic telephone or electronic communication acquired without the consent of a person who is a party to the communication, including communications in electronic storage."