NSA: Surveillance court says no upper limit on phone records collection

A U.S. surveillance court has given the National Security Agency no limit on the number of U.S. telephone records it collects in the name of fighting terrorism, the NSA director said Thursday.

The NSA intends to collect all U.S. telephone records and put them in a searchable “lock box” in the interest of national security, General Keith Alexander, the NSA’s director, told U.S. senators.

“There is no upper limit” on NSA telephone-records collection, Alexander said. “I believe it is in the nation’s best interest to put all the phone records into a lock box that we can search when the nation needs to do it.”

The NSA would need to notify the U.S. Foreign Intelligence Surveillance Court and Congress before collecting some other types of U.S. communications, including mobile-phone location information, Alexander told senators. The NSA doesn't currently have plans to collect mobile-phone location information, he said.

Alexander, other intelligence officials and several members of the Senate Select Committee on Intelligence defended the NSA’s data collection and surveillance efforts during a committee hearing.

The NSA collection of U.S. phone records, disclosed by former NSA contractor Edward Snowden earlier this year, are “lawful, effective and constitutional,” said Senator Dianne Feinstein, a California Democrat and chairwoman of the committee.

Nevertheless, Feinstein said she's working on a bill that would add transparency to the data collection process at the NSA and the surveillance court. Some of the provisions she described would reinforce current NSA practices, but the bill would also give the NSA new authority to continue to conduct surveillance on foreign suspects who enter the U.S. while the agency seeks court-ordered warrants.

Feinstein, chairwoman of the committee that's supposed to oversee the NSA surveillance programs, at one point interrupted witness Tim Edgar, a former director of privacy and civil liberties for the White House, when he talked about the NSA's unauthorized collection of some U.S. communications. Feinstein defended the NSA, saying the agency immediately reported the mistake to the surveillance court.

"I really believe the NSA is extraordinarily careful in what they do," she said. "I have great faith in the NSA."

Alexander, Director of National Intelligence James Clapper, and some committee members blamed what they called inaccurate media reports on the Snowden leaks for creating an environment of mistrust in the NSA by the general public.

Some media organizations are feeding “raw meat to people who refuse to look at the facts” that the NSA’s data collections are legal and protect privacy, said Senator Dan Coats, an Indiana Republican.

“It’s very frustrating to know that we have programs that comply with the law, that have been approved by the Congress, that have been approved by the president of the United States, that are saving Americans’ lives, and there are efforts to compromise those programs to convince a nontrusting public,” Coats said. “Had we not had these programs in place, I’d hate to think of what we’d be talking about” at the hearing.

Clapper agreed with Coats. Intelligence officials are frustrated in their efforts to “counter the popular narrative” about the surveillance programs, he said.

But Senator Ron Wyden, an Oregon Democrat and critic of the NSA programs, pointed his finger back at U.S. intelligence officials. Abuses alleged in the NSA programs were bound to be made public, said Wyden, who introduced legislation Wednesday that would prohibit bulk collection of phone records by the NSA.

“I believe that any government official who thought that the intrusive, constitutionally flawed surveillance system would never be disclosed was ignoring history,” Wyden said. “The leadership of your agencies built an intelligence collection system that repeatedly deceived the American people. Time and time again, the American people were told one thing about domestic surveillance in public forums, while government agencies did something else in private.”

Updated at 3:25 p.m. PT with additional information about mobile-phone location data collection.

Grant Gross covers technology and telecom policy in the U.S. government for The IDG News Service.
More by Grant Gross, IDG News Service

View the original article here

Court bars Apple from making industry-wide ebook deals

The other shoe has dropped: U.S. District Court Judge Denise Cote on Friday issued a permanent injunction against Apple in the ebook price-fixing suits brought against it by the Department of Justice as well as a similar case brought by 31 U.S. states, the District of Columbia, and Puerto Rico. The injunction, which takes effect 30 days from its issuance on Thursday, imposes several restrictions on the way Apple can conduct its ebook business over the next several years.

“We’re pleased that the court has issued an order supporting the Department of Justice’s efforts to address Apple’s illegal price fixing conduct,” said Assistant Attorney General Bill Baer of the DOJ’s Antitrust Division in a statement on the agency’s website. “Consumers will continue to benefit from lower ebooks prices as a result of the department’s enforcement action to restore competition in this important industry. By appointing an external monitor to ensure future compliance with the antitrust laws, the court has helped protect consumers from further misconduct by Apple. The court’s ruling reinforces the victory the department has won for consumers.”

Apple, however, is not yet ready to give up the fight. On Friday, company spokesperson Tom Neumayr told Macworld via email: “Apple did not conspire to fix ebook pricing. The iBookstore gave customers more choice and injected much needed innovation and competition into the market. Apple will pursue an appeal of the injunction.”

Most significantly, the terms of the final judgment dictate what manner of agreement Apple may make with the five publishers—Hachette, HarperCollins, Macmillan, Penguin, and Simon & Schuster—with whom the company was accused of conspiring. Unsurprisingly, Apple is not allowed to make any deals with those publishers that would potentially restrict Apple’s ability to offer cheaper ebooks. Those restrictions expire on a per-publisher basis: it may renegotiate with Hachette after 24 months, HarperCollins after 30 months, Simon & Schuster after 36 months, Penguin six months after that, and Macmillan another six months after that.

Crucially, such deals may not include any “most-favored nation” clause, which was one of the issues at the heart of the case. That practice prevented other retailers with whom the publishers had deals from undercutting Apple’s ebook prices by offering discounted prices. More generally, the judgment says Apple may not take part in any deal with publishers or retailers that would see ebook prices rise or be set at a particular level.

Of course, Apple is also barred from talking to publishers about its deals with any other publishers, or those companies’ strategies, pricing plans, agreements with authors, and so on. And the company may not take any retaliatory action against any publishers, regardless of whether or not Apple has an existing agreement with them.

In order to ensure Apple’s compliance with these terms, the judgment empowers two separate monitors. The first is a full-time antitrust compliance officer who is selected by Apple’s external directors (i.e. those not directly employed by Apple, which is basically anybody but CEO Tim Cook) and who is not employed by Apple.

That officer, who reports to the external directors, is responsible for informing and training Apple’s board, executive team, and other relevant employees in matters relating to the judgment itself. In addition, the compliance officer conducts annual audits, provides logs of communications between Apple and ebook retailers and publishers, and is required to correct any actual or potential violation of the terms of the judgment and report it to federal and state governments.

In addition to that monitor, the court will also appoint an external compliance monitor with consultation from Apple and the involved state governments. That monitor essentially reviews Apple’s internal antitrust compliance system to make sure that it meets with the letter of the law, recommending changes where necessary.

As with the antitrust compliance officer, it’s the external monitor’s job to report violations to the U.S. and state governments, though the monitor has no authority to investigate or pursue such matters directly. And though the external monitor is not an employee of Apple, the position’s expenses and salary will be paid by the company with oversight from the U.S. and state governments.

While the injunction is less strenuous than the terms pursued by the DOJ—which wanted, among other remedies, to apply antitrust regulations to Apple’s App Store and iTunes Store, as well—the company did object to the imposition of an external monitor. However, the final judgment makes it clear that an external monitor is an integral part of the compliance process.

Should the case not go to appeal, how badly would this injunction this affect Apple’s ebook business? It’s unclear at present, but it would certainly seem to put the company at a disadvantage when stacked up against its major competitor in the market, Amazon. Unlike Apple, Amazon continues to rely on the retailer model, where it buys books wholesale from publishers then sets the price wherever it wants to; Apple, on the other hand, was working on an agency model that gave the publishers a percentage of the selling price.

Amazon, for its part, doesn’t appear to be wasting any time solidifying its place in the market. Earlier this week it announced MatchBook, a new service that provides—for no or low cost—an ebook copy of any physical book that customers have purchased from Amazon.

While the terms of the judgment largely impose more overhead on Apple’s business, there’s no reason that the company shouldn’t still be able to succeed in the ebooks market—it just requires the company to come up with creative (and, naturally, legal) solutions for competing against the player in the market. And that’s something with which Apple has plenty of experience.

Dan has been writing about all things Apple since 2006, when he first started contributing to the MacUser blog. Since then he's covered most of the company's major product releases and reviewed every major revision of iOS. In his "copious" free time, he's usually grinding away on a novel or two.
More by Dan Moren

View the original article here

NSA collected thousands of domestic communications in 2011, court document shows

The National Security Agency was acquiring thousands of digital communications from Americans as of 2011, according to a declassified document from the Foreign Intelligence Surveillance Court.

The glimpse of the NSA's surveillance on people in the U.S. was revealed Wednesday in an 86-page court assessment of the constitutionality of agency's data collection methods. It was released by the Office of the Director of National Intelligence.

The 2011 assessment was based on NSA's own review of what the document refers to as "a statistically representative sample" drawn from the intelligence agency's collection of upstream data. "Upstream data" refers to Internet communications, such as email, as they transit, rather than to acquisitions directly from Internet service providers, the court document said.

The review revealed that NSA acquired roughly 2,000 to 10,000 "multi-communication transactions," or MCTs, each year that contain at least one wholly domestic communication. An MCT refers to the capture of multiple different communications at once, such as emails within a single webmail service, one staff member at the Electronic Frontier Foundation said. EFF has been fighting for the federal court to release the review for over a year.

The document also said that the NSA had been acquiring more than 250 million Internet communications in total each year.

The numbers help to shed new light on the scope of government surveillance into people's online communications in the name of national security.

Kurt Opsahl, senior staff attorney with the Electronic Frontier Foundation, called the figures "very significant."

"It shows that the NSA was misusing its authority for years and scanning the content of communications to do so," he said in an email.

The review also revealed a deception. Until NSA's manual review, "the government asserted that NSA had never found a wholly domestic communication in its upstream collection," the court opinion said.

The court expressed reservations throughout the document over the constitutionality of the NSA's data collection methods. Specifically, the procedures that the NSA used to target and minimize its data collection efforts among only foreigners who are of interest to national security issues "are inconsistent with the requirements of the Fourth Amendment," the document said.

The court also lamented a lack of information about the NSA's methods in its review. "The practical implications of NSA's acquisition of Internet transactions through its upstream collection for the Court's statutory and Fourth Amendment analyses are difficult to assess," the document said.

The document was released in response to a Freedom of Information Act lawsuit from the Electronic Frontier Foundation. The digital rights group called its release a victory, partly because it will help to encourage a public debate on the issue of government surveillance.

"Disclosing this opinion -- and releasing enough of it so that citizens and advocates can intelligently debate the constitutional violation that occurred -- is a critical step in ensuring that an informed debate takes place," EFF staff attorney Mark Rumold said in a statement.

The document's release comes just weeks after President Obama announced some sweeping reforms designed to limit data collection by the NSA under the Patriot Act.

Much of the issue of government surveillance has been pushed into the public consciousness following leaks made by former NSA contractor Edward Snowden.

Zach Miners covers social networking, search and general technology news for IDG News Service. Follow Zach on Twitter at @zachminers. Zach's e-mail address is zach_miners@idg.com

View the original article here

US appeals court upholds warrantless collection of phone location data

Warrants are not required by the U.S. government to access historical cell site information, an appeals court ruled in an order.

The Fourth Amendment to the U.S. Constitution protects only reasonable expectations of privacy, the U.S. Court of Appeals for the Fifth Circuit wrote in a 2-1 ruling on Tuesday. The Fourth Amendment protects against unreasonable searches and seizures.

"Because a cell phone user makes a choice to get a phone, to select a particular service provider, and to make a call, and because he knows that the call conveys cell site information, the provider retains this information, and the provider will turn it over to the police if they have a court order, he voluntarily conveys his cell site data each time he makes a call," the court added.

Cell site information is clearly a business record, collected by the service provider for its own business purposes, and without being asked to so by the government, the court said in the order.

The dispute hinged around whether law enforcement agents can access cell site data with a relatively easy-to-obtain order under section 2703 (d) of the Stored Communications Act, which is based on a showing of "specific and articulable facts," instead of using a search warrant after showing probable cause.

Rights groups American Civil Liberties Union and Electronic Frontier Foundation and others have argued that the government should be required to seek a warrant to access the location information, because it is sensitive and can reveal a great deal about a person. The groups argued in court that SCA grants courts the discretion to require the government to obtain a warrant based upon probable cause before accessing historical cell phone location data.

Ruling that compelled warrantless disclosure of cell site data violates the Fourth Amendment, a magistrate judge earlier denied a government request for the historical cell site data in three applications filed in October, 2010 under the SCA for seeking evidence relevant to three separate criminal investigations. The judge, however, allowed for providing subscriber information.

Following an appeal by the government, a district court held that data "disclosing the location of the telephone at the time of particular calls may be acquired only by a warrant issued on probable cause," as the records would show the date, time called, number, and location of the telephone when the call was made, which is constitutionally protected.

The Fifth Circuit court clarified that its ruling only covered section 2703(d) orders to obtain historical cell site information, and did not address, for example, orders requesting data from all phones that use a tower during a particular interval or "situations where the Government surreptitiously installs spyware on a target's phone or otherwise hijacks the phone's GPS, with or without the service provider's help."

The Supreme Court of New Jersey ruled earlier this month that cellphone users have a reasonable expectation of privacy of their cellphone location information, and police are required to get a search warrant before accessing the information. People are not promoting the release of personal information to others when making disclosures to phone companies, the court said in an unanimous ruling.

John Ribeiro covers outsourcing and general technology breaking news from India for The IDG News Service. Follow John on Twitter at @Johnribeiro. John's e-mail address is john_ribeiro@idg.com

John Ribeiro covers outsourcing and general technology breaking news from India for The IDG News Service.
More by John Ribeiro, IDG News Service

View the original article here

University condemns court ban of research paper on flaws in car lock system

A court ban on a research paper that analyzes flaws in a car-lock system should be overturned, according to the Dutch university that employs two of the three researchers who wrote the analysis.

The U.K. High Court of Justice banned the publication of the paper, “Dismantling Megamos Crypto: Wirelessly Lockpicking a Vehicle Immobilizer” on June 25, said the Radboud University Nijmegen in a news release on Monday. The ban came to the attention of the public when the U.K. newspaper The Guardian published a story about it over the weekend.

The U.K. court issued an interim block on the research paper, while considering a permanent ban on request of car manufacturer Volkswagen, the university added. French defense group Thales also requested the ban, according to a report by the BBC.

Roel Verdult and Baris Ege, of the Digital Security faculty at Radboud University, were planning to present their paper with Flavio Garcia a lecturer in Computer Science of the University of Birmingham during the USENIX Security Symposium in Washington, D.C., in August, the Dutch university said.

Verdult and Ege said in a joint email on Monday that they did not want to comment on the matter. Garcia did not return a request for comment.

“In their scientific article, they show that there is a fault in the security of the Megamos chip that is used in the immobilizer in different car brands,” the Radboud University said, adding that the chip was designed in the mid-90s and is outdated. “Nevertheless, it is still widely used in the automotive industry,” it said.

The research is based on publicly available information. In their paper, the researchers reveal the weakness of the chip in mathematical terms, the university said. The research “by no means reveals how to easily steal a car,” it said, adding that very different information is needed to do that.

Furthermore, the researchers informed the chip maker in November 2012, nine months before the intended publication of their paper, so that security measures could be taken, the university said. The researchers also urged the chip maker to inform their own customers from the outset, it added.

“The decision of the English court imposes severe restrictions on the freedom of academic research in a socially highly relevant field,” Radboud University said, adding that it nevertheless respects the decision of the court.

“The University of Birmingham is disappointed with the judgment which did not uphold the defence of academic freedom and public interest, but respects the decision,” a University of Birmingham spokesperson said in an email. It has decided to defer publication of the academic paper in any form while it obtains additional technical and legal advice.

Because the court is considering a final ruling, Radboud University spokeswoman Anja van Kessel declined to provide further comment, but said the university hopes the court will ultimately decide in favor of publication of the paper.

Volkswagen did not respond to a request for comment.

Loek Essers focuses on online privacy, intellectual property, open-source and online payment issues.
More by Loek Essers, IDG News Service

View the original article here