Protesters Call for an End to NSA Mass Surveillance

About 5,000 people attend a rally in Washington to protest NSA programs

 By Grant Gross
Sat, October 26, 2013 CIO

IDG News Service (Washington, D.C., Bureau) — A crowd of about 5,000 people, chanting "stop spying, stop lying" and "hey, ho, mass surveillance has got to go," marched through Washington, D.C., Saturday to protest the U.S. National Security Agency's mass surveillance programs unveiled in press reports this year.

Protesters, from a seemingly wide range of political beliefs, called on the U.S. Congress and President Barack Obama to end mass data collection and surveillance by the NSA.

"The government has granted itself power that it does not have," said former New Mexico Governor Gary Johnson, the 2012 Libertarian Party candidate for U.S. president. "We have to stand against this."

Hundreds in the crowd held signs or wore stickers thanking Edward Snowden, the former NSA contractor whose leaks to news organizations exposed mass surveillance and data collection programs at the spy agency. Others held signs with the text of the Fourth Amendment to the U.S. Constitution, which protests residents against unreasonable searches and seizures.

Another popular sticker, from antiwar group Code Pink, featured lipstick marks and the message, "Make out, not war."

During the rally, members of the groups Fight for the Future and Restore the Fourth delivered a petition, with more than 575,000 signatures, calling on Congress to investigate NSA surveillance programs, to Representative Justin Amash, a Michigan Republican an outspoken critic of the NSA surveillance programs.

Many politicians want people to believe that a small group of people can't make a difference in the U.S. government, said Craig Aaron, president and CEO of digital rights group Free Press. "It's not such a small group," he told the crowd. "There are millions of people siding with us."

The rally, organized by the StopWatching.us coalition, was held on the 12th anniversary of the date former U.S. President George W. Bush signed the controversial Patriot Act into law. The NSA has used portions of the Patriot Act as the foundation for its mass surveillance programs. Protests were also scheduled in a handful of other cities in the U.S. and Germany.

The NSA and members of the Obama administration have defended the data collection and surveillance programs as necessary to protect the U.S. against terrorism. While the NSA collects phone records in bulk, the agency only obtains content for phone calls when it suspects criminal activity, Obama administration officials have said.

Rally attendees said it was important for them to be at the event, although some were unsure if it would make a difference.

Showing up at the rally was a way of "doing something" instead of just complaining about the NSA, said Lauren Schreiber, community outreach and event coordinator at the Council on American Islamic Relations in Washington, D.C.

The Muslim community in the U.S. has long been the target of surveillance, she noted. "I feel like if the government doesn't respect the very basic right of privacy, then all of our other rights are going to be trampled," she said.

Paul Charnetzki IV traveled to Washington from Chicago to attend the rally. He's opposed to the increased surveillance in the U.S. since the Sept. 11, 2001, terrorist attacks on the U.S., he said.

Asked if the rally would make a difference, Charnetzki said, "Who knows?" He talked to a staffer at his congressman's office before the rally, and the staffer questioned if he was an extremist, he said.

"It got a little tense in there," he added.

The U.S. government needs to return to the protections of the Fourth Amendment, added John Lambert, from central Virginia. The U.S. government also needs to stop its surveillance on foreign leaders, he said, noting news reports this week.

"Spying on Americans without warrants is illegal," he said. "Spying on allies is just stupid."

Grant Gross covers technology and telecom policy in the U.S. government for The IDG News Service. Follow Grant on Twitter at GrantGross. Grant's email address is grant_gross@idg.com.

Read More

MEPs vote to suspend US data sharing

24 October 2013 Last updated at 08:52 ET BBC

Leaked documents allege bank data unrelated to terrorism was shared with US

The European Parliament has voted to suspend the sharing of financial data with the US, following allegations that citizens' data was spied on.

The allegation forms part of leaked documents from whistleblower Edward Snowden.

The vote is non-binding but illustrates MEPs' growing unease over how much data was shared with the US.

It comes a day after it was alleged that German Chancellor Angela Merkel's mobile phone calls were monitored.

The European Parliament voted to suspend its Terrorist Finance Tracking Program (TFTP) agreement with the US, in response to the alleged tapping of EU citizens' bank data held by the Belgian company SWIFT.

The agreement granted the US authorities access to bank data for terror-related investigations but leaked documents made public by whistleblower Edward Snowden allege that the global bank transfer network was the target of wider US surveillance.

MEPs also want to launch a full inquiry into the alleged spying.
Merkel phone
The row over exactly how much snooping was done on European citizens appears to be escalating.

Germany has summoned the US ambassador in Berlin over the claims that the US monitored Mrs Merkel's mobile phone calls.

Other leaders are also likely to want further clarification from Washington over the activities of its National Security Agency (NSA) in Europe.

Meanwhile student group, europe v facebook, is launching a fresh attack on how deeply the social network was involved in the US spying programme.

It has won the right for a review of why the Irish data protection commissioner is not investigating the amount of European data shared with the US.

Commissioner Billy Hawkes has previously claimed that there "is nothing to investigate" over Facebook's role in the PRISM programme.

Max Schrem, who heads the group, remains unconvinced.

"When it comes to the fundamental rights of millions of users and the biggest surveillance scandal in years, he will have to take responsibility and do something about it," he said.

Read More

Oakland City Council Passes Open Data Policy

BY Miranda Neubauer | Thursday, October 17 2013 techpresident





The Oakland City Council Tuesday unanimously passed legislation requiring Oakland to adopt an Open Data Policy with the goal of making city data publically accessible in machine-readable format.

The legislation mandates that the city and its departments establish a list of datasets that can be made public and aren't covered by privacy concerns, explained Bruce Stoffmacher, a policy analyst for City Councilmember Libby Schaaf, who spearheaded the legislation. "Just having a list of what datasets the city owns and has access to, just having that information is useful," he said. That list can then help the city prioritize how to release public data, he said.

Oakland already releases, for example, crime data for the past three months, he noted, but was often using an "antiquated system." One goal of the new legislation is for crime reports from several past years to be accessible through Socrata, he said. "I need to be able to access data in a useable way to try and look at crime trends," he said of his own experience. "The state of our streets is abysmal, people are always asking about potholes." He said he hoped the new policy would make more data available on street grading and related issues. "We have the funding to address these issues, but we are not prioritizing correctly."

Stoffmacher said he hoped the policy would result in more freely accessible tools and platforms created by entrepreneurs and developers like Open Budget Oakland, a platform supported by coders, including the Code for America brigade OpenOakland, community advocates and city officials. Stoffmacher said the team behind the platform was able to extricate the data from the published budget even though it is not yet machine-readable.

While an earlier version of the legislation did not move forward, Stoffmacher said the city had supported the effort and had already been working on establishing an Open Data portal on Socrata, which officially went live in February 2013. "This legislation is codifying it in a bit more of a fundamental way to put a bit more teeth into that the city has to make this commitment," Stoffmacher said. Currently, he said many agencies still function with a "paper and pen" mentality or the general practice to "xerox a document and then create a PDF of it."

As some models for the legislation, he cited San Francisco's 311 system and New York City's Open Data efforts.

"I get people calling me every day about different problems on their streets. I wish I didn't have more phone calls and could spend more time working on policy," he said, noting that he felt that that this was less of an issue in a city with a system like San Francisco's. "In parallel to working on entrenched crime and economic development agencies, [this effort ] can make people feel better about government."

Schaaf's press release on the legislation's passage noted that the policy was drafted with the help of the Urban Strategies Council, which organized a roundtable and a Google Hangout, and then published the draft as an open Google Doc that others could edit.

"Strong, sustainable open data policies get to the heart of how communities share knowledge and decision-making power. Oakland's collaborative policy-drafting was a strong demonstration that tapping into this potential can have great benefits, even at the start of a community's open data journey, and we hope other communities will take notice," Laurenellen McCann, national policy manager at the Sunlight Foundation, said in a statement.

Read More

California governor vetoes state email privacy bill

By Kate Tummarello - 10/14/13 03:37 PM ET The Hill

California Gov. Jerry Brown (D) vetoed a state online privacy bill that would have protected residents’ electronic communications accounts from warrantless access by law enforcement agencies.

The bill would require law enforcement agencies to obtain a warrant before accessing electronic communications. They would have to notify a user within three days of accessing that user’s electronic communications.

Under current federal law, the Electronic Communications Privacy Act (ECPA), law enforcement agencies do not need warrants to require electronic communication companies to turn over their users’ communications if they have been electronically stored for more than 180 days.

If law enforcement agencies do obtain a warrant, they do not have to notify the user. If they have subpoenas or court orders — which have a lower burden of proof than warrants — they are required to inform the user.

Led by Senate Judiciary Committee Chairman Patrick Leahy (D-Vt.), Congress is considering ECPA reform but has yet to pass legislation updating the 27-year-old law.

These expanded notice requirements in the California bill “go beyond those required by federal law and could impede ongoing criminal investigations,” Brown wrote in his veto statement on Saturday.

“I do not think that is wise.”

Brown’s concerns are “overblown,” according to Hanni Fakhoury, staff attorney at the Electronic Frontier Foundation (EFF), which supported the bill.

The EFF wrote to Brown last month, encouraging him to sign the bill into law. The bill is “a sensible [one] that updates the state’s electronic privacy laws to the realities of the 21st century,” the group wrote.

Fakhoury said privacy advocates have been optimistic that states will pass privacy-enhancing legislation where the federal government has tried to and failed, especially now that Congress is mired in the shutdown and debt-ceiling debates.

“Our hope has been to get states to jump in and fill the voids,” he said.

Read More

Blackhole malware exploit kit suspect arrested

9 October 2013 Last updated at 08:00 ET BBC

The Blackhole kit offered an interface used to manage malware attacks

Russian police have reportedly arrested a man on suspicion of masterminding two infamous hacking tools.

He is suspected of being the man behind the alias Paunch - the nickname used by the creator of the Blackhole and Cool exploit kits, sold to cybercriminals to infect web users with malware.

The Russian authorities have not confirmed the details.

But security firms said they had already detected a decline in the programs' use.

A spokesman for the law enforcement agency Europol told the BBC: "Europol and the European Cybercrime Centre has been informed that a high-level suspected cyber criminal has been arrested.

"We can only refer you to the Russian authorities, they are the ones who should speak about this topic."

The Russian police's press office said it had nothing to add at this time.

However, Alexander Gostev, chief security expert at the Moscow-based internet protection provider Kaspersky Lab, said the arrest had been confirmed to him by "anonymous sources".
Spreading malware
The Blackhole kit, released in 2010, dominated the crimeware market throughout 2012 and the start of 2013, according to Fraser Howard, a researcher at the anti-virus company Sophos.

He said the code had been sold for an annual licence of $1,500 (£940) or could be rented from its creator for $200 (£125) for one week's use, among other price plans.

The software targeted a range of vulnerabilities in the Java programming language, Adobe's Flash media player, Windows software and PDF files.

It had two ways of doing this:

• adding malicious code to hundreds of thousands of legitimate websites, which then copied malware to visitors computers
• creating links in spam messages to specially created sites that infected PCs

Sophos said that Blackhole was used to send links that directed users to sites that downloaded malware

Among the malware downloaded was:

• fake anti-virus software that falsely claimed the PC was infected and urged the user to pay a fee to remove viruses
• Trojans that attempted to steal financial records stored on the PC
• the ZeroAccess rootkit, which downloaded other software that hijacked the PC for use in a botnet - a facility used to overwhelm websites with traffic and force them offline
• key loggers that took a record of what was typed on the PC
• ransomware that attempted to blackmail the PC owner

Although Mr Howard said Blackhole was once the biggest threat of its kind, he added that in recent months it had been overshadowed by rival kits, including Sweet Orange and Neutrino.

According to the researcher, the Blackhole and Cool kits put together were only involved in about 4% of all malware detected by Sophos in August, down from 28% the previous year.

The figure had since dropped to 2% in recent days, he added.

Another independent security blogger stressed that the arrest was still significant.

"If it's true that the brains behind the Blackhole has been apprehended it's a very big deal - a real coup for the cybercrime-fighting authorities, and hopefully cause disruption to the development of one of the most notorious exploit kits the web has ever seen," said Graham Cluley.

"However, it's worth remembering that nature abhors a vacuum, and there would surely be other online criminals waiting to take their place, promoting their alternative exploit kits and malicious code."

Mikko Hypponen, chief research officer at F-Secure, agreed.

"If indeed it is Paunch that they arrested, that is a major arrest - he is a big deal," he told the BBC.

"He was clearly the biggest player in providing exploit kits - not just by selling them, but also renting and leasing them to online criminals.

"Both Blackhole and its successor Cool have been very popular.

"Users didn't have to be very technical to operate them - there was a manual that came with them - they just had to get them running and be able to break into a high-profile website, or create a new one from scratch, to install something bad on your computer."

Read More

The cloud privacy wars are coming

July 09, 2013

With the recent NSA blowback in Europe, we will likely see the privacy battles heat up in the United States as well

By David Linthicum | InfoWorld

Germany's interior minister, Hans-Peter Friedrich -- the country's top security official -- cautioned privacy-conscious residents and organizations to steer clear of U.S.-based service companies, according to the Associated Press. As InfoWorld's Ted Samson has reported, "Friedrich is by no means the first E.U. politician to issue this type of warning, and as details continue to emerge about the U.S. government's widespread surveillance programs, such warnings are certain to garner greater attention."

The blowback in Europe around NSA surveillance is no surprise. Privacy has always been a huge issue in Europe, as demonstrated by confrontations with Google, among others.

[ InfoWorld's Galen Gruman on how users might win the privacy wars. | Get the no-nonsense explanations and advice you need to take real advantage of cloud computing in InfoWorld editors' 21-page Cloud Computing Deep Dive PDF special report. | Stay up on the cloud with InfoWorld's Cloud Computing Report newsletter. ]

However, the real privacy wars in the cloud have yet to be fought, both in the United States and in Europe. This battle will likely occur in courtrooms and in government regulatory agencies.

The reality is that people who working with cloud-based platforms won't stop using those platforms -- but they will get much better at security and privacy. With such improvements in security and privacy, law enforcement and government agencies won't have ready access to some data. That means legal battles will occur in many countries, with the use of remote data hosting services, such as cloud services, in the middle of those frays.

One result of businesses taking steps to ensure that their data won't be monitored by government agencies will be wider use of both encryption and physical restrictions on access. However, if the government wants to see the data and obtains a court order (sometimes in secret), it will want access to that data. To get that encrypted or restricted-access data in the cloud, the government will need an additional court order to gain access. That's when lawsuits will be filed and all hell breaks loose.

Some people believe these issues can be avoided by not using public cloud providers. But that's naive. If the government wants your data and if there is cause to support their concerns to a judge, it will come after that date whether it's in your closet or a cloud. Welcome to the new world order.

This article, "The cloud privacy wars are coming," originally appeared at InfoWorld.com. Read more of David Linthicum's Cloud Computing blog and track the latest developments in cloud computing at InfoWorld.com. For the latest business technology news, follow InfoWorld.com on Twitter.

Read More

EFF Lawsuit Over Surveillance Moves Forward

Group Aims to 'Restore Americans' Constitutional Rights'

by Karl Bode yesterday Broadband Reports

According to the Electronic Frontier Foundation (EFF), a Federal Judge this week rejected the government's attempts to bury the organization's lawsuit over domestic surveillance, and allowed the EFF's lawsuit to continue (though some of the statutory claims were dismissed). "Over the last month, we came face-to-face with new details of mass, untargeted collection of phone and Internet records, substantially confirmed by the Director of National Intelligence," states the EFF. "Today's decision sets the stage for finally getting a ruling that can stop the dragnet surveillance and restore Americans' constitutional rights."

Read More

Code.org Update

It's 4 months since our launch. Thanks to your sharing & tweeting, 3.5
million kids tried learning to code online, 12,000 schools asked our help to teach computer science,
and 25,000 software engineers volunteered too! We've
connected thousands of schools with opportunities and helped set up hundreds of classes.

How else can you help?

1- Earlier today, responding to your voices, a bi-partisan group
of U.S. Congressmen introduced the Computer Science Education Act. Learn more and spread the word.

2- If you're a parent or student, see our map of local summer-camps & work-shops. Consider enrolling this summer.

3- We're working on a bold plan to bring Computer Science to
thousands of schools. If you can, please consider a generous donation.

Thanks!

Hadi Partovi, founder, Code.org

P.S. if you have feedback for us, feel free to submit ideas at our uservoice forum.

Read More