Snooper's Charter could impede computer security workers in UK

From Ars Technica.

As Glyn Moody and George Danezis point out, the draft bill effectively makes it a crime to reveal the existence of government hacking. Along the way, the new law would also make it illegal to discuss the existence or nature of warrants with anyone under any circumstances, including in court or with your MP, no matter what’s been happening. The powers are sweeping, absolute, and carefully put beyond public scrutiny, effectively for ever. There’s no limitation of time.

Let’s say I’m a security researcher, digging into some unusual behaviour in a router on behalf of a major telecoms client. I discover a security hole into which somebody has installed a backdoor. Whoever it was didn’t leave a calling card: they rarely do.
What would I do if I found that backdoor today? The ethical thing is to check my results with trusted colleagues, tell my client, determine what the best remedial action is, tell whoever is in charge of that aspect of the router software, allow time for a patch to propagate out, then tell the world what happened. It’s interesting, but not immediately important, to work out who did the attack. Fix first, ask questions later.
Let’s look at that in a world where the Snooper's Charter has become law. I find the backdoor and tell a colleague. She doesn’t answer my e-mail, but I get a knock at the door—turns out that GCHQ was behind the attack. I am now banned forever from mentioning to anyone what I found—or that I found anything. The backdoor is later exploited by the bad guys and my client is hit. Why didn’t you find it, they ask? I can only shrug. Soon, my consultancy is in disarray. If I’m sued for incompetence, I cannot defend myself. I can write no papers, warn no people.What would I do if I found that backdoor today? The ethical thing is to check my results with trusted colleagues, tell my client, determine what the best remedial action is, tell whoever is in charge of that aspect of the router software, allow time for a patch to propagate out, then tell the world what happened. It’s interesting, but not immediately important, to work out who did the attack. Fix first, ask questions later.

Strange Loop: "Security for Humans: Privacy and Coercion Resistant Design" by Morgan Marquis-Boir.

Second in my series of favourites from Strange Loop 2015:  "Security for Humans: Privacy and Coercion Resistant Design" by Morgan Marquis-Boir. Marquis-Boir is head of security for The Intercept, the online news source founded by Glen Greenwald and Laura Poitras, the journalists who Edward Snowden chose to be his conduit to the world. Morgan surveys computing and security as of 2015. Time to encrypt your phone!

Petraeus won't serve a day in jail for his leaks. Edward Snowden shouldn't either.

Trevor Timm in the Guardian argues that David Petraeus' crimes, inspired by adultery, are more serious than Edward Snowden's, inspired by liberty.

The sweetheart deal the Justice Department gave to former CIA director David Petraeus for leaking top secret information compared to the stiff jail sentences other low-level leakers have received under the Obama administration has led to renewed calls for leniency for NSA whistleblower Edward Snowden. And no one makes the case better than famed whistleblower Daniel Ellsberg.

Ellsberg, the first person ever charged under the Espionage Act or any other statute for leaking the Pentagon Papers to Congress and seventeen newspapers, told me on Thursday: “The factual charges against [Edward Snowden] are not more serious, as violations of the classification regulations and non-disclosure agreements, than those Petraeus has admitted to, which are actually quite spectacular.”

It’s hard to overstate the shocking nature of the government’s case against Petraeus. The information that he gave Paula Broadwell, his friendly biographer with whom he was then having an extramarital affair, was among the most sensitive in the US government. According to the indictment, Petraeus gave Broadwell eight black books containing “classified information regarding the identities of covert officers, war strategy, intelligence capabilities and mechanisms, diplomatic discussions, quotes and deliberative discussions from high-level National Security Council meetings … and [his personal] discussions with the president of the United States.”

Say no to a Scottish national ID system

The Scottish government has opened for consultation plans of that would lead to database sharing among a vast range of organisations, and could lead to the introduction of de facto ID cards via the back door. Responses to the consultation are due by 25 February 2015. ORG Scotland writes:

A minor, barely noticed consultation is not the way to make a major change to Scottish citizens’ privacy and their relationship with the state. Creating a national ID register was rejected by the SNP and the UK, and the bare minimum should be for the Scottish Executive to introduce primary legislation whereby the public and MSPs can debate the nature of these changes and whether they are acceptable.

Respond to the consultation quickly, courtesy of ORG.

ORG is planning meetings to discuss how we can stop the Scottish Government's plans in Edinburgh, Glasgow and Aberdeen, and is tracking developments in their blog.

Here is the original consultation,  and a detailed response by ORG.

CITIZENFOUR showing in Edinburgh

CITIZENFOUR, Laura Poitras's documentary on Edward Snowden, sold out for its two showings in Edinburgh. The movie is rated five-stars by the Guardian ("Gripping"), and four-stars by the Independent ("Extraordinary"), the Financial Times ("True-life spy thriller"), the Observer ("Utterly engrossing"), and the Telegraph ("Everybody needs to see it").

Kickstarter-like, OurScreen will arrange to show a film if enough people sign up to see it. I've scheduled a showing:

Cameo Edinburgh, 12 noon, Tuesday 2 December 2015

cost: £6.80 Book tickets from OurScreen.

If 34 people sign up by Sunday 23 November, then the showing will go ahead.

Reset the Net

Today is the day we Reset the Net. Here is Edward Snowden's announcement:

"One year ago, we learned that the internet is under surveillance, and our activities are being monitored to create permanent records of our private lives — no matter how innocent or ordinary those lives might be.

Today, we can begin the work of effectively shutting down the collection of our online communications, even if the US Congress fails to do the same. That’s why I’m asking you to join me on June 5th for Reset the Net, when people and companies all over the world will come together to implement the technological solutions that can put an end to the mass surveillance programs of any government. This is the beginning of a moment where we the people begin to protect our universal human rights with the laws of nature rather than the laws of nations.

We have the technology, and adopting encryption is the first effective step that everyone can take to end mass surveillance. That’s why I am excited for Reset the Net — it will mark the moment when we turn political expression into practical action, and protect ourselves on a large scale.

Join us on June 5th, and don’t ask for your privacy. Take it back.”

Reset the Net

If you don't like that GCHQ and the NSA can listen in on all your network activity, here is your chance to Reset the Net.

Today, a coalition of thousands of Internet users, companies and organizations launched a campaign for a day of action to “Reset The Net” on June 5th, 2014, the anniversary of the first NSA surveillance story revealed by whistleblower Edward Snowden. Tens of thousands of internet activists, companies and organizations committed to preserving free speech and basic rights on the Internet by taking steps to shutting off the government’s mass surveillance capabilities.
Watch the campaign video and see a full list of participants here: http://ResetTheNet.org

More than 20 organizations and companies support the launch of the campaign including Fight For The Future (who initiated the campaign) along with reddit, CREDO Mobile, Imgur, Greenpeace, Libertarian Party, FireDogLake, Thunderclap, DuckDuckGo, Disconnect.Me, Demand Progress,  Access, Free Press, Restore the Fourth, AIDS Policy Project, PolitiHacks, OpenMedia, Free Software Foundation, Bill of Rights Defense Committee, Code Pink, Popular Resistance, Participatory Politics Foundation, BoingBoing, Public Knowledge, Amicus, New America Foundation’s Open Technology Institute, Progressive Change Campaign Committee, Student Net Alliance, and the Center for Democracy and Technology.

... 

Internet users are invited to join in on the day of Reset The Net to install privacy and encryption tools and secure their personal digital footprint against intrusive surveillance.

Technical information here and press release here.

Silicon Valley could force NSA reform, tomorrow. What's taking so long?

CEOs from Yahoo to Dropbox and Microsoft to Zynga met at the White House, but are they just playing for the cameras? Photograph: Kevin Lamarque / Reuters

Trevor Timm asks a key question in The Guardian:

The CEOs of the major tech companies came out of the gate swinging 10 months ago, complaining loudly about how NSA surveillance has been destroying privacy and ruining their business. They still are. Facebook founder Mark Zuckerberg recently called the US a "threat" to the Internet, and Eric Schmidt, chairman of Google, called some of the NSA tactics "outrageous" and potentially "illegal". They and their fellow Silicon Valley powerhouses – from Yahoo to Dropbox and Microsoft to Apple and more – formed a coalition calling for surveillance reform and had conversations with the White House.
But for all their talk, the public has come away empty handed. The USA Freedom Act, the only major new bill promising real reform, has been stalled in the Judiciary Committee. The House Intelligence bill may be worse than the status quo. Politico reported on Thursday that companies like Facebook and are now "holding fire" on the hill when it comes to pushing for legislative reform.
...
We know it's worked before. Three years ago, when thousands of websites participated in an unprecedented response to internet censorship legislation, the Stop Online Piracy Act (Sopa), the public stopped a once-invincible bill in its tracks. If they really, truly wanted to do something about it, the online giants of Silicon Valley and beyond could design their systems so that even the companies themselves could not access their users' messages by making their texting and instant messaging clients end-to-end encrypted.
But the major internet outfits were noticeably absent from this year's similar grassroots protest – dubbed The Day We Fight Back – and refused to alter their websites à la Sopa. If they really believed the NSA was the threat so many of them have claimed, they'd have blacked out their websites in protest already.

A new SQL injection attack?

Against speed cameras?

Edward Snowden speaks out

Edward Snowden speaks via Google Hangouts at SxSW in Austin, Texas. Photograph: Jim Bennett/Corbis, Guardian

Cory Doctorow for the Guardian covers Edward Snowden's first public appearance. Snowden has been nominated for the Noble Peace Prize. His closing remarks show why he deserves it:

“Governments have stopped talking about the ‘public interest’ and started talking about the ‘national interest’. When these diverge, something is wrong.
“Would I do this again? Absolutely yes. No matter what happens to me. I took an oath to support and defend the constitution and I saw it was being violated on a mass scale. The interpretation of the constitution has been changed in secret from ‘no unreasonable search and seizure’ to ‘any seizure is fine, just don’t search it.’ That’s something the public has the right to know.”

Will Snowden be Glasgow University's next Rector?

From the Glasgow Herald. Spotted by Mitch Wand.

Chris Cassells, a member of the "Elect Snowden as Rector" campaign at Glasgow University, said a Snowden victory would be a gesture against surveillance culture
"Having Edward Snowden as rector would give us a megaphone with which we can project our views to a global audience particularly on the issue of state surveillance and the very valid and welcome role of whistleblowers in a democracy," explained the PhD student, 27.
"I think he has done a great service to citizens across the world in exposing the corrupt and immoral practises of the NSA and our very own GCHQ.
"Studying at the university is dependent on the free exchange of information and freedom of speech, and I think Snowden's revelations hit to the heart of that."

What does 'many' mean in 'stopping many terrorist plots'?

Yesterday, Andrew Parker, the new head of MI5, spoke out (though not by name) against Edward Snowden and the Guardian.

‘GCHQ intelligence has played a vital role in stopping many of the terrorist plots that MI5 and the police have tackled in the past decade.
‘It causes enormous damage to make public the reach and limits of GCHQ techniques. Such information hands the advantage to the terrorists.
'It is the gift they need to evade us and strike at will. Unfashionable as it might seem, that is why we must keep secrets secret, and why not doing so causes such harm.’

It's interesting to contrast the above with information emerging in the US about the efficacy of the programs whose existence Snowden leaked. Yochai Benkler writes in The Guardian:

In a 2 October hearing of the Senate judiciary committee, Senator Leahy challenged the NSA chief, General Keith Alexander:

Would you agree that the 54 cases that keep getting cited by the administration were not all plots, and that of the 54 only 13 had some nexus to the US? Would you agree with that, yes or no?

Alexander responded:

Yes.

Leahy then demanded that Alexander confirm what his deputy, Christopher Inglis, had said in the prior week's testimony: that there is only one example where collection of bulk data is what stopped a terrorist activity. Alexander responded that Inglis might have said two, not one.
In fact, what Inglis had said the week before was that there was one case "that comes close to a but-for example and that's the case of Basaaly Moalin". So, who is Moalin, on whose fate the NSA places the entire burden of justifying its metadata collection program? Did his capture foil a second 9/11?
A cabby from San Diego, Moalin had immigrated as a teenager from Somalia. In February, he was convicted of providing material assistance to a terrorist organization: he had transferred $8,500 to al-Shabaab in Somalia.

Can you be arrested for sharing a link?

Julian Assange, Chelsea Manning, Edward Snowden, Glen Greenwald, David Miranda: now the powers that be are going after another whistleblower/journalist, Barrett Brown. Digital Trends writes:

In 2010, Brown launched Project PM, a group effort billed as a crowdsourced investigation into the “surveillance state.” When Lulz Sec hackers stole some 70,000 emails from security firm HB Gary Federal and posted them online in February 2011, Brown and fellow Project PM members went to work, uncovering a coordinated campaign to discredit Wikileaks and journalist Glenn Greenwald, among other serious revelations. Later, in December of that year, Anonymous posted more than 5 million emails swiped from intelligence contractor Stratfor Global Intelligence, which were read and mined for information by Brown’s Project PM. Those emails contained a slew of revelations, including talk among Stratfor employees of renditions and assassinations.

During the Stratfor investigation, Brown shared a link to the stolen company emails in an IRC chat with other Project PM members. The documents contained some 5,000 credit card numbers and other personal information of a slew of individuals.
...
Two months later, prosecutors charged Brown with 17 crimes, 12 of which are related the identity theft – all because of that link he shared.
...
Brown did not hack any computers. He did not steal any information. And none of the charges he faces allege that he did. Brown simply shared a link that contained stolen data – something journalists, and many other people, do online every day. He faces up to 105 years in prison.

Digital Trends: Can you be arrested for sharing a link? Maybe.
Rolling Stone: Introducing America's least likely political prisoner.
Demand Progress: Tell the Justice Department: Stop the war on journalists, free Barrett Brown.

Partner of journalist detained for nine hours

David Miranda (right) was detained at Heathrow for nine hours yesterday (Sunday 18 August 2013) under Section 7 of the Prevention of Terrorist Act. He was in transit from Berlin to his home in Brazil, and in the UK only to change planes. Miranda is the partner of journalist Glen Greenwald (left), who interviewed Edward Snowden (below) and has played a key role in the ongoing revelations about the NSA and GCHQ. Miranda had his phone and laptop confiscated, and has not been told when they will be returned. The photo shows Greenwald and Miranda at the airport in Rio di Janiero, today.

Glen Greenwald, responding to the arrest, wrote today:

It's bad enough to prosecute and imprison sources. It's worse still to imprison journalists who report the truth. But to start detaining the family members and loved ones of journalists is simply despotic. ...

If the UK and US governments believe that tactics like this are going to deter or intimidate us in any way from continuing to report aggressively on what these documents reveal, they are beyond deluded. If anything, it will have only the opposite effect: to embolden us even further. Beyond that, every time the US and UK governments show their true character to the world - when they prevent the Bolivian President's plane from flying safely home, when they threaten journalists with prosecution, when they engage in behavior like what they did today - all they do is helpfully underscore why it's so dangerous to allow them to exercise vast, unchecked spying power in the dark.

First report, from the Guardian.
Greenwald's response.
Live blog of ongoing reaction.

Lavabit, e-mail service used by Edward Snowden, shuts in mysterious circumstances

Invitations to attend a press conference at Moscow's Sheremetyevo Airport came from edsnowden@lavabit.com. Now, the secure e-mail service has shut down in mysterious circumstances. The message on their web site makes chilling reading:

The story breaks on Boing Boing
Silent Circle, a similar service, closes a day later
Lavabit founder tells Forbes `If you knew what I knew, you'd stop using e-mail'
Coverage in the Guardian (and a light-hearted summary)