You are being watched

[SciFi Chick]

The case TSC reported on has now been updated. This was not a result of government monitoring. It was a result of a company reporting suspicious Internet activity to the police:

Update, 7:05 p.m.: Because the Googling happened at work.

The Suffolk County Police Department released a statement this evening that answers the great mystery of the day.

Suffolk County Criminal Intelligence Detectives received a tip from a Bay Shore based computer company regarding suspicious computer searches conducted by a recently released employee. The former employee’s computer searches took place on this employee’s workplace computer. On that computer, the employee searched the terms “pressure cooker bombs” and “backpacks.”
After interviewing the company representatives, Suffolk County Police Detectives visited the subject’s home to ask about the suspicious internet searches. The incident was investigated by Suffolk County Police Department’s Criminal Intelligence Detectives and was determined to be non-criminal in nature.

[FZR1KG]

rofl

NO!!!

It wa the government NSA, FBI, CIA, all in cahoots with the KGB to spy on good ol Americans who simply want to try and make their own bombs in case the zombie apocalypse happens next week as foretold by their pet psychologist that specialises analysing cats past lives.

[The Supreme Canuck]

That's no better, as far as I'm concerned. The ISP shouldn't be monitoring Google searches. Moreover, why do you think they were doing so? If I had to wager, I'd put my money on "they were told to."

Google, for example, turns over data to the NSA, without a warrant, all the time. Not because they want to, but because the NSA has said "if you see the following types of activities, you need to tell us."

So how is this better?

[SciFi Chick]

It was hissplace of work monitoring Internet searches while he was at work. You do not have a right to use your employer's property to do personal private things, and I support that. Look up bombs on your own time.

[The Supreme Canuck]

So fire him for slacking. But don't report him to the counter-terrorism unit of the police force for looking up backpacks. That's not okay.

What else isn't okay: the police acting on such thin information. It isn't probable cause. Even if there had been a cop watching over his shoulder as he looked up pressure cookers and backpacks, that cop shouldn't have been able to do a thing. Because the fellow did nothing wrong, or even suspicious.

There's also the little matter of the police saying that they respond to such things 100 times a week... and that 99 times out of 100, it's a false positive.

That's a problem.

[SciFi Chick]

He was looking up how to make a pressure cooker bomb not just pressure cookers. Secondly, you're happy letting the 1% go? I respectfully disagree.

[The Supreme Canuck]

A) Looking up pressure cooker bombs =/= being about to make one. He asked, and apparently two of the cops had done the same thing. Out of curiosity, not for professional reasons. Does that justify a visit to their homes?
B) That 1% is not the disruption of actual terrorist plots. Think about it: if it were, that means there is one terrorist plot disrupted every week. That's 52 plots disrupted per year... in Boston alone. That's not plausible. The 1% represents situations where the police don't just say "whoops, nothing going on here" and walk away. They are situations where any amount of further investigation or action, no matter how minor and no matter their outcomes, occurs. Given that zero arrests and zero convictions have been made as a result of this program (and, yes, we would have heard of them - citizens arrested on charges of terrorism go to court), I'm perfectly comfortable with the 1% the police are talking about "getting away with it." Because they're not doing anything wrong enough to even be arrested.

[Sigma_Orionis]

Now THIS is interesting

Ex-spy 'Falcon': U.S. likes Snowden in Russia

He SEEMS a bit less full of shit than Ellsberg IMHO.

[Sigma_Orionis]

Now THIS is an interesting turn of events.

Short Story:, the CEO of a hosting company that happens to host many services available only through the Tor anonymizing network was arrested on charges related to child pornography, At the same time, all the services at the hosting company (called "Freedom Hosting") where disabled. Notice I said "disabled", not "shutdown" why?

The problem is that Freedom Hosting happened to host quite a bit of these hidden websites, including TOR Mail, and other popular destinations. So when the Ireland authorities arrested Eric, they all went offline. But the story doesn't end there. The sites are actually still available, but with a blank page saying the service is down for maintenance. However, that maintenance page is also serving a JavaScript exploit. This exploit is especially targeted at Firefox 17, the version included in the Tor browser bundle. So it's more than likely that it was created especially to infect Tor users. But what does this exploit do? It simply reports your IP and MAC address to a server in Virginia. It didn't take long after this exploit was found for people to make the link between the FBI-sponsored Irish arrest, Tor, and a certain-Virginia based US government agency. While there is no way to be sure, it seems plausible that the exploit was planted by US authorities in order to make a list of all Tor users.

Emphasis mine.

So, here we have a perfect example of law enforcement vs privacy concerns.

Apparently Freedom Hosting housed a lot of "hidden services" (that means, available only through an anonymising network like TOR) that were either legal, questionable and downright illegal.

I can just listen to TSC saying "fine, put the hacking web page on the illegal sites and leave the other ones alone". Sure, who enforces THAT? Hell we're not even sure that the Tainted Page is sending your info to the CIA. After all it would be a job for the NSA not the CIA to gather stuff like that.

About the only way something like THAT would be able to be enforced would be a very public very noisy lawsuit from people (like the guy who was brosing on how to make Pressure Cooker bombs just out of curiosity) who could show that their info was collected by "SOMEONE" through covert means and then targeted.

[Rommie]

I am fascinated by how these days all my geeky friends have start-up conversations that involve how to set up something that PRISM won't track. Europeans, of course, cause they're the ones who care most about privacy violations, but I nonetheless found it an interesting turn of summer talk over a beer.

It is true though how if you could guarantee a service like that you'd make a lot of money, so I guess they have a point.

[Sigma_Orionis]

Well, Technically it's pretty easy. That's what Project TOR is about. As a matter of fact it attracted lots of unwanted company, like for example: The Silk Road Marketplace, which is an online Black Market which mostly deals with hard drugs like Heroine or Cocaine that can be accessed only through TOR. The problem, you see is more like one of logistics. They'd have to set up in countries where there are good Internet Privacy laws. Apparently, Ireland is not one of them, but the Netherlands is.

There are other Anonymising networks like I2P or even free Peer-to-Peer encrypted communications schemes for file-sharing, chats and forums, so, like I said it's not a technical issue, it's about setting up the services as decentralized as possible to avoid things like what happened in Ireland, because of course if the "hidden services" hosting company gets too inquisitive or even if several of this providers police themsevels they are destroying the whole purpose of what they set up for.

Now, ASSUMING that an "undisclosed us government agency" tagged along when the local law enforcent shut down a "hidden service" provider, because of illegal activity (like Child Pornography), since the above is a grey area, it's perfect for them to set up a "Honey Pot" there to attract whomever they want to track.

[The Supreme Canuck]

I can just listen to TSC saying "fine, put the hacking web page on the illegal sites and leave the other ones alone".

Well, I'd say "Get a warrant against specific illegal activities being hosted by this service. Serve the warrant on the company. If the company refuses to comply with the monitoring warrant, hit them with obstruction and violating a court order."

Which is essentially what has happened, except that the warrant hasn't been issued by an open and valid authority.

My problem is monitoring legal activities. If there are illegal activities, you can get a warrant to monitor them. If the ISP/host/whatever relevant entity refuses to abide by that warrant, you charge that ISP/host/whatever. All warrants should be obtained in open court - and I do mean a court.

So... who enforces this? The court does. Just like with issuing physical search warrants. If the authorities seek a warrant for something that they shouldn't get a warrant for, they don't get that warrant. And if a warrant is improperly issued, there's trouble when the violated party complains or sues.

It's pretty much how the system operates now, except that things aren't kept in the dark and there is judicial accountability. See, right now, no one gets to complain, so there's never any "trouble" and thus no accountability for overreach. This is why we have courts, warrants, and constitutional guarantees about search and seizure in the first place.

[Sigma_Orionis]

Your are right of course, my point is that it won't happen till someone with legitimate privacy concerns gets burned badly, makes a major ruckus out of it, and ends up in court with whomever burned that someone.

[The Supreme Canuck]

Ah. Yeah, that's the big failing of the court system: that's the case for everything. I will say that it's going to be even harder here, since warrants are issued by the FISA court rather than a legitimate, open court that people can take complaints to and which has any measure of oversight.

[Yosh]

Ah. Yeah, that's the big failing of the court system: that's the case for everything. I will say that it's going to be even harder here, since warrants are issued by the FISA court rather than a legitimate, open court that people can take complaints to and which has any measure of oversight.

FISA has oversight, you just disagree with who has the responsibility and the transparency of it.

[Parrothead]

Back to Snowden momentarily. I caught a segment on cnn, during the week. Some filmmaker had interviewed a cold war era defector to the SU. Years later the defector had said he would have liked to have been able to return to the US, he died some time later in Russia. The filmmaker was basically saying the fate of that man, could be a cautionary tale for Snowden. IIRC, I watched the segment between 11pm and midnight, so it was a repeat from an earlier hour, "up front" ? There might be video at the cnn website.

[The Supreme Canuck]

Ah. Yeah, that's the big failing of the court system: that's the case for everything. I will say that it's going to be even harder here, since warrants are issued by the FISA court rather than a legitimate, open court that people can take complaints to and which has any measure of oversight.

FISA has oversight, you just disagree with who has the responsibility and the transparency of it.

Yes. FISA has "oversight," but not in the way that a proper court does. Thus, no real oversight. It's a sham.



Seriously, FISA has denied 0.03% of all warrant requests. It's a rubber stamp for the NSA, and no one can say boo since there's no effective oversight.

[FZR1KG]

Seriously, FISA has denied 0.03% of all warrant requests. It's a rubber stamp for the NSA, and no one can say boo since there's no effective oversight.

I'm just curious, what should the rejection rate be?

I figured if its really low then the people making requests are doing their job well.
If they are getting a lot of rejections then the people making the requests are not really sure of what they are doing.

I suppose you could look at it from the point of view of the people approving the requests too.
If they approve too many, they are rubber stamping.
If they are approving too few they are hindering investigations.

IOW, any approval rate below near 100% is almost always due to incompetence.
So I'm not sure why you would automatically presume both incompetence on behalf of the requester and rubber stamping on behalf of the approvals.

I'd be more upset if there was a lot of rejections because it tells me the people on the front line are incompetent.

[Cyborg Girl]

You know what... The hell with it. PRISM is at least out in the open now, even if the government isn't giving us a particular reason. People at least know they're being spied on.

As long as the government doesn't massively abuse it (e.g. to suppress political dissent), and as long as people are held accountable for actual abuses of it... What the hell. Maybe the panopticon won't be so bad. Maybe we have learned something from the dictatorships of the twentieth century, and won't repeat those mistakes.

That's what I'd like to think, anyway.

OTOH, it's not like we can do anything if the situation does go sour. And both parties are completely owned by monied interests at this point, so I should probably know better than to hope.

Anyway, it's clear at this point that the US is functionally no longer a representative democracy. We'll see if that's for better or for worse.

P.S. I can actually think of a few very good reasons for PRISM and the like, which have nothing to do with terrorism (not by the usual definition anyway). See if you can think of any. Hint: distance kills empathy.

[The Supreme Canuck]

FZ: A reasonable rejection rate is between 5% and 10%. That's the rate for common search warrants obtained from real courts.

[FZR1KG]

FZ: A reasonable rejection rate is between 5% and 10%. That's the rate for common search warrants obtained from real courts.

What makes it reasonable is my question, the fact that they are being rejected means someone is presenting lot of garbage in the hopes of getting a warrant assuming that the person rejecting it is infallible.
If we assume the people rejecting them are also fallible then how fallible is acceptable?

IOW, a rejection rate IMHO has to be extremely low otherwise the system is very inefficient.
It means people need retraining be it on the police or the courts end.

What I find unusual is saying that 5-10% is acceptable.

I'd rephrase that and say its maybe tolerable but not acceptable.
A lower figure is more acceptable otherwise there is a serious problem between working professionals.

[geonuc]

I completely disagree. With balanced systems, a 5-10% rejection rate is not only reasonable, but arguably optimum.

[The Supreme Canuck]

I completely disagree. With balanced systems, a 5-10% rejection rate is not only reasonable, but arguably optimum.

Exactly. A lower rate means that, in all likelihood, the court is not doing due diligence.

Look at it this way, FZ: is a 100% conviction rate in criminal trials a good thing, or an indication that the court is doing something wrong?

[FZR1KG]

This isn't a conviction rate, the two are totally different things.

What this is, is a classic case of control theory applied to humans.
You have a signal and feeddback.
The signal is the request, the feedback is the rejection or acceptance.

What's the aim in applying for a warrant?
To get it approved if its a valid request.

If you're failing that task 1 in 20 or 1 in 10 times then you really aren't running optimal.

Put a failure rate of 1 in 20 or 1 in 10 into other asks and see how that flies.
To me it means retraining should be required.

If the training is adequate then the logical possibility left is human variation.
That being the case, it means some form of better guidelines are required.

So I ask again, why is 5-10% considered good or optimal?
Where is the data that shows why the requests are being rejected and why is no one looking at that data and avoiding wasting time and resources?

[FZR1KG]

I completely disagree. With balanced systems, a 5-10% rejection rate is not only reasonable, but arguably optimum.

We must have worked in totally different industries.
Its a feedback system as far as I can see, more than it is a balanced system.
If it was balanced we'd have 50% rejection.
Balanced systems also work on little feedback, its a case of push and pull, give and take.
I'd hate to think a legal system can be swayed by factors not relevant to the case at hand.

If I ever saw a feedback system that had 5-10% error I'd say that is a candidate for redesign.

The police make a request.
The court rejects request.
The police should then look at the reason and not put in another request that will be rejected for the same reason.

Either the reasons for rejection vary (for identical situations) or are not given or the police are passing on requests they hope will pass.

I'd like to see something that quantifies it.

In any case, I'm interested in why TSC and now yourself think that its optimum to have that high rejection rates.
From what I can see, two professional organisations working with the same set of rules/laws should agree far more often than that.