Confirmed: CMU Attacked Tor, Was Subpoenaed by Feds
motherboard.vice.com
motherboard.vice.com
> [...] it is the Court's understanding that in order for a prospective user to use the Tor network they must disclose information, including their IP addresses [...] such a submission is made despite the understanding communicated by the Tor Project that the Tor network has vulnerabilities and that users might not remain anonymous. Under these circumstances Tor users clearly lack a reasonable expectation of privacy [...]
It seems far more naive to assume there is an expectation of privacy on the Internet.
No, seriously. I believe it is good practice to encrypt all data over all kind of wires (public or not). However, most of the time, we do not encrypt metadata, which can be just about as useful as the actual data (and way easier to analyze). Do you really think that any government cares much about what you say to a specific person? They only care that you talk to that person, when you talked to that person, and how frequently you talked to that person. The same goes for almost anything. If your ISP were interested in your data, they would actually value metadata a lot more then the actual payload because metadata can be analyzed quite easily and reliably.
Tor was (and still is) your only protection against these kinds of attacks because your ISP only knows you're talking to some Tor nodes, the Tor nodes can see very few of the websites you visit (or email recipients you send to) because you will use another nodes for the next website/email, and the website will not know who you are if you don't authenticate because many requests can come from that Tor node.
We could say the same for HTTPs, because it also had its fair share of vulnerabilities.
To provide a contrasting example: GCHQ tapped fiber-optic lines between corporate datacenters. Those lines are not public and are therefore not supposed to be up for grabs; tapping them without the consent of their owners is an espionage activity.
Attaching to an open network that fuzz-routes data and then cheating on the policies of that network that are intended to anonymize the requesters of the data is just good old-fashioned protocol circumvention. Definitely rude and demonstrative of a major practical weakness in tor, but probably not illegal. It doesn't sound like there was any law for SEI to break here (though I hadn't heard the suggestion that the CFAA might apply, which is an interesting legal angle to explore).
It's understandable that Layer 3 knows Layer 2, that Layer 2 knows Layer 1 and that Layer 1 knows the originator.
But Layer 2, 3 and the website should not know Layer 1 by design. Defeating this is akin, IMHO, to circumventing a lock by photographing the key that you don't own.
Perhaps like visiting your cult friend. You have an expectation of privacy for what you say in his house, but the fact that you traveled to his house does not have an expectation of privacy.
There's a reasonable expectation of privacy in a hotel room, for example[1]. To me this argument reads like: "The hotel owner cannot guarantee that a previous patron hasn't left a listening device in your room, so there's no reasonable expectation of privacy."
[1]: http://papers.ssrn.com/sol3/papers.cfm?abstract_id=1718669
The fact that the third party was actually three different parties who only got a piece (or six, when using hidden services) doesn't seem like it would change the law.
If I split data into 6 pieces and handed it to 6 different people, the government can take those 6 pieces and put them together without violating my rights. I don't see why Tor would be any different.
In fact, this particular vulnerability IIRC involved the researchers acting as both the exit node and the guard node, and finding a way to pass a message between the two so they'd notice when they're in the same circuit. That seems even better legally than my analogy above. They didn't need to take any data, the victims connected to them and gave them the info.
Same reason that there is no need for a warrant to collect phone calls since you are handing data over to the phone companies to carry between you and the other party(ies). Also the same reason the government can shift through your mail, since the items are in the possession of a third party (you likely gave the items to the government itself).
To me this makes as much sense as the argument that since a plane carrying people can fly over you, it is perfectly reasonable to put a blimp with an extremely high zoom camera on that spies on your home constantly, detecting not just visible light, but also infrared. Also, since when you talk things vibrate, and since it is possible to view those vibrations though a window, I'm actually broadcasting my speech to the public and thus don't have any expectation of privacy.
IIRC collecting mail is not in fact legal without a warrant, and only photographing the outside (which anyone who handles it can see) is allowed.
I do think the fact that any member of the public can collect data legally means the government should be able to as well.
I like your analogy with aerial surveillance, but partially because I think you are wrong. It is my understanding that aerial views available to the public, such as those available to a commercial helicopter, do not require a warrant. However, if the police go beyond public capabilities with high zoom cameras it may require a warrant. Similarly, if the state goes beyond the capabilities of the public in obtaining my IP address, they should require a warrant. The question then becomes, "Does the CMU project constitute knowledge generally available to the public?" I would argue the negative, but I could see it answered either way.
I doubt anyone is making that argument; in Kyllo v. United States the Supreme Court held that infrared cameras constituted an unreasonable search. Recording vibrations would also likely fall in the same category.
Police spying on you from a blimp is fairly unlikely, since it would be fairly conspicuous, not to mention expensive. Far more likely they just stick a camera on a utility pole as in the recent United States v. Houston, what you're most likely alluding to. The Sixth Circuit did uphold that tactic, but the law is far from settled there.
None of these cases are really analogous to the Tor case. Generally speaking, you have no reasonable expectation of privacy that information that you voluntarily provide to a third party will be kept confidential. This is why the police doesn't need a warrant to get your phone records or to obtain your IP address.
You bring up mail, which is an interesting case. Conents of a sealed mail IS protected by the Fourth Amendment - it's just that the government usually relies on the "exigent circumstances" exception to the warrant requirement (basically, showing that there is probable cause to search the mail but that there is no time to obtain a warrant). The government can't just mass-open all sealed mails and look at their contents.
Many people have planes that fly about, drones or whatnot. So you could expect random members of the public to have ways of taking arial pictures of your house. Therefore those do not violate your right to privacy.
It's very unlikely for a member of the public to own a helicopter with an infrared camera, so using it without a warrant is a violation of privacy.
The basic example used by a court is binoculars. Most people have access to binoculars, and own them. So if you do something next to your window, police can totally look through your windows with binoculars and act on the information.
I wouldn't be surprised if there are usable thermal imaging sensors out there for $100.
We have said that the Fourth Amendment draws "a firm line
at the entrance to the house," Payton, 445 U. S., at 590.
That line, we think, must be not only firm but also bright—
which requires clear specification of those methods of
surveillance that require a warrant. While it is certainly
possible to conclude from the videotape of the thermal
imaging that occurred in this case that no "significant"
compromise of the homeowner's privacy has occurred, we must
take the long view, from the original meaning of the Fourth
Amendment forward.
"The Fourth Amendment is to be construed in the light of
what was deemed an unreasonable search and seizure when
it was adopted, and in a manner which will conserve
public interests as well as the interests and rights of
individual citizens." Carroll v. United States, 267 U. S.
132, 149 (1925).
Where, as here, the Government uses a device that is not in
general public use, to explore details of the home that
would previously have been unknowable without physical
intrusion, the surveillance is a "search" and is
presumptively unreasonable without a warrant.
If the mail is unsealed, they're allowed to open it. See https://www.law.cornell.edu/cfr/text/39/233.3
Surely the point is when sealed there user expects privacy just as seven using Tor a used expects privacy - in both cases there is a system in place to protect the content from being simply read. That the technical solution used can be overcome doesn't change the users expectation that the 'seal' will mean the content is carried without being read.
If someone's calling up random numbers and talking into them, my predicting which number they'll call and buying it, then listening to it doesn't violate any laws (although you can argue it should).
Regarding buying random phone numbers, I'd say again, analogies are only useful to demonstrate the existence of an area of law in which something is legal or illegal, but not useful for designing in detail the laws governing digital/networked activities. There's not a sufficient parallel to make any decisions based on any analogy to a previous situation or technology; there's only enough parallel to prevent closing off the discussion of making privacy violations illegal by saying "it's not".
http://www.nytimes.com/2013/07/04/us/monitoring-of-snail-mai...
https://en.wikipedia.org/wiki/Mail_Isolation_Control_and_Tra...
I'm not saying that it's right but it apparently is happening.
Even on https, they can see who you are and who you're visiting.
Also, tor isn't HTTP. It's quite heavily encrypted.
Or to put it a different way, if Tor doesn't create a reasonable expectation of metadata privacy, what would?
According to the theory put forward in the second part of http://www.abajournal.com/magazine/article/the_data_question..., nothing.
Which isn't actually true. They didn't have the resources to follow everyone everywhere all the time. And if they were following you, it was possible for you to observe them. There are methods to detect a tail, so you could employ them and then not go to the secret place until there is no one watching. To maintain "technological neutrality" it would require there to exist equivalent digital methods for people to use to prevent being observed.
Kerr's whole premise of technological neutrality is also questionable unless you apply it both ways. But does it really make sense to say that the police can't use fingerprints or DNA evidence because it wasn't traditionally available? How does that framework make any sense at all?
Honestly Tor seems like a great analogy here. It makes it far more difficult to be observed, but it's fallible, as is trying to spot a tail.
Because the consequence isn't that the police can't get the information, it's only that they need a warrant first.
So much of our data today is held in the cloud that it amounts to open season for data acquisition. And for data that isn't, what's there to stop a governmental agency from using the All Writs Act to compel data movement/redirection to a third party site?
Just because something is technically legal today, doesn't mean it's the right thing to do.
> The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated...
Information I have about you is not your information, and you can't invoke the 4th amendment to protect it. Data held in the cloud is different. At least arguably, you have a property right to that data even if a cloud provider is holding it for you. You can't say that about IP addresses, IP address logs, call data records, etc. That's the company's data about you. You have no property interest in it, and mostly you don't even have access to it.
Assume you are Verizon (or any other carrier). I pay you for cell phone voice & internet service. As part of that exchange, I provide billing info etc. etc.
Are you saying that I don't own said information and that you are free to derive additional revenue by selling it to someone else? To me, I paid for a service, thereby a single transaction. My expectation is that as part of that transaction, the other party should not have to the ability to derive secondary benefit without explicit consent. Particularly, since I don't see any upside to secondary/tertiary usage.
I guess I'm much more for the European vision of personal data privacy (you own your own data and grant it for specific use) vs. the US version (anything goes).
I'm not familiar with European data privacy laws, but I imagine they're like U.S. privacy laws in the sense that they're not based on ownership. E.g. it's illegal for schools to disclose your educational information to third parties. But your student records are still the school's records, not yours.
From the EU DPD (1 of 2 key documents),
"Pursuant to the Directive 1995/46/EC, the data controller should ensure compliance with several principles relating to data quality. These principles include: (1) the collected data should be processed fairly and lawfully; (2) the collected data should be collected for specified, explicit and legitimate purposes and not further processed in a way incompatible with those purposes; (3) the collected data should be adequate, relevant, and not excessive in relation to the purposes for which they are collected and/or further processed; (4) the collected data should be accurate and, where necessary, kept up to date, and; (5) the collected data should be kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the data were collected or for which they are further processed."
* http://resources.infosecinstitute.com/differences-privacy-la...
* http://politicsandpolicy.org/article/european-union-and-inte...
* http://www.nbcnews.com/id/15221111/ns/technology_and_science...
* http://privacylawblog.fieldfisher.com/2014/how-do-eu-and-us-...
* http://www.wsj.com/articles/SB100014241278873243386045783283...
PS. This is not a wholesale endorsement of EU style privacy, there are things that need to be fixed too but IMO is much more respectful of the individual in general.
Yes, in a sense I'm handling data to a 3rd party, but in another sense they're just today's notebooks and drawers.
The government can request or compel that party to disclose that information they do not have to go through you any more, this means that you can't claim 4th amendment rights as you aren't even "involved" in the process.
At a later date, private phones became the norm. And so in Katz v. U.S. decided in 1967, warrants for tapping phones were held to be required. That is because people's expectations of privacy had changed.
In the case of TOR, people were using a service that was advertised as being designed by the NSA to protect your online privacy EVEN IF you were under attack by state actors. In fact it was widely advertised that all anyone could know is that you were using TOR, but nobody would know what you were doing with it, who you contacted, and so on.
What do you think would have been a reasonable expectation in 2014? That using TOR meant your communication was private, or publicly available?
I would say that the assumption is that your communication is public.
Expectation of privacy is kind of based around self-incrimination, and you lose a lot of those when you hand information to a third party.
Even if it's "public" (in the legal sense of 'not protected'), Tor can be useful against non-state actors, or against weaker state actors.
I'm not saying there isn't a colloquial expectation of privacy, but that the jurisprudence on privacy doesn't apply to Tor (or at least, that there is an argument that it doesn't).
If government wants something forbidden, it creeps towards it. Expectations are meaningless without threats.
The general assumption back when Silk Road was created was that TOR itself was safe, and the most likely way to be discovered was for your personal machine to be compromised. This belief was only strengthened by the FBI's repeated failures to take down Silk Road.
Heck, this was still a widespread belief AFTER Silk Road was taken down! For example http://motherboard.vice.com/read/the-fbis-deep-web-raid-seiz... quotes a security researcher who came to the conclusion in late 2014 that the FBI was just scanning TOR, and TOR itself had not been compromised.
For a comparison to phones, the Supreme Court has held that a list of people you called is not protected, but the contents of your phone calls are. Similarly I think they should rule in this case that the fact you're using TOR is not protected, but the details of what you were doing on TOR is covered by the 4th amendment.
What actually happened is the researchers found a way to bypass the middle guy and reconstruct the info just from the two ends. That's still just comparing notes, but from fewer people.
In our surveillance society, the government's theory is that it should never need a warrant, because terrorism. I strongly oppose that theory. I'm OK with taking down Silk Road, but get the warrant first.
I wonder if false advertising can create a legal expection of privacy. What if I sell a red filter for you to hang in your windows, and advertise that it protects against anyone seeing through. But you can just apply an anti red filter to a camera and see perfectly. Is the government allowed to do that? (I don't particularly understand optics, and this likely doesn't actually make sense, but you hopefully get the idea).
An argument can be made that if someone's using something they don't understand, they shouldn't have a reasonable expectation that it's as described, especially if they aren't paying.
Many people have misconceptions about VPNs as well. That doesn't mean the data they willingly hand over is reasonably expected to be private.
(If there's precedent for a false advertising interacting with the third party doctrine, I'd be interested in seeing it.)
That line of reasoning would mean there is no "reasonable expectation of privacy" ever, against global adversaries like the NSA.
They even advertise it themselves "Total Information Awareness", "Nothing is beyond our reach", etc.
And this is why codified law is nice.
By that argument mail, courier, landline phone, cellphone, satellite phone, email, web chat, SMS, and everything except face to face speech aren't protected.
Legally, I suspect that's a bit of a reach.
Wikipedia says: "In the United States, the Federal Rules of Evidence do not recognize doctor–patient privilege."
Look for the "padlock" icon in your browser before talking to your doctor about Viagra. ;)
> The Court agrees with the government that applicable Ninth Circuit authority precludes the defendant’s success on his motion. SEI’s identification of the defendant’s IP address because of his use of the Tor network did not constitute a search subject to Fourth Amendment scrutiny. The Court reaches this conclusion primarily upon reliance on United States v. Forrester, 512 F.2d 500 (9th Cir. 2007). In Forrester, the court clearly enunciated that: “Internet users have no expectation of privacy in ...the IP address of the websites they visit because they should know that this information is provided to and used by Internet service providers for the specific purpose of directing the routing of information.” Id. at 510.
> In the instant case, it is the Court’s understanding that in order for a prospective user to use the Tor network they must disclose information, including their IP addresses, to unknown individuals running Tor nodes, so that their communications can be directed toward their destinations. Under such a system, an individual would necessarily be disclosing his identifying information to complete strangers. Again, according to the parties’ submissions, such a submission is made despite the understanding communicated by the Tor Project that the Tor network has vulnerabilities and that users might not remain anonymous. Under these circumstances Tor users clearly lack a reasonable expectation of privacy in their IP addresses while using the Tor network. In other words, they are taking a significant gamble on any real expectation of privacy under these circumstances.
> [...]
> The evidence before this Court indicates that SEI obtained the defendant’s IP address while he was using the Tor network and SEI was operating nodes on that network, and not by any access to his computer.
SEI got the IP addresses because the Defendant's computer communicated that information to SEI.
You can imagine that the briefing went something like this:
Government: there is no expectation of privacy because connecting to Tor involves giving out your IP address to random people on the Internet.
Defendant: but the purpose of Tor is to hide your IP address from anyone that might matter.
Government: well obviously that didn't work because we figured out his IP address.
The point of vulnerabilities isn't the basis for the Court's opinion--it's just a rebuttal to the idea that Tor is supposed to keep your IP address secret even though it necessarily involves giving it to at least some untrusted nodes.
>Importantly, my defense of the third-party doctrine implies an important limit: The doctrine should apply when the third party is a recipient of information, but it should not apply when the third party is merely a conduit for information intended for someone else.
Sourced from http://www.abajournal.com/magazine/article/the_data_question...
The linked argument (which is one half of a debate), argues that the third party doctrine should apply to things that you wouldn't be able to hide without third parties. So metadata is covered, because you can't hide who you communicate with, but content is not. The data collected here is metadata (who connected to the site), so it seems they would consider it collectable legally.
Just because you used Tor doesn't make your IP address invulnerable to subpoena.
If I connect through 7 proxies and do something illegal, my IP is no less subject to subpoena than if I weren't to use a proxy at all.
If I stand in my front yard, in view of my neighbors, put on a mask, then I go rob a store, wearing that same mask, I don't have a reasonable expectation of privacy as to my identity while wearing the mask.
This case is far less controversial than the recent one where the FBI hacked all the pervert's computers. It may be an issue of ethics at CMU, but, not an issue with 4th/5th amendments.
What is Tor?
Tor is free software and an open network that helps you defend against traffic analysis, a form of network surveillance that threatens personal freedom and privacy, confidential business activities and relationships, and state security.
So, if the users of a service whose explicit mission statement is to provide anonymity and privacy apparently do not have "reasonable expectation of privacy," who does? Are they going to argue next that the private owner of a wifi-capable laptop has no expectation of privacy in their own home because the webcam could be conceivably hacked and remotely activated?
Is there a reasonable expectation that my new car won't explode when I turn the ignition, if I haven't stripped and rebuilt it to verify every part?
This is an interesting judgment. Tor's purpose is to provide privacy. The fact that it may have vulnerabilities (as all software does) doesn't mean that a person using Tor doesn't expect that it will provide them with privacy.
By voluntarily giving that information up, there is no reason to expect that the Tor server you're connecting too will keep that information private anymore then a Facebook server would, even if we would like/hope that to be the case. The person who owns the Tor server is well within their rights to keep a log of every IP connected to their server.
You also have no control over the node which makes the actual connection to the outside world - In which case that server can equally log anything it wants about that connection. If the same person controls both servers and puts two-and-two together and figures out you made a connection to website X, they haven't violated your 4th amendment rights because you voluntarily gave that information up by connecting to the Tor network without checking who you were giving that information too.
Tor's intended goal is to provide privacy, but that doesn't mean it gives you a legal expectation to privacy, which I think is what they're getting at. The reality is that third-party entities that can do whatever they want with the data you voluntarily give them - The fact that they're Tor nodes doesn't change this.
What's wrong with this idea?
It's the electronic equivalent of a sticker on your car that says "This car is intended to provide its users a reasonable expectation of privacy under US and international law."
I dunno. I've seen some good arguments either way here, and I'm also not a lawyer.
If it did, you can substitute out this SEI story with the CIA just secretly directing multiple tor node owners to run special versions of their software without notifying users.
Of course it wouldn't. Asserting something does not make it true. Your example is as trivial as mine, from a legal point of view -- you can't create constitutional rights that don't exist simply by asserting them. The courts decide where people have an expectation of privacy; you can't just create that expectation by writing it down.
Suppose Tor provided a box that users could (optionally) click to affirmatively declare they were using Tor with an expectation of privacy. Maybe this selection could be locally stored in an encrypted form so that users, if they later needed to prove they had an expectation of privacy, could show they had ticked the box declaring that.
This could provide an affirmative declaration that the user expected privacy when using Tor. Would that be useful? Thoughts, anyone?
The expectation of privacy (at least in the US) is not necessarily about what the users actually think about their level of privacy, but of what a well-informed user might expect.
A well-informed user of Tor knows its handing the exit nodes a lot of information, and thus using Tor makes what you're doing semi-public.
Thinking back to the HeartBleed incident, does this set a precedent for the government to subpoena information related to private keys that may have been exposed due to a software vulnerability and recorded as part of a federally funded university security research lab investigation into said vulnerability? Given that HeartBleed was so public, the likelihood of private keys and certificates not being revoked is pretty low. But what about the next major software vulnerability that doesn't have the same publicity?
Or extrapolating even further, what about DNA that may be collected and kept by entities receiving federal funding. Say healthcare funding? Does that entitle the government to access?
This is a real question - I haven't been able to ask someone directly involved in unmasking users like that.
So, in short, the people at the SEI sleep as well as the people at Raytheon or Lockheed Martin that build the drones, or the folks at Alcatel-Lucent who helped the NSA way back, or maybe even the guys way back at Los Alamos. It's not like some grad students or CS professor got strong-armed into doing this. It's literally their job to do this kind of work for the DoD and other government offices. While the ethics of this line of work are certainly up for debate, they knew exactly what they were getting into.
When I studied it, it basically boiled down to the arguments about patents. We never discussed IBM's involvement with the Gestapo, or the Apartheid South Africa Government.
[1]: https://blog.torproject.org/blog/tor-security-advisory-relay...
Note to the next framers of a constitutional republic. Include some notion of objective unit and functional tests.
You might hold a differing view, but the fact is, reality works as I've described. Delude yourself all you want, but your rights do hinge on the imperfect and subjective manner in which your benevolent rulers have granted them to you.
They have not granted you absolute rights, specifically laid out, but they have done better than, "rights.. and stuff."
This argument is really semantic.
The line always devolve to the tautological "the only rules of the universe are physical rules"
It's just something I believe is worth keeping in mind when talking about your "right to privacy", specifically. There are many prominent public figures who actually don't believe you have that right at all, and when we remember that rights (as we're referring to them) are granted only by the grace of the state, if the members of the state don't believe you have a right, then you simply don't.
The argument here should be more about whether or not it's in the state's best interest to grant the right to privacy to its citizens, and I think there's a pretty strong argument in favor of that, but simply stating "I have a right!" doesn't illuminate that argument very much.
-- The Declaration of Independence
In an American context, human rights are often thought as coming from a God or Creator. They are either preserved or infringed upon by the state, but aren't granted by the state. As a practical matter, just government is required to safeguard those rights.
"We the People of the United States, in Order to form a more perfect Union, establish Justice, insure domestic Tranquility, provide for the common defence, promote the general Welfare, and secure the Blessings of Liberty to ourselves and our Posterity, do ordain and establish this Constitution for the United States of America."
And the Fourth Amendment itself, which enumerates the right at stake, specifically talks about "reasonable":
"The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated, and no Warrants shall issue, but upon probable cause, supported by Oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized."
They might talk about "natural" rights in grade school, but that is not the reasoning that the legal system was ever buillt (not even in the 1790s!) to operate on.
Certainly society is a secondary concept to any strictly individual notion (just formatively speaking) - of course one starts at a point where others have already built up what is currently the case, but certainly that's not saying anything about rights being 'gifted' to an individual - only that there is a threat of violence against individuals by society for all matters not included in said 'rights'.
You're free to play with definitions as you want - but it would help if you had rather spent that time on a clear argument then on statements such as these:
> You might hold a differing view, but the fact is, reality works as I've described.
It can be argued in many different ways, but the actual, consequential mechanisms regarding a person's "rights" are enforced at a legal level, and are done so at the discretion of the state. Reality does work, therefore, as I've described, regardless of what eloquent points you might make about the innate personal liberties each person is "born with". This is my "clear" argument.
Holy tautological christ, batman!
> "physical reality" that exists independent of the concept of personal liberty
How about gay rights? Or reproductive rights? Or the right to use Uber? To argue ideology does not impact our legal system is frighteningly ignorant.
It seems evident that if enough people feel entitled to something (justly or not) it's possible the state is forced to adapt or not enforce unpopular laws. The state influencing society and society influencing the state are not mutually exclusive.
We're talking about "rights" in the context of "what can and can't be done", and I'm concluding that what some people are claiming as "unalienable" or "innate" aren't actually so.
It doesn't matter how many people "feel entitled" to anything. It does not seem that the state is "forced" to do anything. The state can choose to act and behave a certain way, but "forced" is simply wrong, as a way to describe how the state behaves. "Influence" is more accurate, certainly.
It may feel "wrong" or "bad", the fact that the state maintains absolute control, but it's true. Only through the grace of the state's benevolence does the influence of individuals or groups matter. The state gives you many ways to move through its control, and is generally benevolent, but not because it has to be.
My post made no mention of expectations to rights or liberties. My point was the document intended to place limits on the government isn't very objective. And from one perspective - seemingly useless.