declan

This is the rule: Party X will defend unconstitutional electronic surveillance when the president is Party X. And it will attack unconstitutional electronic surveillance when the president is NOT(Party X).

The above rule holds true for both major parties.

There are two ways in which the "USA Freedom Act" could cover flying dirtboxes: regulation and reporting. I've been working on http://recent.io/ rather than following this closely but I'm not aware of any effect the bill would have on dirtboxes (love that term!).

Here are some excerpts from the WSJ paywalled article:

Cellphones are programmed to connect automatically to the strongest cell tower signal. The device being used by the U.S. Marshals Service identifies itself as having the closest, strongest signal, even though it doesn’t, and forces all the phones that can detect its signal to send in their unique registration information. Even having encryption on one’s phone, such as Apple Co. ’s iPhone 6 now includes, doesn’t prevent this process...

The program cuts out phone companies as an intermediary in searching for suspects. Rather than asking a company for cell-tower information to help locate a suspect, which law enforcement has criticized as slow and inaccurate, the government can now get that information itself. People familiar with the program say they do get court orders to search for phones, but it isn’t clear if those orders describe the methods used because the orders are sealed.

Also unknown are the steps taken to ensure data collected on innocent people isn’t kept for future examination by investigators. A federal appeals court ruled earlier this year that over-collection of data by investigators, and stockpiling of such data, was a violation of the Constitution.

This isn't exactly new. Harris' Stingray price list has AIRBRN-KIT-CONUS for sale for $9,000, dating back to 2008: https://info.publicintelligence.net/Harris-SurveillancePrice...

Here's a 2013 post on the so-called DRTBOX: http://electrospaces.blogspot.com/2013/11/drtbox-and-drt-sur...

And another blog post from 2013 saying "Immigration and Customs Enforcement (ICE) purchased $3 million worth of Stingrays over several years, and are purchasing airborne mounting kits for both drones and manned aircraft": http://gritsforbreakfast.blogspot.com/2013/03/bypassing-tele...

An earlier FOIA response from 2012: http://s3.documentcloud.org/documents/479397/stingrayfoia.tx... "The training will cover all of Harris Stringray ll operations from an airborne platform.-Specifically, four students are to attend this special training on three different software packages GSM, and CDM mobile handsets) for the Program... The schedule is more unpredictable due to a large portion of the training taking place in an aircraft."

To summarize: if you live in the U.S.[1], your cell phone info (IMSI etc.) has been slurped up by flying FedGov "dirtboxes" without your knowledge, stored in perpetuity, without any law passed by Congress explicitly authorizing this, in violation of the Constitution's Fourth Amendment, and at best authorized by a secret court order from a secret court. Sigh.

[1] I presume most of the HN US readers live in or near metro areas, and the WSJ article says the program covers "most of the U.S. population." Obviously if you're in Idaho or Alaska, you're less likely to be caught in this particular data vacuum cleaner.

> Where are all the NSA "reforms" now?

Yep. It's been ~18 months since we first heard of Edward Snowden, and there have been no significant policy (as in, presidential executive order) or legal changes to NSA surveillance authority.

I don't know why there's no modern-day Church committee, but here are a few hypotheses:

1. Sen. Church was running the investigation circa 1975, a few years after Watergate was exposed and a year after Nixon resigned. I suspect there was much more public concern about executive abuses than there are today, and the GOP's willingness to defend the Nixon administration was limited post-Waterage (compare to now, where nearly all Dem politicos will defend to the hilt a D in the White House).

2. Much of FedGov's surveillance abuses pre-Church were clearly illegal and criminal. The lesson intelligence agencies learned is that, no matter how dodgy the behavior, as long as there's an AG opinion theoretically blessing it, you won't be prosecuted. So the surveillance abuses today may violate the 4A and our sense of proportionality, but they aren't clearly indictable offenses. Instead of "clearly illegal" you have "AG blessed in a written opinion and lawyers may disagree."

3. There was no Intelligence Committee back then, so TLAs were more limited in being able to get congressional buy-in for warrantless surveillance. Now there is, and Feinstein (and Rs on it as well, to be sure) have been the biggest defenders of the NSA post-Snowden. They have to be: they were read in on the programs and were complicit in any wrongdoing. Answer: argue there was none!

4. Forty years after the Church Committee, people now may expect to be under surveillance (sadly) and expect FedGov to be corrupt. Look at post-1970s movies like Enemy of the State, Gattaca, Minority Report, A Scanner Darkly, V for Vendetta, etc. So what would have shocked the average American's conscience 40 years ago may now be almost expected. (This is the boiling-frog theory.)

5. There's a lot more inflation-adjusted $$$ to be made from the surveillance-industrial complex now especially post-9/11 than there was 40+ years ago. It may be an order of magnitude higher. More tax $$$ kicking around == more support in Washington officialdom.

I'm sure there are other explanations too but those are the first that come to mind...

> Is there a way to disassociate enforcement from penalizing?

Do a Google search for "predatory agency." It's an idea that's been kicking around the law+econ community for 20+ years. Think the GAO on steroids, and at the state level too.

That's why I said "new legislative initiatives" and not "appointments."

Much of this was known before, including the FBI's anonymous letter attempting to provoke a suicide. As others said elsewhere in this thread, documents came out during the Church Committee. I wrote this 15 years ago when I worked at Time:

      The FBI's campaign to destroy Dr. Martin Luther
      King began in December 1963, soon after the
      famous civil rights March on Washington. It
      started with an extensive -- and illegal -- electronic
      surveillance of King that probed into every corner
      of his personal life. 

      Two weeks after the march, the same week King
      appeared on the cover of Time magazine as "Man
      of the Year," FBI agents inserted a microphone in
      King's bedroom. ("They had to dig deep in the
      garbage to come up with that one," FBI director J.
      Edgar Hoover said of the Time cover story.) Hoover
      wiretapped King's phone and fed the information to
      the Defense Department and to friendly
      newspapermen. 

      When King travelled to Europe to receive the
      Nobel Peace Prize, Hoover tried to derail meetings
      between King and foreign officials, including the
      Pope. Hoover even sent King an anonymous
      letter, using information gathered through illegal
      surveillance, to encourage the depressed civil
      rights leader to commit suicide. 

      "The actions taken against Dr. King are
      indefensible. They represent a sad episode in the
      dark history of covert actions directed against
      law-abiding citizens by a law enforcement
      agency," a Senate committee concluded in 1976. 

   […]

      History reveals that time and again, the FBI,
      the military and other law enforcement
      organizations have ignored the law and spied on
      Americans illegally, without court authorization.
      Government agencies have subjected hundreds of
      thousands of law-abiding Americans to unjust
      surveillance, illegal wiretaps and warrantless
      searches. Eleanor Roosevelt, Martin Luther King
      Jr., feminists, gay rights leaders and Catholic
      priests were spied on. The FBI used secret files
      and hidden microphones to blackmail the
      Kennedy brothers, sway the Supreme Court and
      influence presidential elections. 

http://www.politechbot.com/p-00660.html

> The Freedom Act is likely better than whatever a Republican controlled legislative branch will pass

In terms of passing new legislative initiatives (modulo some appropriations stuff), the legislative branch is already effectively Republican-controlled because of the GOP House.

The big Senate changes are probably Udall's departure and Feinstein and Leahy losing their committee chairs. Udall's successor is also pro-reform but without the seniority. As for Leahy, there's a reason why the Sunlight Foundation and the other groups have been critical of his bill.

For background I wrote this last year:

http://www.cnet.com/news/nsa-senate-oversight-bill-may-handc... ...the Vermont Democrat also authored the 1994 Communications Assistance for Law Enforcement Act, which is now looming over Web companies, as well as the deeply unpopular Protect IP Act. Leahy had introduced significant portions of the Patriot Act under the name Enhancement of Privacy and Public Safety in Cyberspace Act (PDF) more than a year before the September 11 attacks happened...

I've followed the EFF since the 1990s (and once had an @eff.org mailing address) so I may have some insight. Seth, one of their technologists who posts here, would have more: https://news.ycombinator.com/threads?id=schoen

The danger when dealing with advocacy organizations and DC is that they "go native." It's a variant of the principal-agent problem: advocacy groups cease to act in the best interest of their members/funders. They become enamored of their own press releases, their own ability to have a "seat at the table," or better yet to convene everyone around their table to draft a backroom deal--even if the resulting law is better than no law at all.

The late Paul Weyrich, founder of the Heritage Foundation and ALEC, talked about this a lot in the context of conservative groups and GOP politicians. Whatever you think of his politics, Weyrich's insight was correct. I wrote about this in the CISPA context in 2012 here: http://www.cnet.com/news/advocacy-group-flip-flops-twice-ove...

Now back to EFF: post-CALEA the group moved from its DC lobbyist row offices (which I remember fondly) to SF to avoid being part of that DC deal-cutting swamp. They intentionally haven't reopened a DC policy office--I think only David Sobel is in DC and he does FOIA not policy--though they easily could have.

So I'd say your faith in EFF is well-placed. EFF is working in your interests and the interests of its other members, the snide aside in the linked article notwithstanding.

Now even honorable organizations make mistakes, and I believe EFF is being too enthusiastic about a deeply flawed bill. I would side with the Sunlight Foundation and other groups opposing it. But no organization is going to agree with all of its members 100% of the time, and if you like everything else they do, there's no reason to cease your support now.

Yes, they did:

"Groupon has agreed to change its product name" http://www.gnome.org/news/2014/11/groupon-has-agreed-to-chan...

The legal team of course reviews product names pre-launch. This about-face was due to community/Internet pressure.

Compare to the Stanford Shopping Center, an outdoor mall on the SF peninsula. Parking is difficult when the weather is nice, and sometimes even when it's not.

It's a nice place to walk around outdoors and designed to be pedestrian-friendly (once you park, of course).

By comparison, I went to the Hillsdale Shopping Center a few months ago on a weekday around noon, and the Sears lot was near-deserted: I saw about six cars in it. The food court was also empty and depressing. I don't think the difference is primarily the neighborhoods: both are on El Camino and in upscale areas (Palo Alto is expensive, sure, but Hillsdale serves San Mateo, San Carlos, Burlingame, and Hillsborough, which aren't cheap).

I think the difference is the mall itself: Hillsdale is a traditional massive indoor mall of the sort that this article describes, and Stanford is a better-designed outdoor mall, with segments split up, that's just nicer to walk around.

>This has to have been run by Groupon legal, right?

Yep. And that portion was in bold. Groupon has officially backed down.

>Consistency / familiarity is a very important part of developing UIs/UXs that are intuitive.

This. My understanding is that Google's adoption of Material Design is in large part intended to make apps more intuitive so they'll be used more frequently and by more people. I've found out when testing Recent (http://recent.io/) that average, non-tech users would prefer something intuitive that uses standard UI toolkit features -- even if they're not that exciting -- over highly designed custom interfaces.

The interesting question to me is to what extent iOS apps beyond Google's own will adopt material design...

Police abuses of civil asset forfeiture have been around longer than many HN readers have been alive. Here's an example of civil asset forfeiture abuse in 1991 (the practice extends back to at least 1985), which was the subject of congressional testimony in 1996: https://www.aclu.org/technology-and-liberty/statement-rep-he...

I remember going to DC policy seminars on the topic that groups like the ACLU and the Cato Institute held 10-15 years ago, and Cato published a lengthy paper about these abuses in 2006: http://www.cato.org/sites/cato.org/files/pubs/pdf/balko_whit...

There's even an organization devoted to ending civil asset forfeiture abuses: http://fear.org/

But after roughly three decades of this practice, and over two decades of well-documented abuses, nothing has changed. Why this remains the case, even though every politician and judge is aware or should be aware of these abuses, is left as an exercise for the reader.

>I don't understand how the people who play these games can motivate themselves to get up in the morning.

That's one reason I decamped to the SF bay area. I have friends still living in DC (or one of its inner 'burbs) who have been saying for over a decade that they want to escape the games and backbiting bullshit, but have never managed to do so. One reason is the compensation can be high: the DC area is home to the highest-income county in the nation[1]. Stewart is a senior partner at Steptoe, where the average partner income is approx. $1M[2]; as a very senior one he might be taking home $2M a year.

Plus housing prices are cheaper than SF or the peninsula, and if you're trained as a political fixer/policy wonk, where else do you go?

On a more HN-relevant point, working in DC means trying to get a bigger slice of a fixed pie. Silicon Valley companies and other startups around the world can make the pie bigger. For more realpolitik, check out this provocative essay on DC-Silicon Valley by San Jose-based Cypress Semiconductor cofounder/CEO TJ Rodgers (it's worth a read even if you disagree, I think): http://www.cypress.com/?rID=34975

[1] "The Washington region dominates the list of the most affluent places in the United States..." http://www.washingtonpost.com/blogs/govbeat/wp/2013/12/12/th...

[2] http://legaltimes.typepad.com/blt/2013/02/steptoe-johnson-ll...

Read his book: http://www.skatingonstilts.com/

Welcome to the delightful world of Washington, D.C. realpolitik!

A third possibility is that he honestly believes his position is the correct one--or is holding out the possibility of returning to a .gov/.mil job in this or a future administration--and (a) is using the best arguments for his case, however weak or (b) is on a conference panel, not in a courtroom, and is aiming for entertaining one-liners rather than a point-by-point argument that you'd find in a legal brief or congressional testimony.

I've known Stewart Baker, the ex-NSA GC quoted in the linked article, for about 15 years--not incredibly well, but well enough that he'd show up at parties I held in my home when I was living in D.C. before moving to the SF bay area.

Stewart is extremely smart, should not be underestimated, and HN comments in this thread calling him "incompetent" reflect badly on the person making the comment. He's likely the single most capable adversary the HN/EFF/ACLU/Cato/Mozilla/etc. axis faces over encryption (if he ends up playing that role).

Stewart is correct that end-to-end crypto will "restrict [companies'] ability to sell" products internationally. And he is narrowly correct that "the market for absolute encryption is more limited than you might think" in a corporate environment. https://www.youtube.com/watch?v=ak4ZwLU3aX0 [8:45]

But these are merely clever rhetorical devices. Of course Apple/Google/FB/etc. know that HTTPS will vex snoophappy governments; at this point I suspect their CEOs may view that as a welcome side effect and in any case know their business better than a DC attorney does. And of course banks and brokerage firms don't want end-to-end encryption for their employees; they have likely have FINRA and other legal obligations to preserve correspondence.

Okay, Russia and China are snoophappy and banks may want access to employees' email. Now can we go back to talking about the NSA's bulk surveillance of law-abiding Americans?

Stewart's comments at 12:56 about Silicon Valley companies "picking fights" with the NSA are also misleading. In reality, the NSA was "picking fights" by bulk-tapping Google's interdata center links, subverting encryption standards, and (in the 1990s) defending export controls that weakened American companies' ability to compete. I posted more about this here: https://twitter.com/declanm/status/529804398457651201 https://twitter.com/declanm/status/529798596221095937

Today these companies -- and hopefully the startup founders here on HN -- are merely protecting their users by adopting encryption. At http://recent.io/, which I founded after leaving CNET/CBS earlier this year, our forthcoming Android and iOS apps use only HTTPS to connect to the backend. Naturally.

TLDR: You underestimate Stewart Baker at your peril.

> would we ever have had a Martin Luther King

Here's a possibly-relevant excerpt from an article I wrote for CNET on the topic (before I left earlier this year to found http://recent.io/):

...Project Shamrock had a "watch list" of people whose conversations would be identified and plucked out of the ether by NSA computers. It was initially intended to be used for foreign intelligence purposes, but at its peak, 600 American citizens appeared on the list, including singer Joan Baez, pediatrician Benjamin Spock, actress Jane Fonda and the Rev. Martin Luther King Jr....

It just takes one neighbor to temporarily create a public WiFi connection for your regularly-scanning-for-open-hotspot "smart TV" to dump its entire cache of logs over HTTP.

(Now it may not be designed to do that, of course, but we're both responding to <lurchpop>'s hypothetical.)

Yes, you should know what you're getting into. Especially after the U.S. Supreme Court's Grokster decision. I posted a pseudocode liability IF-ELSEIF-ELSE tree here a few weeks ago (replace "distributing" with "offering"): https://news.ycombinator.com/item?id=8455648

Note the above only discusses copyright liability, and not other potential legal issues.

I looked into these legal questions in some detail in an article I wrote for CNET (before leaving to found http://recent.io/ earlier this year). The short answer is that Verizon has more leeway than it would if it's a cable company, and it's possible that VZ's actions implicate the Wiretap Act, but exact implementation details matter: http://www.cnet.com/news/web-monitoring-for-ads-it-may-be-il...

Here's a related article I wrote about Verizon selling customers' geographical locations, app usage, and Web browsing activities: http://www.cnet.com/news/verizon-draws-fire-for-monitoring-a...

My favorite quote from that story: "We're able to view just everything that they do," Bill Diggins, U.S. chief for the Verizon Wireless marketing initiative, told an industry conference earlier this year. "And that's really where data is going today. Data is the new oil." "We're able to identify what that customer likes not by filling out a form, but by analyzing what they do on a day-to-day basis..."

This is excellent! I've taught a graduate journalism class in the past and <danso>'s approach here is inspiring -- I hope other instructors pay attention.

Though note the class appears to be "COMM273D/Public Affairs Data Journalism," so the students enrolling presumably are willing to put in the effort required to learn a bit about SQL (I don't know if this approach would be as successful in a basic journalism course).

Yep, I'm seeing the same redesigned page. I get the new page with Chrome (OS X) both logged-in and incognito, and also with Safari, but I see the old page in Firefox.

I did essentially the same thing before leaving CBS/CNET earlier this year to found http://recent.io/ -- saving salary over multiple years, buying a smaller house on the SF peninsula rather than a bigger one with a larger mortgage, etc. That gave me the luxury of being able to work-full time on creating this recommendation/prediction engine and accompanying app without worrying about income for now.

It's not an easy process, but it is possible!

>I can't believe someone, especially in tech...

Remember, the author of this article (who of course didn't continue working there) isn't in tech. She previously wrote about working at a non-profit theater company and about wanting to teach English.

If you mean the programmers at this startup, yes, that seems odd. But this may be the least worst of the options they have available, or the author may have taken some liberties with her description of the office environment...

Yep, Magic Leap is headquartered in Florida, but they didn't get the investment until they opened an office in Palo Alto:

http://recode.net/2014/10/20/look-who-else-is-joining-google... "People familiar with the company say Magic Leap was having trouble convincing Silicon Valley types to drop everything and move to Hollywood, Fla., where it is based... So it recently opened a Palo Alto, Calif., engineering office..."

They're currently hiring engineers in Palo Alto: https://www.linkedin.com/jobs2/view/14797737

And their engineering VP for "perception and core software" is based in Palo Alto: http://www.linkedin.com/in/garybradski

https://support.google.com/websearch/answer/465?hl=en "When you delete items from your Search History, they are no longer associated with your Google Account."

Whether you think that's sufficient or not, at least I have the option. And the last octet in my IP address is automatically modified after 9 months and deleted after 18 months even if I don't do anything. If you can tell me how I can do the same thing with Apple's search log files, and what Apple's IP address retention policy for its search log files, I'd be much obliged...

Assuming that Apple does disclose this adequately -- meaning they'd be legally in the clear -- I'd still want to know the answers to: How do I delete the records of my searches saved on Apple's serves? (Google lets me delete my search history.) How do I randomize my unique ID? How many FedGov or state/local agencies have showed up demanding info on which users searched for "dirty bombs" or "how to join Al Qaeda?" Does Apple always require a warrant? Etc.

Separately, Kevin McArthur (author of the Pro PHP book) is reporting this evening on Twitter that Spotlight is harvesting user locations after updating to Yosemite, apparently before the opt-out option is presented: https://twitter.com/KevinSMcArthur/status/523975643340353537 https://twitter.com/KevinSMcArthur/status/523977472627335168

> People should be able to install whatever software on their computers they want

Yep, agreed. But unless I'm missing something, Google is not preventing you from installing whatever apps you want on your handheld computer. <tahooie>, the fellow who started this thread, is free to distribute the .apk file for his app via his own site. (Apple, on the other hand, forbids it.)

In fact, Google tells you how to do this: "you can make them available for download on your own website or server... An easy and quick way to release your apps is to send them to users by email... you can distribute your apps through any app marketplace you want or use multiple marketplaces..." http://developer.android.com/distribute/tools/open-distribut...

And when I've been working on Recent.io, it's a lot easier to distribute to early testers on Android vs. iOS. Simply add someone to a Google Group/G+ group vs. TestFlight, must open in Mail app, provisioning profiles, recompiling, re-uploading, why doesn't this version work, I hit my 100-user limit, etc. Ick.

If the Google Play Store's policies become too aggressive, app developers will begin to shift to competing stores or distribute directly or find HTML5 workarounds. Of course I agree that Google should have reasonable policies, but if you don't like them, they (unlike Apple) at least give you alternatives.