Government Executive - Authors - Brendan Sasso

The Hill's Newest Encryption Fight -- Over Committee Turf

Brendan Sasso, National Journal — Wed, 23 Mar 2016 10:17:02 -0400

Amid a series of terror attacks and the court battle between Apple and the FBI, few members of Congress have any idea how to solve the thorny problems surrounding government access to encrypted data. But that hasn’t stopped them from fighting over who gets to come up with the solutions.

The issue has birthed a uniquely Washington kind of battle—between a “working group” and a “commission.”

On Monday, the House Judiciary Committee and the Energy and Commerce Committee formed a bipartisan working group of lawmakers to study encryption and make policy recommendations. The announcement was a clear rebuke to Rep. Michael McCaul, a Texas Republican, and Sen. Mark Warner, a Virginia Democrat, who have been pushing their own bill that would create a commission of outside experts on privacy, security, and law enforcement to study the issue.

McCaul is the chairman of the Homeland Security Committee, but his bill was referred to the Judiciary, Energy and Commerce, and Foreign Affairs Committees—leaving him with little control over its fate. Speaking to reporters Tuesday, McCaul argued that the creation of the joint working group doesn’t necessarily mean his bill is dead.

“I think they’re not mutually exclusive,” McCaul said of the two approaches. “It may be this working group could actually have good recommendations that the commission I have proposed would take into account.”

But the top lawmakers on the Judiciary and Energy and Commerce Committees appear to have no interest in taking up McCaul’s bill. “To be candid, I think the chairmen and ranking members of the two committees of jurisdiction did not feel comfortable punting on it, in their opinion, by going with the commission,” said Republican Rep. Darrell Issa, one of the eight members named to the House working group. “They wanted to have a more active role.”

Judiciary Chairman Bob Goodlatte sees McCaul’s proposal as a challenge to his committee’s rightful authority over a critical issue. “The Judiciary Committee is a particularly appropriate forum for this congressional debate to occur,” Goodlatte said at a hearing on the issue earlier this month. “As the committee of exclusive jurisdiction over the U.S. Constitution, the Bill of Rights, and the federal criminal laws and procedures, we are well-versed in the perennial struggle between protecting Americans’ privacy and enabling robust public safety.”

Goodlatte insisted that Congress (and presumably not a panel of outside experts) “is best-suited to resolve” the encryption debate.

The joint working group will hold regular meetings in the coming months with technical experts, government officials, and tech industry representatives. The group’s work could—but won’t necessarily—lead to legislation.

Encryption has become a particularly pressing issue as Apple and the FBI have battled over access to an iPhone used by one the San Bernardino shooters. The two sides reached an uneasy cease-fire Monday when the Justice Department delayed a court hearing, saying it had likely discovered a way of unlocking the device without conscripting Apple engineers to deactivate a security feature.

There is no evidence yet on whether the terrorists behind the attacks in Brussels Tuesday relied on encryption to evade surveillance. But the carnage that left more than 30 people dead is already leading to calls to ensure that intelligence and law enforcement agencies have access to the tools they need to thwart terrorists. “We do not know yet what role, if any, encrypted communications played in these attacks—but we can be sure that terrorists will continue to use what they perceive to be the most secure means to plot their attacks,” Rep. Adam Schiff, the top Democrat on the House Intelligence Committee, said in a statement.

“I do think it’s important that Congress act, especially after the events of today,” McCaul told reporters.

While the two House proposals would just study the issue further, Sens. Richard Burr and Dianne Feinstein, the leaders of the Senate Intelligence Committee, are looking to take more aggressive action. They are working on legislation to force companies to provide the government access to encrypted data—a proposal that is likely to face fierce resistance from the tech industry and privacy advocates.

]]>

The White House's Encryption Views Are All Over the Map

Brendan Sasso, National Journal — Tue, 26 Jan 2016 09:39:59 -0500

The widespread use of encryption is making it increasingly difficult for the government to catch gangsters, child predators, and terrorists, a top Justice Department official warned Monday at a technology-policy conference.

“The Department of Justice is completely committed to seeking and obtaining judicial authorization for electronic evidence collection in all appropriate circumstances,” Leslie Caldwell, the head of the Justice Department’s Criminal Division, said in a speech to the State of the Net Conference. “But once that authorization is obtained, we need to be able to act on it if we are to keep our communities safe and our country secure.”

But just minutes after Caldwell finished her speech, another top Obama appointee took the stage at the Newseum in Washington, D.C. to deliver almost the exact opposite message to the audience of tech-industry insiders: Encryption helps protect consumers from hackers, argued Terrell McSweeny, a Democratic member of the Federal Trade Commission.

“As a person charged with thinking about consumer protection, I deeply worry about things like mandatory backdoors,” McSweeny said. “We need to be very mindful of consumer data security, and we should be very, very careful about anything that undermines that data security.”

The comments are just the latest example of top Obama administration officials offering conflicting views on how to address the growing use of encryption, which can thwart both law enforcement agents and criminals from gaining access to sensitive data.

FBI Director James Comey ignited the debate over encryption with a speech in 2014, in which he warned that criminals are increasingly “going dark” from government surveillance.

The FTC is an independent agency, so McSweeny isn’t required to be in lockstep with the FBI or any other part of the executive branch. The commission regulates consumer-protection issues, including privacy and data security. But McSweeny is not the only official to express concerns with policies that could weaken encryption.

Even National Security Agency Director Mike Rogers said last week that “encryption is foundational to our future” and that undermining encryption could lead to more massive hacks, like the breach of millions of federal records at the Office of Personnel Management, which was allegedly conducted by Chinese hackers. “Spending time arguing about, ‘Hey, encryption is bad and we have got to do something about it’—that is a waste of time to me,” Rogers said in a discussion at the Atlantic Council.

As the head of the NSA, Rogers has competing interests when it comes to cybersecurity. Strong “end-to-end” encryption, in which messages are inaccessible even to the tech companies transmitting the data, makes it harder for the NSA to conduct surveillance. But the NSA’s mission is also to protect U.S. networks from foreign hackers—a job that’s made easier by stronger security measures.

That tension between ensuring legal government access to data while keeping out hackers is at the heart of the administration’s conflicted approach to encryption. Most technology experts warn that any “backdoor” for government access can, at least in theory, also be exploited by hackers.

After a lengthy internal deliberation, the White House concluded last year that it would not ask Congress to pass legislation ensuring government access to encrypted data. Instead, the White House is focused on working with tech companies to try to find some other voluntary solution to address the issue. Senior administration officials, including White House Chief of Staff Denis McDonough, met with CEOs of major tech companies in San Jose, California earlier this month to discuss encryption (among other issues).

But the White House’s decision hasn’t settled the debate in Congress. Senate Intelligence Committee Chairman Richard Burr and ranking member Dianne Feinstein are working on legislation to force tech companies to comply with court orders for data. Sen. Mark Warner, a Virginia Democrat, and House Homeland Security Chairman Michael McCaul, a Texas Republican, want to take a more cautious approach and create a commission to study the issue more thoroughly.

For the proponents of government access to data, the terrorist attacks last year in Paris and San Bernardino added even more urgency to the debate. Speaking at Monday’s tech conference, the Justice Department’s Caldwell said that a shooter in Garland, Texas last year sent more than 100 text messages to an overseas terrorist.

“We have no idea what he said because it was encrypted,” she said. “That is a big problem. We have to grapple with it.”

(Image via Orhan Cam/Shutterstock.com)

]]>

Ted Cruz Is Correct: The NSA Reform Bill Allows More Spying

Brendan Sasso, National Journal — Wed, 16 Dec 2015 10:11:11 -0500

Sens. Marco Rubio and Ted Cruz clashed over their opposing votes on a key surveillance bill during Tuesday night’s GOP debate, with each senator trying to establish himself as the strongest on national security.

Rubio accused Cruz of hampering intelligence agencies by supporting the USA Freedom Act, which ended the National Security Agency’s vast collection of millions of U.S. phone records. That information could have been critical in investigating the shooting in San Bernardino, California, Rubio argued. “We are now at a time where we need more tools, not less tools,” the Florida Republican said. “And that tool we lost, the metadata program, was a valuable tool that we no longer have at our disposal.”

Cruz shot back that Rubio “knows what he’s saying isn’t true.” The old NSA dragnet, Cruz argued, covered only 20-30 percent of call records, whereas the Freedom Act will actually allow the agency to collect “nearly 100 percent” of records. Rubio stayed firm, claiming that “there is nothing that we are allowed to do under this bill that we could not do before.”

So who is right? Did the Freedom Act actually give the NSA access to more records, as Cruz is claiming?

Yes, according to top intelligence officials. “The overall volume of call detail records subject to query pursuant to court order is greater under USA FREEDOM Act,” the Office of the Director of National Intelligence wrote in a fact sheet on its implementation of the law last month.

Under the old law, the Patriot Act, the NSA claimed it had the right to collect records on every U.S. phone call. But due to technical obstacles, the agency reportedly struggled to integrate cell-phone records into its database. With people increasingly relying on cell phones instead of landlines, the technical problems had caused a major gap in the NSA’s database.

Under the Freedom Act, the NSA was required to give up control of the database. Instead, the phone companies keep the records themselves, and the NSA can get court approval to search for particular records. But critically, the law includes a provision that requires phone companies to provide “technical assistance” to help the NSA access the data in a readable format. That provision ensures the NSA can access millions of cell-phone records that had previously been beyond its reach.

So while the NSA now has fewer records in its direct possession, the universe of phone-call logs it can access is actually larger.

New Jersey Gov. Chris Christie tried to put himself above the fray by saying the debate over surveillance powers shows why the public hates the Senate—“endless debate about how many angels can dance on the head of a pin.”

]]>

The FAA Will Require $5 Registration Fee for Drones

Brendan Sasso, National Journal — Mon, 14 Dec 2015 15:26:23 -0500

Consumers who buy drones will have to register with the government and pay a $5 fee, the Federal Aviation Administration announced Monday.

The move is an attempt by federal regulators to gain some control over the burgeoning drone industry, which is expecting a surge in sales for the holidays. Lawmakers and government officials have been calling for stricter regulations of recreational drones, citing a number of near misses with airplanes.

“Make no mistake: Unmanned aircraft enthusiast are aviators, and with that title comes a great deal of responsibility,” Transportation Secretary Anthony Foxx said in a statement. “Registration gives us an opportunity to work with these users to operate their unmanned aircraft safely.”

The consumer drone industry was expecting a registration requirement but had lobbied against the $5 fee. Michael Drobac, a lobbyist for the firm Akin Gump, which represents a number of drone companies, called the fee a “disappointment” and warned that it will just discourage consumers from registering at all.

“The minute you ask consumers to pay for something of this kind, it creates a deterrent,” Drobac said. “Even though it’s a mandatory registration, the question becomes: What are the enforcement mechanisms? How will consumers get this information?”

An FAA task force made up of drone companies, consumer advocates, and government officials had called for drone pilots to register but had recommended against a registration fee.

The rules apply to any drones that weigh more than .55 pounds but less than 55 pounds, which covers many (but not all) generally-available drones. Consumers can register online, and will have to provide their names, home addresses, and email addresses. In an effort to encourage registration, the FAA is waiving the registration fee for the first 30 days. Consumers who already bought drones will have to register by Feb. 19.

Owners will have to be at least 13 years old to register, and will have to mark their drone with a unique identification number.The FAA still requires businesses to apply individually for special permission to operate drones for any commercial purposes, such as aerial photography.

“We expect hundreds of thousands of model unmanned aircraft will be purchased this holiday season,” Michael Huerta, the administrator of the FAA, said in a statement. “Registration gives us the opportunity to educate these new airspace users before they fly so they know the airspace rules and understand they are accountable to the public for flying responsibly.”

The rules don’t impose any requirements on the drone makers or retailers. Instead, the responsibility will be on the consumer to register. Drobac said he hopes the FAA will spearhead a public-relations campaign to inform consumers about their responsibilities.

Sen. Richard Blumenthal, a Connecticut Democrat, called the registration rules a “positive step” but said more needs to be done to prevent drones from crashing into airplanes, buildings, or people on the ground. “The FAA needs to combine today’s announcement with effective enforcement, holding anyone accountable who threatens air safety,” he said in a statement. “Congress must act swiftly, empowering FAA even further with more authority, tools, and resources to safeguard our skies from increasing dangers of these new devices.”

(Image via Ahturner/Shutterstock.com)

]]>

FBI Director: It’s Impossible to Ban All Encryption

Brendan Sasso, National Journal — Wed, 09 Dec 2015 15:45:10 -0500

FBI Director James Comey acknowledged Wednesday that determined terrorists and criminals will always have ways to hide their communications from the government.

Even if Congress requires U.S. tech companies to guarantee access to their devices and services, there will likely still be foreign companies that offer strong encryption, Comey said during a Senate Judiciary Committee hearing. And sophisticated terrorists could even build their own encrypted messaging apps, he admitted. Encryption scrambles communications, leaving only meaningless gibberish to anyone who doesn’t have the right “key” to unlock the message.

“I think there’s no way we solve this entire problem,” Comey acknowledged. “Encryption is always going to be available to the sophisticated user.”

The admission may seem to undermine Comey’s push for broader government access to data. But, according to the FBI chief, even though there’s no perfect solution, it’s still worth making it harder for terrorists to escape surveillance.

“The problem we face post-Snowden is, it’s moved from being available to the sophisticated bad guy to being the default. And so it’s affecting every criminal investigation. I agree there’s no way to solve this entire problem, but I still think it’s worth trying to solve a big chunk of it.”

Comey first began warning of the problem of criminals using encryption to “go dark” from surveillance in a speech last year. Companies shouldn’t offer services that make it impossible for them to respond to warrants or other legal orders for information, Comey has been arguing. The recent terrorist attacks in Paris and San Bernardino have created momentum on Capitol Hill to try to address the issue.

Sen. Dianne Feinstein, a California Democrat, said during Wednesday’s hearing that she plans to introduce legislation along with Sen. Richard Burr, a North Carolina Republican, to “pierce” encryption. “I have concern about a PlayStation that my grandchildren might use and a predator getting on the other end, and talking to them, and it’s all encrypted,” she said. “I think there really is reason to have the ability, with a court order, to be able to get into that.”

But tech companies and civil liberties advocates argue that encryption makes the Internet more secure. Any law requiring weaker encryption would make it easier for malicious hackers to steal sensitive information, they say.

Comey dismissed that argument Wednesday. “It’s not a security issue. It’s a business-model issue,” he said, arguing that consumers should pressure tech companies to help the government catch criminals and terrorists.

]]>

Most House Members Want to End Email Spying. Why Hasn’t Their Bill Moved?

Brendan Sasso, National Journal — Wed, 02 Dec 2015 11:00:00 -0500

It’s among the most popular bills in Congress, but it’s still stuck in committee.

More than 300 House members—a majority of the body—have signed on as cosponsors to the Email Privacy Act, which would require police to obtain a warrant before accessing emails, Facebook messages, and other private online content. It has vocal support from conservatives such as Reps. Kevin Yoder and Ted Poe, as well as liberals such as Reps. Jared Polis and Sheila Jackson Lee. Getting it passed is one of the top policy priorities for Internet giants such as Google and Yahoo, and it’s even endorsed by antitax crusader Grover Norquist.

But after more than three years of debate, the bill still hasn’t made it to the House floor for a vote. And on Tuesday, a hearing of the House Judiciary Committee made it clear why: The panel’s chairman, Rep. Bob Goodlatte, isn’t backing the bill yet, and his committee perch gives him enough power to keep it from going through.

Goodlatte said Tuesday he supports the “core” of the Email Privacy Act, but he also demanded changes to ensure the bill doesn’t hamper law enforcement. A Goodlatte aide said the hearing “highlighted some issues that need to be addressed” and declined to say when the bill might advance to a vote in the committee.

Goodlatte’s resistance is proving to be a major stumbling block, even though the bill already has more cosponsors than it would need votes to pass.

Under the Electronic Communications Privacy Act, the government can seize emails that have been opened or that are more than 180 days old without judicial approval. When lawmakers passed ECPA in 1986, they assumed that if a person hadn’t downloaded and deleted an email within six months, it could be considered abandoned and wouldn’t require strict privacy protections. While one federal appeals court ruled in 2010 that the Constitution requires police to obtain a warrant to access emails, other courts have concluded that people lose privacy protections when they share information with third parties such as email providers.

The Judiciary Committee chairman also warned that there are “serious public safety” concerns with a provision that would require police to serve the criminal suspect with the warrant instead of just the suspect’s email provider. And he argued that the bill could undermine investigations by Congress and civil agencies, which don’t have access to criminal warrants.

That concern was echoed by Andrew Ceresney, the head of enforcement at the Securities and Exchange Commission. The Email Privacy Act, Ceresney testified, “poses significant risks to the American public by impeding the ability of the SEC and other civil law enforcement agencies to investigate and uncover financial fraud and other unlawful conduct.”

But Ceresney acknowledged that the SEC hasn’t tried to subpoena email providers since the appeals court granted constitutional protections to remotely stored content in 2010. The bill’s supporters also argued that civil agencies such as the SEC should just continue forcing the targets of their investigations to turn over records instead of going to email providers like Google.

Pointing to the controversy over the Internal Revenue Service targeting conservative organizations, Chris Calabrese, the vice president of policy for the Center for Democracy and Technology, a privacy advocacy group, urged Congress not to allow civil agencies to use the bill as “a tool to gain new powers.”

The bill, which would not affect foreign intelligence operations, had been largely overshadowed by the leaks by Edward Snowden and the debate over National Security Agency surveillance.

Sens. Patrick Leahy and Mike Lee introduced counterpart legislation to the Email Privacy Act in the Senate. The Senate Judiciary Committee held a hearing in September, but like Goodlatte, Chairman Chuck Grassley worried the legislation could hamper law enforcement investigations. The Senate has not scheduled a committee vote on the bill.

(Image via Valeri Potapova/Shutterstock.com)

]]>

FCC Slashes Prison Phone Rates

Brendan Sasso, The Atlantic — Thu, 22 Oct 2015 16:04:38 -0400

Federal regulators on Thursday capped the rates that prison phone companies can charge inmates and their families, delivering a major victory to civil-rights groups and prisoner advocates who have been decrying alleged price gouging for more than 14 years.

In a 3-2 vote, the Federal Communications Commission declared that the current rates charged by phone companies, which average about $3 for a 15-minute call and can sometimes reach as high as $14 per minute, are “unjust and unreasonable.” The new regulations will limit the cost of most 15-minute calls to $1.65 per call.

“For the majority of those faced with these bills, high payments are their reality and incredible sacrifices unimaginable to most of us are being made,” said Mignon Clyburn, a Democratic FCC commissioner who spearheaded the action. “This is untenable, egregious, and unconscionable.”

She argued that the high prices unfairly hurt the families of inmates and that making it easier for inmates to stay in touch with loved ones can help to reduce recidivism.

Martha Wright, a blind Washington, D.C., nurse who wanted to speak to her incarcerated grandson, petitioned the FCC to crack down on prison phone rates in 2003, but the issue languished. Wright died last year.

“Today’s vote will never make up for the inactions of the past, but it is my hope that the order will finally bring relief to those that have waited for so long,” said Clyburn, who teared up as she spoke of the burdens that high phone rates place on poor families.

Chairman Tom Wheeler and Commissioner Jessica Rosenworcel, the two other Democrats on the FCC, joined Clyburn and applauded her efforts on the issue. While criminal-justice reform has been gaining bipartisan support in Congress in recent years, Thursday’s action by the FCC was a strictly party-line vote, with Republicans arguing that the agency was overstepping its legal authority.

Instead of addressing prison payphone rates, Republican Commissioner Ajit Pai focused his remarks on the dangers of contraband cell phones in prisons. “While behind bars, inmates are running drug operations. They are managing gang activities. They are ordering hits. They are running phone scams,” he said. “The time has come to end this crime wave.”

The FCC already voted in 2013 to cap rates for prison phone calls across state lines. The commission on Thursday tightened those rules and expanded them to all calls within states. The commission limited extra charges on calls and established a tiered system, allowing more flexibility for smaller jails than major prisons.

Some civil rights groups had been pressing for lower caps on the call rates, but applauded Thursday’s action. “Today’s vote is a major victory for black families and communities, who are already coping with disproportionate policing and over-incarceration, and who have for too long been seen as a billion-dollar cash cow by prison phone companies,” said Rashad Robinson, the executive director of the Color of Change. “Prison phone companies have profited off the backs of a literally captive audience, charging unconscionable prices with no correlation to the actual cost of services.”

Prison phone companies like Global TelLink, Securus, Telmate, and Pay Tel have claimed the decision will prevent them from getting “fair” compensation and have threatened to sue the agency.

]]>

Regulators: Bill Could Make Cars More Vulnerable to Hackers

Brendan Sasso, National Journal — Thu, 22 Oct 2015 09:34:56 -0400

House Republicans are working on legislation that aims to make cars and trucks more secure from hackers. But federal regulators warned at a hearing Wednesday that the bill could have the exact opposite effect.

“The proposed legislation, as drafted, could substantially weaken the security and privacy protections that consumers have today,” testified Maneesha Mithal, the head of the Federal Trade Commission’s Division of Privacy and Identity Protection.

Internet-connected cars can provide exciting new features for drivers, but they can also be susceptible to cyberattacks. Fiat Chrysler had to recall more than a million vehicles earlier this year after the company discovered a software flaw that could allow hackers to gain remote control over the engine and steering. Privacy advocates have also expressed alarm about the amount of personal information that car companies can collect.

A draft bill released last week by the Republican leaders of the House Energy and Commerce Committee aims to improve vehicle security and give consumers more control over their personal information. The bill would direct the National Highway Traffic Safety Administration to create an advisory council to craft cybersecurity standards for car companies. Anyone who accesses a car’s electronic systems “without authorization” could face a $100,000 fine under the legislation. And the bill would require car companies to create privacy policies and file them with the Transportation Department.

But the regulators warned that the bill would gut existing consumer protections. Under the legislation, companies with privacy policies that meet minimum standards would be immune from FTC privacy lawsuits. “Under this proposal, manufacturers can satisfy the requirements of this section without providing any substantive protections for consumer data,” Mithal argued at the hearing of the Commerce, Manufacturing, and Trade Subcommittee. “For example, a manufacturer’s policy could qualify for a safe harbor even if it states that the manufacturer collects numerous types of personal information, sells the information to third parties, and offers no choices to opt out of such collection or sale.”

She also warned that the section authorizing fines for car hackers could penalize researchers who are just testing a car for security holes. The vulnerability of the Fiat Chrysler cars, for example, was first exposed by cybersecurity researchers. “By prohibiting such access even for research purposes, this provision would likely disincentivize such research, to the detriment of consumers’ privacy, security, and safety,” Mithal said.

Mark Rosekind, the administrator of the NHTSA, argued the bill would allow industry lobbyists to dominate the council in charge of cybersecurity standards. “Ultimately, the public expects NHTSA, not industry, to set safety standards,” he said.

Democrats also blasted the bill, claiming it would only weaken consumer protections. “Instead of pursuing a bipartisan approach, the majority chose to prepare this legislation behind closed doors,” said Rep. Frank Pallone, the Energy and Commerce Committee’s top Democrat.

Republicans defended their legislation, but also acknowledged that it is a work in progress.

“The staff discussion draft that we will review today is a starting point,” said Energy and Commerce Chairman Fred Upton, a Michigan Republican. “It includes proposals intended to foster greater vehicle and roadway safety for motorists now and in the years to come. Some pieces, like having a corporate officer responsible for safety compliance, aren’t new. Other ideas, like how to best ensure cybersecurity, may need to further evolve.”

(Image via Radu Bercan / Shutterstock.com)

]]>

Drone Firm Faces $1.9 FAA Million Fine for Unsanctioned Flights

Brendan Sasso, National Journal — Tue, 06 Oct 2015 16:06:10 -0400

The Federal Aviation Administration on Tuesday announced its largest fine ever against a drone operator, showing that the agency is not afraid to crack down on the booming commercial drone industry.

The agency plans to fine SkyPan International, an aerial-photography company, $1.9 million for conducting 65 unauthorized flights in New York City and Chicago between 2012 and 2014. The flights in congested airspace threatened lives and property, the FAA alleged.

The FAA has issued dozens of waivers in recent months to allow Hollywood studios and other companies to operate drones, but for most cases, there is a blanket federal ban on the commercial use of drones. SkyPan did obtain a waiver in April 2015, but all of the alleged unauthorized flights occurred before that date.

“Flying unmanned aircraft in violation of the Federal Aviation Regulations is illegal and can be dangerous,” FAA Administrator Michael Huerta said in a statement. “We have the safest airspace in the world, and everyone who uses it must understand and observe our comprehensive set of rules and regulations.”

In 2012, Congress directed the FAA to develop regulations to allow for commercial drones in U.S. airspace by September 30 of this year. The FAA, which is still working on the new rules, missed the deadline, meaning that its ban is still in place. People can fly a small drone for recreational purposes as long as they follow rules, like keeping it within sight and flying no higher than 400 feet.

While many lawmakers have been urging the FAA to move more quickly to allow broader legal use of drones, others have been alarmed by the increasing number of near collisions between drones and airplanes. “I call on the Federal Aviation Administration to take aggressive action to protect everyone who relies on safe and secure skies,” Sen. Richard Blumenthal, a Connecticut Democrat, wrote in a letter in August.

SkyPan has 30 days to respond to the FAA’s complaint. Karl Brewick, a production coordinator for SkyPan, said the company is still reviewing the complaint and does not yet have a comment. Michael Drobac, the executive director of the Small Unmanned Aerial Vehicle Coalition, a lobbying group that until recently included SkyPan, called the fine “astronomical” and “heavy-handed.”

“Technically, they were not in accord with the FAA’s guidance,” Drobac admitted. “But it seems a little audacious to be handing out penalties this large when the agency itself has missed a congressionally-mandated deadline to have a rule in place for commercial use."

(Image via Goodluz/Shutterstock.com)

]]>

EU Court Ruling: NSA Spying Violates Privacy Rights of Millions

Brendan Sasso, National Journal — Tue, 06 Oct 2015 09:56:06 -0400

The international fallout over Edward Snowden’s leaks about U.S. surveillance operations continued Tuesday, as the top European court ruled that the National Security Agency is violating the privacy rights of millions of Europeans.

Although the decision by the European Court of Justice is likely to do little to actually curb NSA spying, it could become a major headache for thousands of companies on both sides of the Atlantic.

The court scrapped a “safe harbor” agreement between the U.S. and E.U. that allowed companies like Google, Facebook, and Amazon to freely store Europeans’ data on U.S. servers. The court held that, because of the NSA’s “mass and undifferentiated” surveillance, the U.S. lacks the adequate privacy protection required by E.U. law.

“Permitting the public authorities to have access on a generalised basis to the content of electronic communications must be regarded as compromising the essence of the fundamental right to respect for private life,” the judges wrote. The Court of Justice is Europe’s highest court, and its opinion cannot be appealed.

The ruling could empower each E.U. nation’s individual privacy regulator to investigate company data practices. Although tech companies have been watching the ruling especially closely, it could also affect any businesses that send customer records or human resources information to the United States. “It’s a sad day for European privacy and a sad day for businesses on both sides of the Atlantic,” said Brian Hengesbaugh, a partner with the law firm Baker & McKenzie, who represents businesses in a variety of industries. “There will be a tremendous amount of upheaval.”

Companies could avoid a regulatory crackdown by adding language to their user agreements or by setting up internal company contracts. But compliance could be especially bewildering for small companies that lack teams of lawyers to interpret the decision.

Privacy advocates, who have long accused the U.S. of lagging behind Europe on privacy protection, celebrated the ruling. “Safe Harbor was designed to enable U.S. data companies to engage in pervasive commercial surveillance in the EU,” said Jeff Chester, the executive director of the Center for Digital Democracy, a U.S. privacy group. “The end of the current Safe Harbor regime will be a major global victory for privacy.”

Companies and the U.S. government have been bracing for this decision since the court’s top adviser recommended throwing out the data agreement two weeks ago. The U.S. government wasn’t a party to the case, but officials in recent days have claimed the lawsuit was based on misperceptions about the NSA’s programs. “The United States does not and has not engaged in indiscriminate surveillance of anyone, including ordinary European citizens,” the U.S. Mission to the European Union said in a statement last week. The NSA’s Internet surveillance program, the U.S. said, “is in fact targeted against particular valid foreign intelligence targets, is duly authorized by law, and strictly complies with a number of publicly disclosed controls and limitations.”

Because of the backlash to the Snowden leaks, the U.S. and E.U. had already begun re-negotiating the details of the safe harbor framework. Tuesday’s ruling adds pressure to reach a new deal quickly, although talks have reportedly been stalled over how much access U.S. intelligence agencies should have to European data.

The case was brought by Max Schrems, an Austrian graduate student, who accused Facebook of violating his rights by cooperating with the NSA. “This decision is a major blow for U.S. global surveillance that heavily relies on private partners,” Schrems said in a statement. “The judgment makes it clear that U.S. businesses cannot simply aid U.S. espionage efforts in violation of European fundamental rights.”

Snowden tweeted his support for Schrems Tuesday, saying the activist had “changed the world for the better” and that the safe harbor agreementwas “routinely abused for surveillance.”

In a statement, Facebook emphasized that it was only complying with U.S. law. “This case is not about Facebook,” the Internet giant said. “It is imperative that E.U. and U.S. governments ensure that they continue to provide reliable methods for lawful data transfers and resolve any issues relating to national security.”

<(Image via Carsten Reisinger / Shutterstock.com )

]]>

Feds: App Secretly Hijacked Phones to Mine Digital Money

Brendan Sasso, National Journal — Mon, 29 Jun 2015 16:55:04 -0400

A smartphone app secretly hijacked its users' devices to mine for digital currencies for its developer, federal and state regulators alleged Monday.

The process drained batteries and used up mobile data, potentially causing users to incur fees by going over their monthly data limits, the Federal Trade Commission and the New Jersey Attorney General's office said.

The "Prized" app, which was available on Google's Play Store and Amazon's App Store, advertised that consumers could earn points playing games that they could then use on rewards, such as clothes or gift cards. The company also promised it was free from any malware or viruses, according to the government's complaint.

But instead, the app took control of the user's computing power to secretly mine for virtual currencies, including DogeCoin, LiteCoin, and QuarkCoin, the regulators said. The government's complaint doesn't mention Bitcoin, the most popular virtual currency. People can "mine" for virtual currencies by solving complex mathematical equations.

By tricking users into downloading the app, the developers were able to enrich themselves by hijacking consumers' devices, the regulators allege.

Ryan Ramminger, the CEO of Equiliv Investments, which created the Prized app, agreed to settle the charges with the FTC and New Jersey attorney general. The firm will be barred from creating any malware in the future and will have to pay $50,000 to the state of New Jersey. Ramminger couldn't be reached for comment.

"Hijacking consumers' mobile devices with malware to mine virtual currency isn't just deplorable; it's also illegal," Jessica Rich, director of the FTC's Bureau of Consumer Protection, said in a statement. "These scammers are now prohibited from trying such a scheme again."

(Image via Tanjala Gica / Shutterstock.com )

]]>

Groups Boycott Administration's Facial Recognition Talk

Brendan Sasso, National Journal — Tue, 16 Jun 2015 10:31:32 -0400

The Obama administration's push to restrict the commercial use of facial recognition technology suffered a severe setback Tuesday when privacy groups walked away in protest.

The groups said in a statement that they saw no reason to continue the talks organized by the Commerce Department because the tech industry refused to agree to even modest limitations.

Privacy advocates worry that companies could use facial recognition technology to deliver customized advertisements or even track people as they move through public spaces. And while it's easy to change a password, credit card number, or online account, it can be impossible to alter distinguishing facial features.

"At a base minimum, people should be able to walk down a public street without fear that companies they've never heard of are tracking their every movement—and identifying them by name—using facial recognition technology," the American Civil Liberties Union, the Center for Democracy and Technology, the Consumer Federation of America, the Center for Digital Democracy, and other privacy groups said in the statement. "Unfortunately, we have been unable to obtain agreement even with that basic, specific premise."

The ability of government agencies such as the FBI to scan faces in crowds and protests has raised particular privacy concerns, but the Commerce Department's efforts have focused only on the use of the technology by private companies. Facebook, for example, already uses facial recognition software to tag users in photos.

The collapse of the government-led talks highlights the difficulty in crafting policies through voluntary negotiations with business groups instead of mandatory laws or regulations. And with consumer privacy legislation stalled in Congress, it seems unlikely that tech companies will face major new privacy restrictions anytime soon.

"I think we need to fundamentally rethink the ability of multi-stakeholder processes to produce good privacy rules," said Alvaro Bedoya, the executive director of the Center on Privacy & Technology at Georgetown University Law Center and one of the advocates who now is boycotting the discussions. "The American people need to wake up to what industry lobbying is doing to consumer privacy in Washington."

But the Commerce Department's National Telecommunications and Information Administration, which is convening the talks, isn't giving up yet. In a statement, a spokeswoman said the agency is "disappointed" in the boycott, but that that the meetings will continue with whatever groups want to participate.

"Up to this point, the process has made good progress as many stakeholders, including privacy advocates, have made substantial, constructive contributions to the group's work," the NTIA spokeswoman said. "The process is the strongest when all interested parties participate and are willing to engage on all issues."

And tech groups are vowing to forge ahead with writing a code of conduct for facial recognition software without input from the privacy groups. It is in the industry's own interest, they argue, to ensure that consumers trust their products.

"Regardless of who writes the code, I would hope that everyone could agree that it would improve consumer privacy protections," said Carl Szabo, policy counsel for NetChoice, an industry group that represents Google, Facebook, Yahoo, and other tech companies.

In early 2012, the White House unveiled a "Consumer Privacy Bill of Rights" and urged Congress to enact the protections into law. With the proposal facing long odds on Capitol Hill, President Obama directed NTIA to begin a series of "multi-stakeholder" meetings between industry groups and consumer advocates to develop privacy codes of conduct.

The codes would be voluntary, but companies that agreed to abide by them could brag to consumers about their strong privacy protections. Agreeing to a code and then violating it could result in federal enforcement for deceptive advertising.

The first area that the agency tackled was privacy on mobile apps. In 2013, consumer advocates and industry associations worked on a code for how apps should disclose the kinds of data they are collecting from users.

For the past year, the groups have been meeting to try to craft a code of conduct for facial recognition technology. But the privacy advocates became frustrated that the tech industry refused to agree that companies should have to ask permission in some cases to scan people's faces. Unnecessary restrictions could squelch promising new innovations that would ultimately be good for consumers, the industry lobbyists said.

Bedoya argued that a weak code of conduct would be worse than none at all because Texas and Illinois already have enacted strong biometric privacy rules. While Congress is unlikely to do much on the issue, he argued that privacy advocates should focus on passing more state laws to limit the use of facial recognition technology.

Szabo said he is disappointed that the privacy groups are boycotting the NTIA process and argued that there was still plenty of room for agreement. They could have worked on transparency measures or ways to give users more control over how companies can use their facial images, he said.

"Consensus doesn't mean that everyone always gets everything they want," he said. "But it means we find enough things on which we agree that we can produce something beneficial."

But the privacy advocates say they won't think much of whatever code the industry groups produce on their own.

"You can't call it a multi-stakeholder process if you only have industry stakeholders," Bedoya said.

(Image via )

]]>

Experts: NSA Spying May Leave the U.S. Without Moral High Ground in OPM Hack

Brendan Sasso, National Journal — Mon, 15 Jun 2015 10:43:38 -0400

All signs point to China being responsible for one of the worst hacks in U.S. history, exposing sensitive records of millions of federal employees.

But the U.S. is an awkward position in deciding how to respond to the humiliating blow. That's partially because in the two years since Edward Snowden's leaks about U.S. surveillance, the Obama administration has repeatedly argued that hacking into computer networks to spy on foreigners is completely acceptable behavior.

It won't be so easy for the U.S. to express indignant outrage just because it's on the opposite side of the surveillance this time.

"Stealing secrets from governments is part of spying," said Adam Segal, who studies cybersecurity and Chinese policy as a senior fellow at the Council on Foreign Relations. "You can get angry with the incompetence of our defense. It's hard to get angry with the Chinese for trying."

China has denied responsibility for the breach of the Office of Personnel Management, and attributing responsibility for cyberattacks is always tricky. It's possible that the hackers could be Chinese criminals hoping to use the Social Security numbers and other federal employee records to commit financial fraud.

But top U.S. officials reportedly believe that the Chinese government is behind the attack, and Senate Democratic Leader Harry Reid, who receives classified intelligence briefings, blamed the country in a speech on the Senate floor last week.

If the attack was the work of Chinese government hackers, they could use the information to build a detailed database of information on U.S. officials at all levels of government. Administration officials say the hackers likely obtained security clearances, which could be used to identify undercover U.S. operatives or blackmail officials.

The U.S. has called out China before for cyberespionage. The Justice Department even indicted five alleged Chinese military hackers last year for stealing secrets from U.S. businesses.

But the U.S. has drawn a bright line between spying for national security and spying to gain an economic edge. It's unacceptable to steal trade secrets, U.S. officials argue, but governments spy on other governments every day.

The Snowden documents, for example, revealed that the NSA had tapped into links between Google and Yahoo data centers overseas to collect records on hundreds of millions of people at will.

"The legal safeguards that restrict surveillance against U.S. persons without a warrant do not apply to foreign persons overseas," President Obama explained in a speech last year. "This is not unique to America; few, if any, spy agencies around the world constrain their activities beyond their own borders. And the whole point of intelligence is to obtain information that is not publicly available."

The OPM breach also appears to be different from North Korea's alleged hack of Sony Pictures last year, which caused unprecedented damage to a U.S. company, experts say.

James Lewis, a senior fellow with the Center for Strategic and International Studies, said that the evidence seems to indicate that the hack of OPM was a standard intelligence-gathering operation.

"This is traditional spying stuff, so it's not unprecedented," he said.

But as the most powerful nation in the world, the U.S. doesn't have to worry about being hypocritical, he argued.

"From a legal perspective, we don't have a leg to stand on, but as a great power, we can say, 'Hey, we're not going to let you get away with this, and we want to see this stop,'" Lewis said.

Earlier this year, Obama signed an executive order allowing the Treasury secretary to impose sanctions on individuals or groups that engage in cyber attacks that threaten U.S. national security. Asked about the executive order in a press briefing on Friday, Josh Earnest, the White House press secretary, said that the "newly available option is one that is on the table."

But imposing economic sanctions would almost certainly prompt another retaliation from China, leading to a spiral of hostile steps that neither country wants, Lewis said.

The U.S. response, Lewis predicted, will more likely be symbolic and behind the scenes. The U.S. might delay a meeting between leaders or not give China the kind of public recognition as a global power that it craves, he said.

Segal said it is unlikely that the U.S. could ramp up its surveillance of China as a response. "I assume we're already spying as much as we can," he said. "I don't know how we can do more."

Both Segal and Lewis predicted that U.S. hackers will try to locate the vast batch of OPM records on Chinese servers, and if possible, delete it.

But for now, the U.S. hasn't even publicly accused China of responsibility for the breach.

On Friday, National Security Advisor Susan Rice met with Chinese General Fan Changlong at the White House to discuss military and disaster relief coordination and "narrowing areas of disagreement, including on maritime and cyber issues," according to a statement from the White House.

(Image via Gil C / Shutterstock.com )

]]>

Members of Congress Look to Probe FBI’s Use of Spy Planes

Brendan Sasso, National Journal — Fri, 05 Jun 2015 09:51:33 -0400

Members of Congress are demanding that the FBI turn over more information about its use of airplanes to conduct surveillance of Americans.

The FBI is using at least 50 planes to conduct surveillance operations over U.S. cities and rural areas, the Associated Press reported earlier this week. The planes, registered under fake company names, are equipped with high-tech cameras and, in some circumstances, technology that can track thousands of cell phones below.

"In the wake of the president's signature on a surveillance reform law that ends warrantless bulk collection of Americans' phone records, it is highly disturbing that your agency may be doing just that and more with a secret fleet of aircraft engaged in surveillance missions in the United States," 16 lawmakers, including Reps. Suzan DelBene, Zoe Lofgren, and Chris Van Hollen, wrote in a letter Thursday to FBI Director James Comey.

The lawmakers requested that the FBI brief Congress on the legal theories justifying the program, when it seeks warrants, the technologies it uses on the flights, and how it limits spying on innocent Americans.

Senate Judiciary Committee Chairman Chuck Grassley and Sen. Al Franken sent their own letters this week asking for similar information from the FBI.

In a statement Thursday, the FBI denied that it was collecting any information in bulk or that the program was classified. The bureau said it uses fake company names to protect the security of the operations, and that the Justice Department conducts "rigorous oversight." The flights use cell-phone-tracking technology only in rare circumstances, such as hostage situations, the FBI said.

"It should come as no surprise that the FBI uses planes to follow terrorists, spies, and serious criminals," FBI Deputy Director Mark Giuliano said. "We have an obligation to follow those people who want to hurt our country and its citizens, and we will continue to do so."

]]>

National Security Agency Starts to Shut Down Mass-Spying Program

Brendan Sasso, National Journal — Tue, 26 May 2015 09:50:40 -0400

Senators will return to Washington next Sunday for a last-minute, last-ditch effort to reach an agreement on the National Security Agency's bulk surveillance, but the Obama administration says it's already shutting the program down.

"We've said for the past several days that the wind-down process would need to begin yesterday if there was no legislative agreement," an administration official said Saturday. "That process has begun."

The statement rebuffs Republicans such as Senate Intelligence Committee Chairman Richard Burr, who said early Saturday that the administration was being "disingenuous" and that the program wouldn't really go offline until next week.

Key provisions of the Patriot Act are set to expire on June 1, but White House officials have been warning that, without congressional action, the NSA would need to begin winding down its bulk collection of millions of phone records on May 22. That was the deadline set by the Foreign Intelligence Surveillance Court, which oversees the nation's intelligence programs.

The secretive court, which reauthorizes the phone data-collection every 90 days, told the administration it would need to file its new application by May 22.

"We did not file an application for reauthorization," the administration official confirmed.

White House press secretary Josh Earnest had warned Senate Republicans Friday that "to play chicken with [national security] is grossly irresponsible."

After the Senate failed to agree on legislation to renew the Patriot Act early Saturday, Senate Republican leaders said they would return on May 31 to try to hash out a last-minute deal.

Despite the White House and NSA warning that inaction would risk killing the program altogether, Burr, a fierce defender of NSA spying, said he believed it was merely a bluff.

Speaking to reporters on his way out of the Capitol, Burr said NSA lawyers had assured his staff earlier in the day that the real shutdown would not begin until 4 p.m. on May 31. "The database doesn't go poof and go away," he said.

Asked whether he believed the NSA was lying to the public about an earlier shutdown, Burr said, "I think it's disingenuous, but they don't work for me, they work for the president."

"And the White House has been very specific that they wanted this bill passed," the North Carolina Republican continued. "This was the most significant lobby on a piece of legislation in the six years I've seen the Obama administration."

The House already passed the USA Freedom Act, which would extend Patriot Act authorities but bar the NSA from indiscriminately collecting U.S. records in bulk. Instead, the agency would be able to ask the Foreign Intelligence Surveillance Court for permission to obtain specific records from the phone companies.

Democrats and several Republicans pushed to pass the USA Freedom Act in the Senate. But Majority Leader Mitch McConnell, Burr, and other Republicans warned it would hamper national security.

The Senate voted 57-to-42 on the House bill shortly after midnight Saturday, but it was short of the 60 votes needed to overcome procedural hurdles. McConnell then offered a two-month extension of the Patriot Act without any changes, but it failed on a vote of 45-to-54.

Sens. Rand Paul, Ron Wyden, and Martin Heinrich then objected to extensions of even a few days. Out of options, McConnell said the Senate would return on May 31, and the senators left for their Memorial Day recess.

"This was an entirely avoidable scenario," said Sen. Mike Lee, a Utah Republican who cosponsored the USA Freedom Act. "I think we should have put it on the floor earlier. It was a big mistake not to."

]]>

NSA Spying Heads to Critical Senate Showdown

Kaveh Waddell and Brendan Sasso, National Journal — Thu, 14 May 2015 10:52:29 -0400

The House overwhelmingly approved legislation Wednesday to end the National Security Agency's mass-spying program, setting up a high-stakes showdown next week in the Senate.

Key provisions of the Patriot Act are set to expire June 1, and because of a scheduled recess, Congress has only until May 22 to reach a deal on the controversial post-9/11 surveillance law.

The House's bill, the USA Freedom Act, would extend the Patriot Act while also imposing restrictions on the NSA's powers. Democratic Sen. Patrick Leahy, Republican Sen. Mike Lee, and others are championing counterpart legislation in the Senate.

The White House officially threw its support behind the USA Freedom Act on Tuesday.

But Senate Majority Leader Mitch McConnell is pushing to renew the Patriot Act without any changes, saying the NSA's bulk collection of records on millions of U.S. phone calls is critical for protecting national security. Republican Sen. Bob Corker said Wednesday morning that he is "shocked" at how little data the NSA collects.

"We're not taking up the House bill," Senate Intelligence Committee Chairman Richard Burr, another defender of the NSA, told reporters Wednesday. "The program as designed is effective, and members are reluctant to change things that are effective just because of public opinion."

Burr said he views the USA Freedom Act as "one and the same" as allowing the Patriot Act provisions to expire entirely. "Because when you do away with bulk storage, you basically have an unworkable system in real-time," he said.

McConnell will force a vote on his bill for a clean reauthorization of the Patriot Act next week, Burr said. But he didn't rule out the possibility that USA Freedom Act supporters would be able to offer their bill as an amendment.

Reform advocates hope that the lopsided 338-88 vote in the House will put pressure on the Senate to pass their bill. "The overwhelming vote in the House should send a strong signal to Senate Republican leaders that momentum is on the side of surveillance reform," Leahy said in a statement.

With a 60-vote threshold in the Senate necessary to take any action, it's possible that neither bill will muster enough support to pass. If both sides refuse to back down, the Patriot Act provisions will expire.

That's what privacy advocates such as the American Civil Liberties Union are rooting for, along with Sen. Rand Paul, who has said he plans to filibuster a renewal of the Patriot Act.

Even if the Senate passes McConnell's surveillance bill, it's not clear if the measure could make it through the House. Rep. Adam Schiff, the top Democrat on the House Intelligence Committee, called a clean Patriot Act bill a "nonstarter" in the House.

The NSA's defenders may try to pass a short-term extension, but even that would likely face resistance. Democratic Sen. Ron Wyden and Leahy have said they would oppose any clean extension of the Patriot Act.

Democratic Sen. Richard Blumenthal said he will not support an extension unless it's very short—"weeks," he said. "And only for the purpose of working for some compromise."

Blumenthal called the NSA program "stunningly unproductive" and said he is surprised that "senators would still believe that it is absolutely necessary to our national defense."

With less than a week before the Patriot Act provisions sunset, the Senate's path forward on changing the NSA's surveillance programs—or not—remains unclear.

"You know, Yogi Berra said, 'I never make predictions—especially about the future,' " Burr said.

]]>

NSA Officials Lobby Senators as Patriot Act Nears Deadline

Brendan Sasso, National Journal — Wed, 13 May 2015 09:51:13 -0400

Top intelligence officials met with senators Tuesday in a classified briefing as key surveillance provisions of the Patriot Act edge closer to expiring.

Senators declined to provide any details as they left the secure briefing room in the U.S. Capitol. FBI Director James Comey also refused to answer any questions as he left the briefing.

The other administration officials present at the meeting, according to a Senate aide, were Adm. Mike Rogers, the director of the National Security Agency; Bob Litt, the general counsel of the Office of the Director of National Intelligence; and John Carlin, the assistant attorney general for national security.

Senate Majority Leader Mitch McConnell invited the administration officials to brief the entire Senate on the government's mass collection of U.S. phone records ahead of the June 1 deadline for the program, the aide said.

Although both McConnell and the intelligence officials argue that the program is crucial for protecting national security, they disagree over how to deal with the impending deadline.

McConnell is pushing to renew the Patriot Act without any changes, while the White House has endorsed the USA Freedom Act, which would rein in the NSA's powers. The bill would allow the NSA to continue searching for possible terror connections, but the agency would need a judge's approval to gain access to specific phone records.

"The Intelligence Community believes that the bill preserves the essential operational capabilities of the telephone metadata program and enhances other intelligence capabilities needed to protect our nation and its partners," Attorney General Loretta Lynch and Director of National Intelligence James Clapper wrote in a letter to senators Monday. "In the absence of legislation, important intelligence authorities will expire on June 1."

The House is expected to pass the USA Freedom Act on Wednesday. But the showdown between McConnell and the NSA reformers in the Senate has left the fate of the legislation unclear in the upper chamber.

]]>

Patriot Act In Uncharted Legal Territory As Deadline Approaches

Brendan Sasso, National Journal — Mon, 11 May 2015 10:48:47 -0400

Can Congress overrule a court decision without changing a word in the law?

That's the question that lawmakers are wrestling with after a federal appeals court ruled last week that a controversial National Security Agency surveillance program is illegal. The U.S. Court of Appeals for the 2nd Circuit didn't address the claims that the program violates constitutional privacy rights. But the judges did rule that the NSA's mass collection of millions of U.S. phone records oversteps the authority that Congress gave the agency under the Patriot Act.

Although Congress has renewed the Patriot Act several times since first passing it in 2001, most lawmakers had no idea how the NSA was using the powers, the court found. "Congress cannot reasonably be said to have ratified a program of which many members of Congress—and all members of the public—were not aware," Judge Gerard E. Lynch wrote in a unanimous decision for the court.

The key provision of the Patriot Act, Section 215, is set to expire in just a few weeks. Senate Majority Leader Mitch McConnell and other top Republicans are pushing for a clean reauthorization of the surveillance law, arguing that the NSA program is critical for thwarting terrorist attacks.

Extending the law this time might give it a new meaning because, in the wake of Edward Snowden's leaks of classified documents, lawmakers would understand for the first time what they were actually voting on.

"If they reauthorize the program, the basis on which the 2nd Circuit rejected the program fails, or at least is substantially undermined and would have to be re-litigated from scratch," said Stewart Baker, a partner at the law firm Steptoe & Johnson and a former general counsel for the NSA.

Congress will either renew the program, change it, or let it expire. No matter which option it chooses, the court's decision will be irrelevant in a few weeks, Baker said.

"This was a 97-page law review article," he said. "Its significance is close to zero."

Senate Intelligence Committee Chairman Richard Burr, a North Carolina Republican who also ispushing for a clean renewal of the Patriot Act, argued that the court decision is wrong now, and Congress doesn't have to do anything to address it.

"I think the statutory language today allows the NSA to do exactly what they're doing," he said, adding that the issue will likely end up at the Supreme Court. "I have a very tough time thinking the Supreme Court would look at this law… and come to the conclusion that we didn't empower the NSA to do bulk collection."

But the NSA's critics argue that it won't be so easy for Congress to ignore the court's ruling. Words have meaning, they say, and Congress can't stretch words to mean something new.

"Words don't just mean whatever the NSA says they mean," said Alvaro Bedoya, the executive director of the Center on Privacy & Technology at Georgetown Law Center. If lawmakers want to authorize the mass collection of Americans' phone records, they would have to write new language for that, he argued.

Section 215 of the Patriot Act currently gives the NSA the authority to seize any "tangible thing" that is "relevant" to an intelligence investigation. The government argues that all U.S. phone numbers, call times, and call durations are "relevant" because the agency uses them to compile a vast database that it then sifts through for terrorism connections.

But the court said privacy advocates are right to believe that "such an expansive concept of 'relevance' is unprecedented and unwarranted."

Neema Guliani, a legislative counsel for the American Civil Liberties Union, which brought the case before the 2nd Circuit, said the court decision shows that the Patriot Act can't be used to justify mass surveillance. "The court was pretty blunt in saying the plain language of the statute is clear and that can't be superseded," she said.

She also argued that it's extremely unlikely that a majority of Congress will agree to reauthorize the Patriot Act without substantial reforms. The House is set to vote this week on the USA Freedom Act, which would extend the Patriot Act but keep the bulk databases of phone records out of the hands of the NSA.

The court's decision has given the NSA's critics in Congress a new boost of momentum, Guliani argued. "I would be surprised if, given the Second Circuit decision, members of Congress were willing to reauthorize programs that independent oversight bodies and the courts have now found were a violation of the law," she said.

But Sen. Rand Paul, who voted against the USA Freedom Act last year because he said it didn't go far enough in reining in the NSA, argued that in the wake of the court's ruling, Congress should be especially cautious about any bill to extend surveillance authorities.

"Now that the appellate court has ruled that Section 215 doesn't authorize bulk collection, would the USA Freedom Act actually be expanding the Patriot Act?" the Kentucky Republican and presidential candidate asked in an op-ed in Time. "That would be a bitter irony if the attempt to end bulk collection actually gave new authority to the Patriot Act to collect records.

—Dustin Volz contributed to this article

(Image via Rena Schild / Shutterstock.com

]]>

Democrats Press FCC to Unmask Koch-Backed Groups

Brendan Sasso, National Journal — Fri, 01 May 2015 09:49:44 -0400

Frustrated with the Koch Brothers and other conservative donors pouring money into attack ads, Democrats are asking a federal agency to enact tougher political disclosure rules.

But that agency isn't the Federal Election Commission, which typically handles campaign finance issues. Instead, top Democrats in the House and Senate are pressing the Federal Communications Commission to use its power over the nation's airwaves to make super PAC spending more transparent.

The Keeping Our Campaigns Honest Act (yes, that's the "KOCH Act") would direct the FCC to require that super PACs and other outside political groups disclose their major donors in TV and radio ads.

"The American people are owed a level honesty when it comes to identifying who is trying to influence their vote," said Democratic Rep. John Yarmuth of Kentucky, one of the sponsors of the bill. "So long as these individuals are allowed to continue to spend hundreds of millions of dollars attempting to impact our elections and our democracy, they should also be required to step out into the light and let voters know just who they are."

Minority Leader Nancy Pelosi and Reps. Frank Pallone, Anna Eshoo, G.K. Butterfield, and Doris Matsui are among the 16 leading Democrats backing the bill. Sen. Bill Nelson, the top Democrat on the Senate Commerce Committee, plans to introduce counterpart legislation in the upper chamber in the coming days.

The legislation is dead on arrival in the GOP-controlled Congress, but the Democrats argue that the FCC doesn't actually need any new legal power. The bill is an attempt to pressure the agency to act on its own to expand its existing rules requiring that all TV and radio ads (commercial and political) reveal the "true identity" of their sponsors. That requirement should mean more than just a vague name, like "Americans for a Better America," the Democrats argue—it should mean the group's major donors.

If the FCC followed the Democrats' wishes, it would face fierce resistance from Republicans, who argue that greater political disclosure can lead to harassment and stifle free speech.

And FCC Chairman Tom Wheeler may be reluctant to wade into the contentious debate over political disclosure—especially because the issue has already burned him in the past.

After Democrats first floated the idea of using the FCC to unmask super PAC donors in 2013, Republican Sen. Ted Cruz demanded that Wheeler, then just a nominee, swear never to try the strategy. Cruz blocked Wheeler's nomination for two weeks until Wheeler assured him that the issue was "not a priority."

The FCC and Cruz's office did not respond to requests to comment on the new legislation.

(Image via Mark Van Scyoc / Shutterstock.com )

]]>

For First Time in 7 Years, FCC Fines TV Station for Nudity

Brendan Sasso, National Journal — Tue, 24 Mar 2015 10:00:05 -0400

For the first time during the Obama administration, the Federal Communications Commission on Monday said it plans to fine a television station for airing sexually explicit material.

A Roanoke, Virginia, station accidentally aired a brief pornographic video clip during its evening newscast on July 12, 2012, in a segment on an ex-porn star who was volunteering for a local rescue squad. The station included a 3-second clip from the woman's website of her posing suggestively, but the station says it didn't notice that the site had an explicit video clip in a box on the side of the webpage.

The proposed $325,000 fine of WDBJ Television is the maximum amount possible under the law.

The FCC has long barred radio and broadcast TV stations from airing indecent material such as curse words and nudity. But for much of the Obama administration, the agency declined to enforce the rules, saying its authority was in legal limbo because of constitutional challenges from broadcasters.

In 2012, the Supreme Court upheld the FCC's authority to police the airwaves for indecent content. The FCC settled cases against two radio stations in 2014, but Monday's ruling is the first action against a TV station since 2008.

"Our action here sends a clear signal that there are severe consequences for TV stations that air sexually explicit images when children are likely to be watching," Travis LeBlanc, chief of the FCC's Enforcement Bureau, said in a statement.

The station plans to fight the FCC's decision.

"We are surprised and disappointed that the FCC has decided to propose to fine WDBJ7 for a fleeting image on the very edge of the of some television screens during a news broadcast," Jeffrey Marks, the station's president, said in a statement. "The story had gone through a review before it aired. Inclusion of the image was purely unintentional. The picture in question was small and outside the viewing area of the video-editing screen."

Marks claimed "the enormous fine" would be an "extraordinary burden on protected speech" and pointed to the station's long history of complying with FCC regulations. In filings with the FCC, the station warned that a fine would violate procedural rules and its constitutional free-speech rights.

Conservative values groups celebrated the action, saying they hope it will mean a new era of tougher enforcement.

Melissa Henson, the head of communications and public education for the Parents Television Council, said the major TV networks had been "taking advantage" of lax enforcement and basically daring the FCC to take action.

"The fact that the FCC issued the fine this morning did, I think, send the signal that they are still looking at enforcing the broadcast decency laws," she said. "Hopefully, the broadcast networks will think twice before continuing this agenda of pushing the content envelope."

She complained that Julius Genachowski, who was FCC chairman from 2009 to 2013, made it clear he had no interest in cracking down on indecent content, even after the Supreme Court upheld his authority to do so. She has higher hopes, she said, for Chairman Tom Wheeler, who took office in late 2013.

Henson acknowledged that with cable TV and online video, consumers have more choices than ever in what to watch, much of it beyond the reach of the FCC's broadcast decency rules. But, she argued, it is important to take a hard line against the radio and TV networks because they are using a public resource—the nation's airwaves.

(Image via )

]]>

Obama's 'Privacy Bill of Rights' Gets Bashed from All Sides

Brendan Sasso, National Journal — Mon, 02 Mar 2015 11:26:24 -0500

The White House unveiled an ambitious legislative proposal Friday to restrict how companies, including Web giants like Facebook and Google, can handle private information. And it was promptly denounced by industry groups and privacy advocates alike.

Tech companies warned that the so-called "Consumer Privacy Bill of Rights Act" would impose burdensome regulations, potentially stifling exciting new online services that could benefit consumers. Privacy advocates claimed the bill is riddled with loopholes and would essentially let companies write their own rules.

"We didn't celebrate a great victory yesterday in the fight to protect the Internet for American consumers just to turn around and enable their online information to be easy prey for digital bandits seeking to pilfer Americans' personal information," Sen. Ed Markey, a Massachusetts Democrat and longtime privacy advocate, said, referring to the Federal Communications Commission's vote on Thursday to enact strong net neutrality rules.

Rather than supporting the White House's bill, Markey said he plans to reintroduce his own privacy legislation next week that would crack down on "data brokers"—firms that buy and sell personal information.

The White House proposal is an expansion of seven principles that President Obama outlined in 2012 to protect consumers' online privacy, an idea that went nowhere. The administration now is offering its own legislative text of the principles in a bid to jumpstart discussions on Capitol Hill.

"The Obama administration is committed to protecting consumer privacy while also giving U.S. businesses the flexibility they need to grow and innovate," Lawrence Strickling, the Commerce Department's assistant secretary for communications and information, said in a statement. "With this discussion draft the White House released today, we want to advance President Obama's framework for protecting consumer privacy by bringing all parties to the table to further discuss how we effectively apply privacy protections in the digital age."

The draft bill would declare that consumers have a right to understand how their data will be used, to delete the data collected about them, and to only have data collected in "context"—that is, companies shouldn't reuse or sell data in surprising ways. It would be the first time that U.S. consumers would have broad rights for how companies across all industries could handle their data. Health privacy protections and other sector-specific laws would remain in place.

But privacy advocates are disappointed that the proposal would not give the Federal Trade Commission the power to set regulations to enforce the principles. Instead, companies and industry associations would write their own rules and then ask the FTC to sign off on them. Additionally, the bill would overturn state laws that offer stronger protections.

Alvaro Bedoya, the executive director of the Center on Privacy and Technology at Georgetown University Law Center, warned that the bill "seems to assume a world where all of our data is collected about us, all of the time."

"Since the 1800s, the right to privacy has included a simple right to say 'leave me alone.' This bill moves us to a world of 'take what you want—but try to behave,' " Bedoya said.

Jeff Chester, the executive director of the Center for Digital Democracy, called the draft a "huge win" for companies like Google and Facebook.

"The president allowed the process to be hijacked by the Commerce Department, which is more aligned with the data lobby than the American public," Chester said.

But the Web companies themselves aren't so thrilled with the proposal either. Michael Beckerman, the CEO of the Internet Association, which represents Google, Facebook, Amazon, Yahoo, and others, warned that the bill "casts a needlessly imprecise net."

The Consumer Electronics Association, which represents Apple, Samsung, and other device makers, was even harsher. Gary Shapiro, the group's CEO, said the White House bill "could hurt American innovation and choke off potentially useful services and products."

Even the Federal Trade Commission, which is made up of three Democrats and two Republicans selected by the president, is balking at the bill. An agency spokesman identified "concerns that the draft bill does not provide consumers with the strong and enforceable protections needed to safeguard their privacy."

House Republicans issued one of the more generous reactions to the draft. "There are some interesting elements included in the president's proposal, but we must tread carefully," said House Energy and Commerce Committee Chairman Fred Upton and Commerce, Manufacturing, and Trade Subcommittee Chairman Michael Burgess in a statement.

The proposal did, however, win support from Microsoft, as well as the Software and Information Industry Association.

]]>

President Backs Government-Run Internet Networks

Brendan Sasso, National Journal — Wed, 14 Jan 2015 10:23:33 -0500

President Obama will travel to Cedar Falls, Iowa, on Wednesday to tout the ability of local governments to provide high-speed Internet to their residents.

And he will urge the Federal Communications Commission to strike down state laws around the country that restrict the ability of cities to build their own broadband networks. The move is likely to draw fire from Republicans, who argue that states should be free to set their own policies—including restrictions on local governments.

"Laws in 19 states—some specifically written by special interests trying to stifle new competitors—have held back broadband access and, with it, economic opportunity," the White House wrote in a fact sheet . "Today, President Obama is announcing a new effort to support local choice in broadband, formally opposing measures that limit the range of options available to communities to spur expanded local broadband infrastructure, including ownership of networks."

Telecom and cable companies have been lobbying for the state laws, arguing that it's not fair for them to have to compete with government-owned Internet providers. The companies claim the city projects discourage private investment and are often expensive failures. House Republicans passed legislation last year to protect the state laws from FCC action.

But the White House argues that many Americans lack any option for fast, affordable Internet service from private providers. Some cities have built their own networks offering speeds 100 times faster than the national average.

In a video released Tuesday, Obama explains that Cedar Falls, a city of just 40,000 people, provides broadband speeds that rival what is available in Seoul, Hong Kong, and Paris.

"The reason they can compete with these other cities is citizens got together and made the investment to bring competition in and make sure Internet speeds were just as fast there as anywhere else," Obama said. "That gives them a huge competitive advantage. It means a business can come in and locate there knowing that they can hook into world markets, products, services, anywhere around the globe."

Chattanooga, Tenn., and Wilson, N.C., filed petitions last year asking the FCC to nullify their states' laws limiting municipal broadband projects. The Obama administration plans to file a letter urging the FCC to side with the local governments.

FCC Chairman Tom Wheeler has already indicated he is likely to strike down the state limitations. "I believe that it is in the best interests of consumers and competition that the FCC exercises its power to preempt state laws that ban or restrict competition from community broadband," he said last year.

It's not the first time that Obama has waded into a debate at the FCC, an independent agency that is not bound to comply with his wishes. In November, he urged the agency to enact the "strongest possible" net-neutrality regulations to ensure users can access whatever online content they choose.

In addition to asking the FCC to strike down the state limits, the White House plans to host a summit of mayors and county commissioners who want to build their own broadband projects. And the Commerce Department will provide resources and tools to help local officials get the projects off the ground.

The White House also plans to create a Broadband Opportunity Council to examine government regulations that may be holding back broadband deployment. The Agriculture Department plans to relaunch a program to provide loans to rural broadband providers.

]]>

Why Businesses Love Obama's Push for Security Regulation

Brendan Sasso, National Journal — Tue, 13 Jan 2015 11:00:00 -0500

Business groups and Republicans are used to railing against President Obama's calls for stronger regulation, warning that government mandates will only stifle economic growth. But they're cheering a new data-security plan the president outlined Monday.

The White House's proposal would require companies to notify their customers within 30 days if their personal information has been exposed in breaches such as the ones at Target, Home Depot, and Neiman Marcus.

Companies are enthusiastic about the proposal because they already have to notify consumers about data breaches due to laws in 47 states plus the District of Columbia. The laws vary from state to state, so compliance can be a major headache for national chains like Target.

Obama's plan would create a single national standard for companies to follow.

"Right now, almost every state has a different law on this, and it's confusing for consumers and it's confusing for companies—and it's costly, too, to have to comply to this patchwork of laws," Obama explained in a speech at the Federal Trade Commission. "Sometimes, folks don't even find out their credit-card information has been stolen until they see charges on their bill, and then it's too late."

The proposal won applause from industry groups including the National Retail Federation, the Direct Marketing Association, TechAmerica, the Information Technology Industry Council, and the Software & Information Industry Association.

"When a business is faced with a breach, it's a far better use of its time and resources to focus on mitigating the impact of the breach rather than navigating 47 different state notification laws," said Mary Bono, a former Republican congresswoman who had pushed for data-breach legislation. She is now a vice president at FaegreBD Consulting.

Republican Rep. Michael Burgess of Texas, the new chairman of the House Commerce and Trade Subcommittee, said that one of his first goals for the subcommittee will be passing a data-breach bill.

"Consumers shouldn't have to hold their breath and cross their fingers every time they swipe a card or enter information online," Burgess said. "Cybercrime is a real and escalating concern for the American people, and recent high-profile security breaches have only reinforced the urgent need for congressional action."

But privacy advocates are less thrilled with the proposal. They worry that if Congress preempts state laws, it could actually loosen the reporting requirements for companies.

"Right now, you have a race to the top," said Alvaro Bedoya, the executive director of the Center on Privacy & Technology at Georgetown University Law Center. "There is a patchwork, but right now consumers benefit from that patchwork because companies have to abide by the strongest state's privacy laws."

Justin Brookman, the director of the Consumer Privacy Project at the Center for Democracy and Technology, said he could support a federal data-breach bill—but only if it sets a strong standard and "allows the states a fair amount of autonomy to enforce and enact new protections."

Also on Monday, Obama announced a legislative proposal to restrict the ability of companies to mine the data of students. And he said he plans to soon release a sweeping plan to protect principles he calls the "Consumer Privacy Bill of Rights." The bill would limit how Internet giants like Google and Facebook can collect and handle personal data.

Those steps won praise from the privacy advocates. But the response from industry groups was more predictable.

"We all agree that it's essential to protect consumer data privacy, but new federal regulations won't make consumers any safer," said Mark MacCarthy, vice president of public policy for the Software & Information Industry Association.

(Image via ValeStock / Shutterstock.com)

]]>

Pentagon: Hackers Didn't Get Classified Information From Hack

Brendan Sasso, National Journal — Tue, 13 Jan 2015 09:55:17 -0500

Monday's hack of Twitter and YouTube accounts belonging to U.S. Central Command was embarrassing, but it doesn't appear to have compromised any classified information.

"CENTCOM's operational military networks were not compromised and there was no operational impact to U.S. Central Command," said Navy Commander Elissa Smith, a Pentagon spokeswoman.

Smith said the military is viewing the incident "purely as a case of cybervandalism." But, she said, the Pentagon has notified law enforcement about "the potential release of personally identifiable information."

The hackers posted messages supporting the Islamic State, or ISIS. Some of the messages included publicly available information, such as names and addresses of generals.

The accounts have now been suspended.

The attack came just as President Obama was giving a speech at the Federal Trade Commission on the importance of cybersecurity. Hackers, Obama said, are a "direct threat to the economic security of American families." Cybersecurity is expected to be a major focus in the president's State of the Union address next week.

The hack of the military social-media accounts is yet another reminder that no one is immune from a cyberattack. But cybersecurity experts note that the incident doesn't appear to be nearly as significant as the recent attacks on Sony, Target, Home Depot, or JPMorgan Chase, in which the hackers were able to steal sensitive information.

"It doesn't strike me as particularly significant," said Adam Segal, a senior fellow at the Council on Foreign Relations. "I think it's just irony and embarrassment, especially since the president was speaking about cybersecurity at the same time. But I don't see it as reflecting any new capability or threat."

The hackers likely sent a scam email to trick a person managing the accounts into revealing the password, Segal said.

Michael McNerney, a former Defense Department cybersecurity adviser, said that U.S. operations have weakened ISIS, but that cyberattacks like the one on the CENTCOM accounts can help their recruiting efforts.

"This hack, while not devastating from a security perspective, is a public relations coup for them," he said.

House Homeland Security Chairman Michael McCaul, a Texas Republican, called the incident "severely disturbing."

"Assaults from cyber-jihadists will become more common unless the administration develops a strategy for appropriately responding to these cyberattacks—including those like the North Korea attack against Sony," McCaul said in a statement. "Without laying out the rules of the game for offensive responses and having direct consequences, cyber threats and intrusions from our adversaries will continue and escalate."

]]>

Obama Calls on Congress to Pass Data Privacy Laws

Brendan Sasso, National Journal — Mon, 12 Jan 2015 15:49:03 -0500

In the wake of the massive breaches of Target, Home Depot, and Sony, President Obama urged Congress on Monday to pass a series of cybersecurity and privacy bills.

"This is a direct threat to the economic security of American families, and we've got to stop it," Obama said in a speech at the Federal Trade Commission. "If we're going to be connected, then we need to be protected. As Americans, we shouldn't have to forfeit our basic privacy when we go online to do our business."

The president proposed the Personal Data Notification and Protection Act, which would require companies to notify their customers within 30 days if their personal information has been exposed. The bill quickly earned applause from business groups, who would prefer to comply with a single national notification standard rather than the current patchwork of state laws.

The bill would help consumers know their credit card has been stolen before the hackers are able to use it, Obama said.

He also outlined a new bill, the Student Digital Privacy Act, to restrict the ability of companies to mine the data of children. The measure, which is based on a California law, would prevent companies from selling student data to third parties for non-educational purposes or from targeting advertising to students based on data collected in schools.

Technology can allow for exciting new educational tools, Obama said, but companies should not abuse their access to sensitive academic information of students.

"We've already seen some instances where some companies use educational technologies to collect student data for commercial purposes, like targeted advertising," Obama said. "And parents have a legitimate concern about those kinds of practices."

Jim Steyer, the CEO of children's advocacy group Common Sense Media, said he is "thrilled" with the student privacy bill. Students, he said, "deserve the opportunity to use educational websites and apps to enrich their learning without fear that their personal information will be exploited for commercial purposes or fall into the wrong hands."

The president also renewed his push for a sweeping Consumer Privacy Bill of Rights. Within 45 days, the White House plans to release legislative language to enshrine the principles into law.

The White House first outlined the online privacy rights in 2012 and urged Congress to take up the issue. But there has been little movement on the Hill, and no legislation has been introduced.

Marc Rotenberg, the executive director of the Electronic Privacy Information Center, said he supports the president's bills on student and consumer privacy, but he has some concerns with the data-breach notification bill. "It would preempt stronger state laws, and it lacks a private right of action," he explained.

Some privacy advocates noted that Obama's proposals won't address another critical privacy issue: the government's access to information.

"We're still waiting for reform on NSA and the Electronic Communication Privacy Act after years of intense effort and the creation of a very broad coalition of support," said Justin Brookman of the Center for Democracy and Technology.

In addition to the legislative proposals, Obama also announced several steps he is taking on his own to bolster privacy protections. The White House secured commitments from 75 companies, including Apple and Microsoft, to provide privacy protections to students, teachers, and parents. The Energy Department released new voluntary guidelines for utilities to protect consumer electricity data.

JPMorganChase, Bank of America, USAA, and the State Employees' Credit Union agreed to provide free credit scores to their members. "This means that a majority of American adults will have free access to their credit score, which is like an early warning system telling you've been hit by fraud so you can deal with it fast," Obama said.

The announcements were all part of a series of previews of Obama's State of the Union address, which he will deliver next week.

The president will make more announcements later this week about his plans for cybersecurity and Internet access. On Tuesday, he will travel to the National Cybersecurity and Communications Integration Center to tout efforts to increase voluntary cybersecurity information-sharing between the private sector and the government.

On Wednesday, the president will go to Iowa, where he will announce a plan to increase affordable access to broadband. On Thursday, Vice President Joe Biden will travel to Norfolk, Va., to announce new funding to train Americans for cybersecurity jobs.

]]>