Sunsetting A Few Parts Of The PATRIOT Act May Be Symbolic And Good, But It Won't Really Change Much By Itself

As you likely know, barring some sort of last minute deal this weekend (which is a distinct possibility) a few sections of the PATRIOT Act are set to expire (or, as the cool kids are saying: "sunset"). It is not -- as some have falsely claimed -- the entire PATRIOT Act ending. It just a few pieces -- with most of the publicity focused on Section 215, which had been the rationale for the bulk phone records collection that was the first big leak from the Snowden documents. There's been a bit of a debate among some about whether or not this sunset is really that important, beyond the clear symbolism of finally killing off part of the PATRIOT Act. Two of the people I most respect on privacy and surveillance issues -- Jennifer Granick and Julian Sanchez -- have come down on seemingly different sides of the issue, so it seemed worth comparing what they had to say (and realizing that they're really not that far off from each other). Granick takes the position that letting the provisions sunset is important and a big deal. She admits that it's still limited:

If Congress does nothing, section 215 will sunset. And this is exactly what reformers should be asking for. The fact is, sunset is the only thing that will definitely stop massive spying under section 215. It won’t stop mass surveillance more generally, but killing the law that NSA and FBI have abused for years is the first step.

But, still, she says, it's important and will have an impact. In particular, she notes that while basic reform -- a la the USA Freedom Act -- might have made sense before, "the political winds have shifted." In particular, she points to the the big 2nd Circuit appeals court ruling that noted that Section 215 never really authorized the bulk records collection program in the first place -- along with a growing number of elected officials who appear to believe the intelligence community has gone too far. Her fear, is that if we passed something like the USA Freedom Act, it will take away any chance at real reform, whereas sunsetting may force the issue:

Americans want real, not symbolic change. Sixty percent of likely voters from both political parties believe the rules on surveillance have to become more restrictive. Groups that were heavily involved in the USAF compromise negotiations are concerned that if it doesn’t pass, if 215 sunsets, civil liberties advocates will have to struggle to ensure that something worse than USAF doesn’t become law. But there’s a clear and present danger that if USAF passes, everyone will pat themselves on the back for a job well done, suspicionless domestic spying will continue, the amazing and expansive Second Circuit opinion will be mooted, and it’ll be suspicionless spying as usual until the next big surveillance provision, section 702 of the FISA Amendments Act sunsets at the end of 2017, and we’re in the same position again. The truth is, this struggle to be a robust democracy in the face of the threat of terrorism, is here to stay, regardless of what happens in the next week or so.

So, let’s don’t just do something, let’s stand here. Let’s let 215 sunset. It was unthinkable a month ago. Today it’s likely. In combination with the Second Circuit opinion, the sunset will, irrefutably, put laws on the books that will end domestic dragnets. Then, let’s get serious. Let’s have hearings, really understand all the spying being done in our name, how the information is being used. Let’s set up real, comprehensive, robust checks and balances, starting with declassifying interpretations of law and changing the role of the FISA judges.

On the flip-side, however, we have Sanchez, who argues that the benefits to sunsetting Section 215 are massively overstated. He highlights how the intelligence and law enforcement communities have a number of other authorities under which they have collected similar "bulk" records, and that they would likely shift to pretty quickly after Section 215 goes away.

But while "Sunset the Patriot Act" makes for an appealing slogan, the fact remains that the vast majority of the Patriot Act is permanent—and includes an array of overlapping authorities that will limit the effect of an expiration.

While section 215 covers business records, section 214, also known as the "pen register/trap & trace" authority, covers the acquisition of communications “metadata” (things like dialed phone numbers and email or Internet Protocol addresses) in real time.

Years before the current version of the NSA telephone program under 215 was born, the government employed similar arguments to persuade the secret Foreign Intelligence Surveillance Court (FISC) to bless a bulk program vacuuming up international internet metadata under the aegis of section 214. Though that program was ended in 2011—likely at least in part because NSA was able to obtain much of the same data by collecting it overseas, with fewer restrictions—the authority is permanent.

Also permanent are National Security Letters or NSLs, which that allow the FBI to obtain a more limited range of telecommunications and financial records without even needing to seek judicial approval. Unsurprisingly, the government loves these streamlined tools, and used them so promiscuously that the FBI didn’t even bother using 215 for more than a year after the passage of the Patriot Act. Inspector General reports have also made clear that the FBI is happy to substitute NSLs for 215 orders when even the highly accommodating FISC manages a rare display of backbone. In at least one case, when the secret court refused an application for journalists’ records on First Amendment grounds, the Bureau turned around and obtained the same data using National Security Letters.

Even worse, there's actually something of a "grandfather clause" that will let the NSA keep on keeping on anyway:

Even 215 itself doesn’t really expire when it expires. In theory, the law reverts to a pre–Patriot Act version of the business records authority that is restricted to records that "pertain" to a suspected foreign agent or terrorist—language the government is sure to read as broadly as possible. But thanks to a little-noticed grandfather clause in the law, the current souped-up version of the law, which covers any records “relevant” to an authorized national security investigation, will remain available for investigations already open at the time of sunset, as well as new investigations into offenses committed before the sunset. Since the FBI routinely maintains massive “enterprise” investigations covering entire terror groups, which can continue for years if not decades, we can expect section 215 to have a lengthy afterlife.

In short: sunsetting may be symbolic, but it won't really change much on its own. Sanchez points out that what we really need is real reform -- and his fear is that by focusing so much on championing the "sunset," people advocating for such a solution may miss out on then adding the necessary surveillance reforms that are needed beyond that:

...the celebration may not only be premature, but counterproductive if the impending expiration is perceived as a substantial victory in itself. Some legislators and activists are now so fixated on the symbolism of sunsetting "the Patriot Act" that they’re even urging opposition to broader reforms.

Sanchez readily admits that the USA Freedom Act isn't perfect either, but that it does have many features that are important:

That’s not to say that the USA Freedom Act is by any means an ideal alternative, or that its critics shouldn’t use the sunset of 215 as leverage to push for stronger reforms. USA Freedom, for instance, doesn’t even touch massive surveillance within the United States under section 702 of the FISA Amendments Act, or the even more massive spying enabled by Executive Order 12333, a Reagan-era order that covers surveillance conducted outside the United States. But the Freedom Act does at least cover the full range of Patriot Act authorities that employ the "relevance" standard, preventing a tricky shell game that simply moves collection from expired authorities to permanent ones.

The way USA Freedom seeks to do this is also hardly perfect: The law creates a streamlined process for obtaining specific telephone records from multiple phone carriers (addressing objections that a massive NSA database was the only way to avoid the cumbersome necessity of serving many companies with orders for records stored in incompatible formats) and requires that, across all these authorities, "specific selection terms"—like a phone number or billing address—be used to identify the particular records sought. That means instead of evaluating whether an entire database might be “relevant” when considered in aggregate, the court would have to consider whether the government had demonstrated the relevance of the particular records corresponding to a set of selection terms.

Both are very interesting reads -- and while they appear to be taking the opposite viewpoint, they really are a lot closer than they may appear on the surface. Both are advocating for the need for real surveillance reform, going beyond just this program. Both recognize that sunsetting Section 215 is largely symbolic. Where they differ is in their thinking about how best to get there. Sanchez worries that the sunset will be seen as "mission accomplished" and real reform won't occur. Granick fears the same "mission accomplished" feeling with the too weak USA Freedom Act.

To be honest, they both may have a point. The common message remains there, however: we need real surveillance reform to stop an awful lot of bad activity on the part of the intelligence (and law enforcement) community. Sunsetting Section 215 is a possible step. USA Freedom is another possible step. Either one, on their own, is not nearly enough.

That said, the fact that either are seriously on the table is a huge step forward on its own. For years, surveillance has only expanded. And we're actually at a rare point in history where things are going to go the other way. Now we just need to make it meaningful in creating something that goes beyond either just sunsetting or just USA Freedom.

Permalink | Comments | Email This Story

Body Cam Footage Clears Police Officer Of Bogus Sexual Assault Allegations

With so many police forces being saddled with body cams against their (or their union's) will, you'd think this form of public accountability (but not really, because so many legislators are helping cops opt out of the "accountability" part) was foisted upon law enforcement by axe-grinders looking to finally expose the proverbial "bad apples." There's some truth to that, seeing as some of these implementations have originated as stipulations in settlements with the DOJ.

But what can damn can also exonerate. This video, posted by notorious cop-haters* CopBlock (who, in return, are universally hated by haters of cop-haters…), shows that body cam recordings aren't solely there to encourage cops to be on their best behavior. They're also there to nudge citizens in the right direction. But in this case, the "aggrieved" citizen was far too impaired to notice her dramatics were being observed by an unblinking eye.

*I am, of course, using the term facetiously.

The young woman in the video attempts to set the officer up by using her phone to record an audio only performance meant to make it appear as though he was acting inappropriately. She was attempting to ‘flip the script’. What she failed to realize is that the entire thing, including her devious performance, were recorded.

Audio-only: for when you want a certain version of the "truth" on record. (Still a step ahead of the FBI's pen-and-paper interrogation "recordings...") After failing a field sobriety test, this woman thought she could turn an embarrassing arrest into sexual assault allegations. She asks to use the restroom, and while in there, wonders aloud (a bit too aloud, apparently) how she can get her arresting officer in trouble. Cue the false accusations of "inappropriately touching" her while she was in the squad car and her saying, "Please don't touch me" when the officer is outside the bathroom door, getting this all down on his body cam.

Now, while this does show that body cams can help cops, rather than just "hurting" them, there's still the issue that far too many agencies retain strict control of the resulting footage. This was released by the involved police department -- something likely expedited by the fact that the recording showed no wrongdoing by the officer. The real test of this department's transparency will come when the disputed footage isn't nearly as flattering.

Permalink | Comments | Email This Story

Washington State Says Its Anti-SLAPP Law Is Unconstitutional

For years, we've talked about the importance of anti-SLAPP laws that help quickly toss out lawsuits whose sole purpose are to silence critics. A key point that we've made is the need for a federal anti-SLAPP law, because until then, we're at the mercy of a patchwork of state laws. Some states have no anti-SLAPP law. Some have weak ones. A few have strong ones. In just the past month alone we've discussed Florida strengthening its anti-SLAPP law, and Nevada's attempt to weaken its anti-SLAPP law. Meanwhile, a court in DC issued a ruling that greatly limited the effectiveness of DC's anti-SLAPP law.

And now... Washington State has just ruled its anti-SLAPP law unconstitutional. The full ruling is worth reading, but if you want to dive deep, Ken "Popehat" White has excellent "lawsplainer" as well. In short, this particular anti-SLAPP had a feature unlike most others -- and that was the problem. Basically, it requires the plaintiff "to establish by clear and convincing evidence a probability of prevailing on the claim." Most states, on the other hand, use lesser standards, involving "sufficient" evidence or something similar. The problem, as the Washington court ruling notes, is that by making the standard "clear and convincing" it requires the judge to weigh the evidence. And that's a problem, the court decided, because then the judge is effectively acting as a jury -- thus depriving the plaintiff of a constitutionally guaranteed jury trial:

Thus, [the Washington anti-SLAPP law] creates a truncated adjudication of the merits of a plaintiffs claim, including nonfrivolous factual issues, without a trial. Such a procedure invades the jury's essential role of deciding debatable questions of fact. In this way, [the anti-SLAPP law] violates the right of trial by jury under article I, section 21 of the Washington Constitution.

In short: the court is saying that the anti-SLAPP would be okay if it were more like a summary judgment situation, wherein the judge didn't have to weigh any of the evidence on the merits. Once it gets to that stage, however, it's taking on the role of a jury. As Popehat notes, this might impact some of the stronger anti-SLAPP laws out there, but it's fixable, just by changing the standard. Unfortunately, though, that does lower the power of some anti-SLAPP laws:

Fortunately, the fix is relatively simple — all state legislatures have to do is define the plaintiff's burden carefully so that it resembles the summary judgment burden — the burden to produce admissible evidence which, if believed, is enough to win. Practically speaking, that will continue to weed truly frivolous cases out.

Speaking as someone who hates censorious and vexatious lawsuits, it would be nice, on some level, if plaintiffs suing over speech had to prove that their evidence was not just sufficient but strong. But that requirement has always been vulnerable to attack.

This ruling will only impact the more aggressive anti-SLAPP statutes, not the most common ones.

Permalink | Comments | Email This Story

UN Report: Encryption And Anonymity Deserve 'Strong Protection'

Techdirt has been following for a while a worrying move to demonize strong encryption, amid calls from politicians and senior law enforcement officials for it to be undermined or compromised. That makes a new report affirming the central importance of encryption (doc), from the UN's Special Rapporteur on the promotion and protection of the right to freedom of opinion and expression, David Kaye, particularly valuable. His report clearly inhabits a post-Snowden world, since it takes as its starting point the following:

Contemporary digital technologies offer Governments, corporations, criminals and pranksters unprecedented capacity to interfere with the rights to freedom of opinion and expression.

The report looks at ways in which encryption and anonymity can help to protect basic rights to privacy and freedom of opinion and expression, and explores to what extent governments may impose restrictions. In many ways, the most interesting aspect of his analysis concerns the right to hold opinions:

During the negotiations on the drafting of the [International Covenant on Civil and Political Rights], "the freedom to form an opinion and to develop this by way of reasoning was held to be absolute and, in contrast to freedom of expression, not allowed to be restricted by law or other power". The ability to hold an opinion freely was seen to be a fundamental element of human dignity and democratic self-governance, a guarantee so critical that the Covenant would allow no interference, limitation or restriction.

But as Kaye points out, the ability to hold opinions is now intimately bound up with technology:

Individuals regularly hold opinions digitally, saving their views and their search and browse histories, for instance, on hard drives, in the cloud, and in e-mail archives, which private and public authorities often retain for lengthy if not indefinite periods. Civil society organizations likewise prepare and store digitally memoranda, papers and publications, all of which involve the creation and holding of opinions. In other words, holding opinions in the digital age is not an abstract concept limited to what may be in one's mind. And yet, today, holding opinions in digital space is under attack.

Encryption and anonymity, he concludes, are powerful ways to preserve that right to hold opinions in a digital form:

The right to hold opinions without interference also includes the right to form opinions. Surveillance systems, both targeted and mass, may undermine the right to form an opinion, as the fear of unwilling disclosure of online activity, such as search and browsing, likely deters individuals from accessing information, particularly where such surveillance leads to repressive outcomes. For all these reasons, restrictions on encryption and anonymity must be assessed to determine whether they would amount to an impermissible interference with the right to hold opinions.

In terms of "permissible interference," the following factors are key:

Restrictions on encryption and anonymity, as enablers of the right to freedom of expression, must meet the well-known three-part test: any limitation on expression must be provided for by law; may only be imposed for legitimate grounds (as set out in article 19 (3) of the Covenant); and must conform to the strict tests of necessity and proportionality.

It's the last of those that is increasingly under the spotlight after Snowden's leaks revealed a global system whose underlying principle -- "collect it all" -- is the very antithesis of proportionality:

A high risk of damage to a critical, legitimate State interest may justify limited intrusions on the freedom of expression. Conversely, where a restriction has a broad impact on individuals who pose no threat to a legitimate government interest, the State's burden to justify the restriction will be very high.

Kaye picks up on this theme again in his recommendations, where he notes that encryption and anonymity are not just vital for the right to freedom of opinion and expression in the digital age, but also for other rights, including economic rights, privacy, due process, freedom of peaceful assembly and association, and the right to life and bodily integrity. As a result:

States should not restrict encryption and anonymity, which facilitate and often enable the rights to freedom of opinion and expression. Blanket prohibitions fail to be necessary and proportionate. States should avoid all measures that weaken the security that individuals may enjoy online, such as backdoors, weak encryption standards and key escrows. In addition, States should refrain from making the identification of users a condition for access to digital communications and online services and requiring SIM card registration for mobile users. Corporate actors should likewise consider their own policies that restrict encryption and anonymity (including through the use of pseudonyms). Court-ordered decryption, subject to domestic and international law, may only be permissible when it results from transparent and publicly accessible laws applied solely on a targeted, case-by-case basis to individuals (i.e., not to a mass of people) and subject to judicial warrant and the protection of due process rights of individuals.

One issue rather skated over there is what happens when court-ordered decryption is impossible. Kaye rightly notes that it is "a seemingly universal position among technologists that there is no special access that can be made available only to government authorities, even ones that, in principle, have the public interest in mind." Absent such backdoors, you can build systems where even the service providers cannot access messages, which renders court orders moot. Nonetheless, Kaye's report is important, because it offers a counter-argument to repeated assertions by the authorities that encryption is essentially something bad, used by bad people to do bad things. He also has an answer to those who claim that strong crypto will usher in a new Dark Age for law enforcement:

Governments have at their disposal a broad set of alternative tools, such as wiretapping, geo-location and tracking, data-mining, traditional physical surveillance and many others, which strengthen contemporary law enforcement and counter-terrorism.

That's a crucial fact that is almost always overlooked. Its appearance here is another reason why this new UN report is welcome.

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Permalink | Comments | Email This Story

Dallas PD Guts Specifics From Citizen Recording Policy, Leaving Only Vague Reminder To Respect Pre-Existing Rights

It shouldn't need to come to this, but the Dallas Police Department has finally issued a policy related to citizen photography. There are many reasons law enforcement agencies need to remind officers of the right to record, but the Dallas PD may have needed a bit more of a nudge after a Texas legislator tried (unsuccessfully) to impose additional restrictions on citizen recordings -- like a 25-foot "halo" around working officers, supposedly for their safety.

The issued general order seems straightforward enough.

[N]o member of the Dallas Police Department may prevent or prohibit any person's ability to observe, photograph, and/or make a video recording (with or without a simultaneous audio recording) of police activity that occurs in the public domain, so long as the person's location, actions. and/or behavior do not interrupt, disrupt, impede, or otherwise interfere with a peace officer while the peace officer is performing a duty or exercising authority imposed or granted by law. The public's access to information regarding the official business of the Dallas Police Department is of critical importance to effective, transparent government.

Driving the point home further is the summary paragraph at the bottom of the order:

It is increasingly common for uninvolved bystanders at the scene of police activity to photograph and/or video/audio record the actions and conduct of police officers. Officers of the Dallas Police Department should simply assume at any time a member of the general public is likely to observe, and perhaps even photograph or video/audio record their activities.

This is a good assumption to make. And better yet, there's no ridiculously arbitrary "halo" -- one backed up by possible felony charges -- attempting to further separate the police from public accountability.

So, what's the problem with this order? It's all the stuff it left out. As has been observed on multiple occasions, there are ways officers can still abide by the letter of an order while stomping all over its spirit. In addition to direct intimidation, officers have been known to block off recordings with their bodies or render recordings useless through other means. The Dallas PD originally considered these issues in a four-page draft. Almost none of this survived the cull into a single-page order.

Here are some of the specifics that failed to make their way into the final order.

331.05 Officer Responsibilities

Upon discovery that a bystander is observing, photographing, or video/audio recording the conduct of police activity:

DO NOT impede or prevent the bystander's ability to continue doing so based solely on the discovery of his/her presence. (including, but not limited to, deliberately shining a flashlight into the camera lens to prevent recording)

DO NOT seize or otherwise demand to take possession of any camera or video/audio recording device the bystander may possess based solely on the discovery of his/her presence.

DO NOT demand to review, manipulate, or erase any images or video/audio recordings captured by the bystander based solely on the discovery of his/her presence.

Additional stipulations that were ultimately discarded include the reminder that no recording citizen is required to produce "press credentials" or otherwise justify their presence at a scene. It also instructs officers that their attention should be focused on the situation that demanded a police response, not the onlookers and their recording devices. And it tells officers that any seized recording equipment must be given up voluntarily by the person recording or obtained with a warrant. Exigent circumstances may result in temporary seizures, but only for the length of time needed to obtain a copy of the recordings.

All of this has been swept away and replaced with a truncated order that basically says the same thing, but doesn't specifically forbid the sort of behavior often observed when officers discover a camera rolling at the scene. And if it's not specifically forbidden, it's generally taken to mean that this behavior is still acceptable until proven otherwise.

In the context of this order -- which is really a reminder that officers should allow citizens to make use of their previously-existing rights -- the lack of details leaves the door open for abuse.

Permalink | Comments | Email This Story

Throwback Thursday: Eat'n Park Still Suing Over Smiley Face Cookies After All This Time

The more things change, the more they stay the same, as the saying goes. Over half a decade ago, Techdirt covered a bakery out of Pennsylvania that used trademark laws to keep another bakery from putting smiley-faces on its cookies. Frankly, it's one of those stories we cover where the immediate question of how trademarks could be twisted into this nonsense is immediately followed by the assumption that the whole thing will soon go away, never to be repeated again.

Not so much in this case, as it turns out. Eat'n Park recently once again brought a federal trademark suit against another company for daring to put the universal symbol for happiness on a cookie.

Eat'n Park this week sued a Chicago company in federal court over its use of a cookie that the Pittsburgh restaurant chain says is too similar to its trademarked Smiley face cookie. The suit filed Tuesday said Chicago American Sweet & Snacks sells cookies called "Smiley's" that Eat'n Park says are a lot like its product. Eat'n Park has sold its Smiley cookies since 1985 and has filed numerous trademark infringement suits against various companies over the years to protect the design.

It should be noted that the dispute also seems to be about the two company logos for their respective smiley-face cookie brands, not just about the baked goods. Here are the logos for both.

Now, let's leave aside for a moment the fact that the two logos don't look anything alike and are about as likely to be confused with one another as my manly physique is likely to be confused with a professional bodybuilder's. Instead, I'd like to propose that there should be a provision in trademark law that goes something like this: if your distinctive logo is so generic that tons of your competitors keep accidentally coming upon the same base design as yours, nobody gets to trademark it. Think of it as something like an independent invention test for patents. We can call it the Geigner rule, because vanity is my trademark, jerks.

“In this particular case, the “Smiley’s Cookies” logo name and design used by the company infringes on our brand trademark,“ said spokesman Kevin O’Connell.

If it was audible, Mr. O'Connell would be hearing the sound of my eyes rolling. Nobody is associating a smiley-face cookie with any particular brand, because the very idea seems like the kind of thing that everyone came up with when making cookies in their home kitchens. Maybe it's time someone do a cookie with an "R" encircled by the treat, huh?

Permalink | Comments | Email This Story