Friday, January 8, 2010
News: Aiport Security Technology
Forbes has posted an interesting article today discussing various proposals for improving airport security, including behavioral analysis systems, physiological sensors, and increased use of profiling. One system being tested in Israel even sounds like psychological warfare—flashing images onto airport screens, “such as symbols associated with a certain terrorist group or some other image only a would-be terrorist would recognize” and then assessing individuals’ reactions to those images. The article also cites Jim Harper of the Cato Institute for suggesting that security be placed in the hands of the airlines in order to introduce more variation in security procedures.
Thursday, January 7, 2010
Comment: Christmas Day Plot, Part I (Update)
The Telegraph has published a story today claiming that US Customs and Border Protection had singled out Umar Farouk Abdulmutallab based on the human intelligence submitted by the State Department and were waiting to bring him in for interrogation in Detroit. This claim seems to take some steam out of the argument that US intelligence failed to “connect the dots.” This raises the question whether, under the circumstances, some other operative action should have been taken while the flight was in the air. Given what was known, would it have been appropriate to order the flight to turn back around to Amsterdam? Suppose Abdulmutallab caught on to what was happening and decided to detonate over Amsterdam upon the return. Would it have been appropriate to order the flight crew to restrain him? Think of the standards that would apply if the “suspect” were simply someone standing on a public street. Should different standards apply on airplanes?
The article also features an interesting quote from a “senior Homeland Security official” who indicated that “in-depth vetting only begins once the flight manifest has been generated, a few hours before takeoff.” This statement suggests that passenger name records are not submitted on a rolling basis as reservations are made but only once the list of passengers on any one flight has been relatively solidified.
The article also features an interesting quote from a “senior Homeland Security official” who indicated that “in-depth vetting only begins once the flight manifest has been generated, a few hours before takeoff.” This statement suggests that passenger name records are not submitted on a rolling basis as reservations are made but only once the list of passengers on any one flight has been relatively solidified.
Wednesday, January 6, 2010
Comment: Christmas Day Plot, Part I
“Failure to connect the dots” became a catch-phrase paraphrasing the mistakes within the intelligence community that permitted the 9/11 attacks despite the presence of intelligence within the possession of various US agencies that pointed toward the development of the underlying plot. This phrase has cropped up again in connection with the Christmas Day plot involving Northwestern Flight 253, leading to the question as to whether the lessons learned from the 9/11 review have been implemented.
As news of the attempted attack began to unfold, reports began to roll in that the individual behind the attempt, Umar Farouk Abdulmutallab, had raised a number of red flags which should have resulted in enhanced screening, potentially his detention for further investigation, or--as some have suggested--the denial of an entry visa for the US. First it was revealed that Abdulmutallab had been included in the National Counterterrorism Center’s TIDE (Terrorist Identitites Datamart Environment) database (more on TIDE in Part II) (See this story from CBS). Then, it came to light that Abdulmutallab’s father had approached US State Department officials in Nigeria with concerns that his son had “fallen under the influence of ‘religious extremists’ in Yemen” (See this story from CBS). According to a report from CBS News, this information was forwarded to officials in Washington (In fact, it may have been the basis for Abdulmutallab being entered in TIDE). Apparently, however, no flags were attached to Abdulmutallab’s US visa, and the CBS report suggests that US officials who had received information relating the father’s concerns did not realize that the individual in question had been issued a multiple-entry visa by the US Embassy in London that was valid from June 16, 2008 to June 12, 2010. Lastly, it has been reported that the NSA had identified communications among Al Qaeda members in Yemen concerning a plot involving a Nigerian (See articles here and here).
The Obama administration called for two reviews: one quick review of flight screening procedures and technologies, the other a more in-depth review of the terrorist watch list system in use in the US. President Obama has promised that the results of the reviews will be revealed in public reports in the near future. It will be interesting to see to what extent the details of what happened at each stage of Abdulmutallab’s journey will be released. For me, the following questions come up: 1) Were any personal data pertaining to Abdulmutallab submitted to the TSA before he boarded the flight from Nigeria? 2) What security procedures did Abdulmutallab undergo in Lagos (or Ghana)? 3) Was Abdulmutallab subjected to security procedures at Schiphol? It would be particularly interesting to know whether he underwent a full-body scan (such scanners are evidently in common use at Schiphol) (more on full-body scanning below)?
In this case, it isn’t clear to what extent fault can be found with US authorities. Clearly mistakes were made, but even if all the information on Abdulmutallab had come together and resulted in an operational decision, measures stemming from that decision would have to have been taken in Nigeria or the Netherlands in order to have been effective. The incident may primarily reflect the lack of uniform and coordinated procedures at the international level. The US has expressed the desire to receive passenger name records for all passengers who have booked flights to the US. Yet, the question arises as to how many airlines indulge that desire and with what level of accuracy. This requirement has been particularly contentious within the EU. However, given the fact that Abdulmutallab had booked passage with a US-based air carrier for the final leg of his journey, it seems likely that the US carrier submitted passenger record data on Abdulmutallab to the TSA. But again, even if the TSA had singled out Abdulmutallab for enhanced screening or identified him as being on the no-fly list, how does it ensure that Dutch or Nigerian airport security take appropriate action? If a Dutch or Nigerian equivalent of the TSA have special requests with respect to a particular passenger departing from the US en route to the Netherlands or Nigeria, would the TSA automatically comply in reciprocal fashion? Note that according to an editorial in the New York Times, the TSA can still request a US-bound flight to return to its point of departure if there is a suspicious passenger on board, but for long distance flights, this option may become unfeasible if the request is not received until later stages of the flight.
Suggestions for changes already began to be voiced soon after the incident. Among the calls for improvements to security that have emerged in public discourse, the notion of making more use of body scanners, such as millimeter wave scanners, has been particularly prominent--notably former US Department of Homeland Security Secretary, Michael Chertoff, has been among those advocating this move (see here) (although it later came to light that Chertoff’s company, the Chertoff Group, has a manufacturer of such machines as a client). Some commentators, however, have argued that such full-body scanners would have failed to detect the explosive device in this case. The Telegraph has cited two former US officials from counter-terrorism agencies for having long argued that swabbing for explosive substances and other chemicals is “cheaper, easier and more effective” than full-body scanners. In that article, Larry Johnson, former deputy director of Counter Terrorism at the US State Department was quoted as saying “[s]wabbing everyone is not hard and it’s just about the only way, short of making passengers fly naked and without luggage, of being reasonably sure they aren’t carrying a bomb.” Although swabbing would entail making bodily contact with the swabs, for some--if not most--it may raise fewer privacy concerns than the full-body scanners. The Telegraph article suggests that the swab tests would not need to be taken from the same part of the body or baggage where explosives were located. That means that contact with sensitive areas of the body could be avoided.
In Part II, I’ll discuss databases and watch lists.
As news of the attempted attack began to unfold, reports began to roll in that the individual behind the attempt, Umar Farouk Abdulmutallab, had raised a number of red flags which should have resulted in enhanced screening, potentially his detention for further investigation, or--as some have suggested--the denial of an entry visa for the US. First it was revealed that Abdulmutallab had been included in the National Counterterrorism Center’s TIDE (Terrorist Identitites Datamart Environment) database (more on TIDE in Part II) (See this story from CBS). Then, it came to light that Abdulmutallab’s father had approached US State Department officials in Nigeria with concerns that his son had “fallen under the influence of ‘religious extremists’ in Yemen” (See this story from CBS). According to a report from CBS News, this information was forwarded to officials in Washington (In fact, it may have been the basis for Abdulmutallab being entered in TIDE). Apparently, however, no flags were attached to Abdulmutallab’s US visa, and the CBS report suggests that US officials who had received information relating the father’s concerns did not realize that the individual in question had been issued a multiple-entry visa by the US Embassy in London that was valid from June 16, 2008 to June 12, 2010. Lastly, it has been reported that the NSA had identified communications among Al Qaeda members in Yemen concerning a plot involving a Nigerian (See articles here and here).
The Obama administration called for two reviews: one quick review of flight screening procedures and technologies, the other a more in-depth review of the terrorist watch list system in use in the US. President Obama has promised that the results of the reviews will be revealed in public reports in the near future. It will be interesting to see to what extent the details of what happened at each stage of Abdulmutallab’s journey will be released. For me, the following questions come up: 1) Were any personal data pertaining to Abdulmutallab submitted to the TSA before he boarded the flight from Nigeria? 2) What security procedures did Abdulmutallab undergo in Lagos (or Ghana)? 3) Was Abdulmutallab subjected to security procedures at Schiphol? It would be particularly interesting to know whether he underwent a full-body scan (such scanners are evidently in common use at Schiphol) (more on full-body scanning below)?
In this case, it isn’t clear to what extent fault can be found with US authorities. Clearly mistakes were made, but even if all the information on Abdulmutallab had come together and resulted in an operational decision, measures stemming from that decision would have to have been taken in Nigeria or the Netherlands in order to have been effective. The incident may primarily reflect the lack of uniform and coordinated procedures at the international level. The US has expressed the desire to receive passenger name records for all passengers who have booked flights to the US. Yet, the question arises as to how many airlines indulge that desire and with what level of accuracy. This requirement has been particularly contentious within the EU. However, given the fact that Abdulmutallab had booked passage with a US-based air carrier for the final leg of his journey, it seems likely that the US carrier submitted passenger record data on Abdulmutallab to the TSA. But again, even if the TSA had singled out Abdulmutallab for enhanced screening or identified him as being on the no-fly list, how does it ensure that Dutch or Nigerian airport security take appropriate action? If a Dutch or Nigerian equivalent of the TSA have special requests with respect to a particular passenger departing from the US en route to the Netherlands or Nigeria, would the TSA automatically comply in reciprocal fashion? Note that according to an editorial in the New York Times, the TSA can still request a US-bound flight to return to its point of departure if there is a suspicious passenger on board, but for long distance flights, this option may become unfeasible if the request is not received until later stages of the flight.
Suggestions for changes already began to be voiced soon after the incident. Among the calls for improvements to security that have emerged in public discourse, the notion of making more use of body scanners, such as millimeter wave scanners, has been particularly prominent--notably former US Department of Homeland Security Secretary, Michael Chertoff, has been among those advocating this move (see here) (although it later came to light that Chertoff’s company, the Chertoff Group, has a manufacturer of such machines as a client). Some commentators, however, have argued that such full-body scanners would have failed to detect the explosive device in this case. The Telegraph has cited two former US officials from counter-terrorism agencies for having long argued that swabbing for explosive substances and other chemicals is “cheaper, easier and more effective” than full-body scanners. In that article, Larry Johnson, former deputy director of Counter Terrorism at the US State Department was quoted as saying “[s]wabbing everyone is not hard and it’s just about the only way, short of making passengers fly naked and without luggage, of being reasonably sure they aren’t carrying a bomb.” Although swabbing would entail making bodily contact with the swabs, for some--if not most--it may raise fewer privacy concerns than the full-body scanners. The Telegraph article suggests that the swab tests would not need to be taken from the same part of the body or baggage where explosives were located. That means that contact with sensitive areas of the body could be avoided.
In Part II, I’ll discuss databases and watch lists.
Wednesday, December 2, 2009
Data collection and retention policies of social networking sites
The Electronic Frontier Foundation (EFF), working with the Samuelson Law, Technology, and Public Policy Clinic at the University of California, Berkeley, School of Law (Samuelson Clinic), filed suit today against a half-dozen US government agencies for refusing to disclose their policies for using social networking sites for investigations, data-collection, and surveillance.
Recent news reports have publicized the government's use of social networking data as evidence in various investigations, and Congress is currently considering several pieces of legislation that may increase protections for consumers who use social-networking websites and other online tools. In response, the Samuelson Clinic made over a dozen Freedom of Information Act (FOIA) requests on behalf of EFF to the Central Intelligence Agency, the Department of Justice, the Department of Homeland Security, and other agencies, asking for information about how the government collects and uses this sensitive information.When several agencies did not respond to the FOIA requests, the Samuelson Clinic filed suit on behalf of EFF. The lawsuit demands immediate processing and release of all records concerning policies for the use of social networking sites in government investigations.
Interesting related reads:
* Myspace Law Enforcement Guide.
* Old Facebook Subpoena/Search Warrant Guidance. Less detailed than myspace.
Types of information available
Recent news reports have publicized the government's use of social networking data as evidence in various investigations, and Congress is currently considering several pieces of legislation that may increase protections for consumers who use social-networking websites and other online tools. In response, the Samuelson Clinic made over a dozen Freedom of Information Act (FOIA) requests on behalf of EFF to the Central Intelligence Agency, the Department of Justice, the Department of Homeland Security, and other agencies, asking for information about how the government collects and uses this sensitive information.When several agencies did not respond to the FOIA requests, the Samuelson Clinic filed suit on behalf of EFF. The lawsuit demands immediate processing and release of all records concerning policies for the use of social networking sites in government investigations.
Interesting related reads:
* Myspace Law Enforcement Guide.
Because MySpace functions as both an “electronic communications” and “remote computing” service as defined under ECPA (Electronic Communications Privacy Act, 18 U.S.C. § 2701), ECPA mandates that MySpace disclose certain user information only in response to specific types of government process, including subpoenas, court orders, and search warrants.Generally speaking, ECPA permits the disclosure of basic user identity, log-in information, and stored files (photos, videos, blogs) in response to a subpoena, but requires a court order under § 2703(d) to disclose additional user records, or search warrant to authorize disclosure of private user messages. The rules may differ also depending on whether law enforcement seeks stored, historical information, or to capture information prospectively. For example, if law enforcement seeks ongoing information about a user’s IP address each time they log-in to their account, the law would require a pen register/trap and trace order.
MySpace permits users to exchange private mail messages with other MySpace members. These communications are sent from and held for users on MySpace servers. ECPA generally restricts disclosure of private user communications less than 180 days old except in response to a search warrant. 18 U.S.C. § 2703(a).
Under 18 U.S.C. §§ 2702(b)(8) and 2702(c)(4), MySpace is permitted to disclose information, including user identity, log-in, private messages and other information voluntarily to a federal, state, or local governmental entity when MySpace believes in good faith that an emergency involving danger of death or serious physical injury to any person requires such disclosure without delay.
Data retention
The basic identity information entered by a user in creating a profile, as well as data (blog entries, user profile information, etc.) and images contained in an account are maintained as long as the user has not removed or edited the content from the profile. Once a change is made by the user, the previously existing information is overwritten.
Private inbox messages -- Private messages are retained until the user removes them (MySpace cannot recover deleted messages).
Private sent messages -- 14 days
User identity and date in the user profile is generally available for up to ten days after account deletion. Other stored files, such as photos, may be lost at the time of account deletion.
No mail (inbox or sent mail) is available for deleted accounts.
MySpace will honor requests by law enforcement to preserve information in accordance with 18 U.S.C. § 2703(f). In response to such requests, MySpace will preserve the specific information identified in the request for 90 days, and for an additional 90 days if the law enforcement entity requests the original period be extended.
* Old Facebook Subpoena/Search Warrant Guidance. Less detailed than myspace.
Types of information available
The User Neoprint, which includes
• Profile Contact Information
• Mini-Feed
• Status Update History
• Shares
• Notes
• Gifts, Public and Private
• Wall Postings
• Messages
• Friend Listing, with Friends Facebook ID’s
• Groups Listing, with Facebook Group ID’s
All user contact information input by the user and not subsequently deleted by the user is available, regardless of whether it is visible in their profile. This information may include the following:
Name
Birthdate
Contact email addresses
Address
City
State
Zip
Phone
Cell
Work phone
Screen name (Usually for AOL Messenger / iChat)
Website
If a profile is changed or updated, deleted content is not retained, and cannot be produced. Any messages or wall postings deleted by the user are not retained and cannot be produced.
Where a group is known, we will provide a list of users currently registered in a group.
Tuesday, December 1, 2009
News: US SWIFT Access Granted
From the Lift: The EU has agreed a nine month interim deal to allow the US non reciprocal access to SWIFT banking data. Germany and Austria, reported as threatening a veto over the privacy implications of such a deal, abstained. A unanimous vote was required, not counting abstentions as votes against. The agreement can be annulled in the Spring, when the European Parliament will have to give their assent to the plan.
The Register quotes an EU official as saying that "The truth is that we in Europe don’t have the technical ability to interpret this stuff," and that this is the reason why "We rely on the Americans to process it and pass it on as intelligence." Many European intelligence agencies end up as beneficiaries in the arrangement as they are not permitted by their home countries to gather such information themselves. In the event, delegates were apparantly put under huge pressure from US representatives to pass the deal:
The Register quotes an EU official as saying that "The truth is that we in Europe don’t have the technical ability to interpret this stuff," and that this is the reason why "We rely on the Americans to process it and pass it on as intelligence." Many European intelligence agencies end up as beneficiaries in the arrangement as they are not permitted by their home countries to gather such information themselves. In the event, delegates were apparantly put under huge pressure from US representatives to pass the deal:
The pressure from the Americans was "massive," say diplomats in Brussels. U.S. Secretary of State Hillary Clinton apparently told her European counterparts that the fate of the West hung in the balance. And in the capital cities of Europe, American ambassadors stormed governments like door-to-door salespeople. As one EU foreign minister put it, "they pulled out all the moral and political stops."
Subscribe to:
Posts (Atom)
