Irreal

Bruce Schneier has an excellent article in The Atlantic entitled The NSA Is Commandeering the Internet. This is a great read and I urge you to take a look if you haven’t already.

The title is a little misleading, however. The article is really a strongly worded exhortation for tech firms to start fighting for their users. If they don’t, Schneier says, they will lose those users. Schneier tells them not to depend on the NSA protecting them, “The NSA doesn’t care about you or your customers, and will burn you the moment it’s convenient to do so.” As evidence for that he points to Google, Yahoo, Microsoft, and others who are already seeing customers fleeing and who are pleading with the government to let them explain what they’ve been required to do and what information they’ve turned over but the government has refused. They don’t care about you or your problems Schneier tells them.

He tells other tech companies that haven’t yet been outed (or approached by the government) that the NSA will tell them that their participation will remain forever secret but their names will inevitably find their way onto internal documents that Snowden or some future leaker will make public.

The only alternative to fighting the government when it comes calling with its secret warrants is to break faith with your users. Do that, and when those users find out they will never trust you again and will start looking for someone else to do business with.

Again, this is a great article. Read it.

Update: say → says

The Internet is ablaze with reports of a Google lawsuit filing claiming that Gmail users have no expectation of privacy. After all the pixels I’ve spilled lately bloviating about privacy and the misdeeds of large Internet companies, including Google, you’d think that I’d be outraged by this. But actually, my reaction was, “Well duh!”

The folks suing are upset that Google scans their emails to remove malware and, more importantly, to target them with advertisements they may be interested in. Of course. What did they think was happening? It’s not as though Google kept it a secret. In fact, all those Gmail users whining about the scanning of their email specifically consented to it. I know, I know: who reads those click through agreements? But really, how else is Google going to make money to run what is, after all, a large and expensive service? It’s well known that Google’s main business model is targeted advertising and no reasonable person could believe that Gmail was any different.

Those complaining would do well to remember this useful bit of advice about Internet services: If you aren’t paying for the product, you are the product. When you sign up for Gmail you make a bargain with Google: in exchange for a free—and, really, pretty good—email service, Google gets to scan your emails looking for keywords so they can target you with effective advertisements.

Google has plenty of things to answer for; this nonsense isn’t one of them.

Actually, there is no lighter side to what the NSA is doing. One thing that every politician knows is that they’re in trouble when the late night comics start making them the butt of their jokes. That’s already happening with the NSA scandal but there’s something else: the daily comic strips are mocking the government over the NSA scandal as well.

Here are two examples:

• Dilbert
  • {2013-08-13 Tue}
  • {2013-08-14 Wed}
• Sherman’s Lagoon
  • {2013-08-13 Tue}
  • {2013-08-14 Wed}

Doubtless there are other examples. If you have a favorite, leave a comment.

It’s my hope that all this mockery represents a tipping point in the sense that the issue has burst upon the general public’s awareness and is no longer the concern of just geeks, news junkies, and politicos. If that is indeed the case, it will be harder for Congress to pretend that everything is fine and that there’s no need for reform. On the other hand, no one ever lost money underestimating the common sense of politicians.

There is so much to love in this announcement. Kim Dotcom’s Mega.co.nz is going to offer secure, encrypted email and house the server out of the reach of the illegal snooping of the NSA. Not content to make the US DOJ look like the Keystone Kops after their trying unsuccessfully, and probably illegally, to extradite him and destroy his business, Dotcom is once against sticking his finger in the US government’s eye by working to replace the Lavabit and Silent Circle secure email services with one of his own.

Really, I don’t know what the government was thinking. By again overstepping, and in a climate which already sees a majority of Americans worried about their activities, the FBI/NSA provoked the two services to shutdown. This guaranteed two things:

1. Someone would open a new service outside of US jurisdiction.
2. Many Americans (and others) who haven’t previously used a secure email service will sign up.

Add to that the likelyhood that an already skittish Congress will be more inclined to bow to popular pressure and significantly rein them in and it’s pretty easy to conclude that they haven’t done themselves any favors.

Like everyone else, I don’t want some wackjob blowing me up but the Fourth Amendment is the law of the land and there’s no wackjob exception in it. I get tired of hearing about “balancing security and privacy.” The Fourth Amendment says what it says: you want to go snooping, show probable cause and get an individualized search warrant. No short cuts allowed no matter how much easier it makes the intelligence agencies’ jobs.

Update: Secure Circle → Silent Circle

Forbes has a bit more information on the closing of Lavabit. They provide additional clues that Ladar Levison of Lavabit was indeed asked to monitor users’ logins in order to capture their keys.

Among other things, we learn that Levison has complied with “two dozen” individual warrants in the 10 years that he has run Lavabit. He says explicitly that the reason he shut down Lavabit was not because of a request for a single user’s data but to protect all his users. That’s a bit ambiguous, I suppose, but a fair interpretation is that the government wanted him to do something that could potentially affect more than a single targeted user.

I’ll leave you with this quote from Levison explaining why he is stepping away from email:

If you knew what I know about email, you might not use it either.

Those of you who who follow Irreal daily know that I recently migrated the email that was going to my Gmail account to Lavabit. All of that mail was from technical mailing lists so it didn’t really matter much except as a statement of principle. Now Ladar Levison, the owner and operator of Lavabit, shows us what principle is really about.

Levison announced Thursday that for reasons he is legally barred from disclosing he is shutting down Lavabit. He says that it was a hard decision to walk away from 10 years work but that he could not be complicit in crimes against the American people. In as much as Lavabit has previously complied with specific warrants issued with reasonable probable cause, it seems a safe inference that he was being asked to provide a more wide-ranging access to users’ accounts.

Because of the way Lavabit works, this would mean either monitoring users’ logins to capture their passwords or making copies of emails before they were encrypted. Either of these would break faith with Lavabit’s users so Levison apparently felt he had no choice but to close his business. A business, let me say again, that he spent 10 years building.

Friday brought the news that Silent Circle was closing its email service as well. Silent Circle says that they weren’t approached by the government but that in light of Lavabit’s experience they felt it was likely and rather than put their users at risk they preemptively closed the service and destroyed the server it ran on.

Years of hard work and doubtlessly many jobs were lost with the two closings. All this so that no Americans could keep their emails private. Google, Microsoft, Apple, and the others who have willingly collaborated with this illegal government spying may not care but they should. The Technology and Innovation Foundation reported this week that US cloud computing companies could lose between $21 billion and $35 billion because of their ties to the NSA. As Edward Snowden remarked about the Lavabit closing,

The President, Congress, and the Courts have forgotten that the costs
of bad policy are always borne by ordinary citizens, and it is our job
to remind them that there are limits to what we will pay.

Perhaps it’s time for one of the big boys to take a lesson on integrity from Lavabit. Imagine what would happen, for example, if Google threatened to shut down Gmail.

Update: Those who you → Those of you who

Personally, I think the only thing to do is to go back to the original
sense of the Fourth Amendment and say, no warrantless wiretapping, no
general warrants, no surveillance without specific probable cause, no
exceptions, ever. There shouldn’t even be something like FISA to allow
exceptions for special cases.

Commenter Petréa Mitchell in response to the excellent post by Bruce Schneier on how to restore trust in government after the NSA revelations.