Wyrok Trybunału Konstytucyjnego w sprawie dostępu do bilingów telefonicznych – radykalny krok w stronę prywatności.
W końcu zapadł wyrok w zainicjowanej przez Rzecznika Praw Obywatelskich i Prokuratora Generalnego sprawie dotyczącej zgodności z konstytucją oraz konwencją o ochronie praw człowieka i podstawowych wolności przepisów dotyczących uprawnień policji, agencji bezpieczeństwa wewnętrznego i szeregu innych służb. Wnioskodawcy wnosili o zbadanie konstytucyjności szeregu zapisów – związanych z kontrolą operacyjną, katalogiem przestępstw powiązanych z możliwością prowadzenia określonych czynności oraz przetwarzaniem, niszczeniem i udostępnianiem danych telekomunikacyjnych. Najciekawsze jest oczywiście ostatnia grupa, gdyż to właśnie w niej Trybunał dokonał najpoważniejszych korekt. Czego więc dotyczyły owe przepisy?
Osią sprawy jest artykuł 20c ust. 1 ustawy o Policji oraz analogiczne przepisy w ustawach dotyczących ABW, CBA, Straży Granicznej, Kontroli Skarbowej, Żandarmerii Wojskowej i Służb Wywiadu i Kontrwywiadu Wojskowego. Umożliwił on funkcjonariuszom żądania od operatorów telekomunikacyjnych informacji dotyczących użytkownika końcowego inicjującego i odbierającego połączenie, a także danych z tym związanych czyli czasu, daty, rodzaju i lokalizacji użytkownika – mniej więcej tego co funkcjonuje powszechnie jako ‘billing telefoniczny’. Co więcej operatorzy byli zobowiązani do świadczenia takiej usługi na własny koszt oraz do ‘zapewniania warunków’ do udostępniania tychże danych – co w praktyce oznaczało niemal nieograniczony dostęp służb.
Nie dowiemy się jak jak atakować Tora :( – kontrowersyjna prezentacja zapowiadana na BlackHat 2014 odwołana
Prezentacja dwóch badaczy z uniwersytetu Carnagie-Mellon o sensacyjnym tytule ‘Nie musisz być NSA aby złamać Tora’ już od pierwszych zapowiedzi budziła wiele kontrowersji. Tweet Runy Sandvik który początkowo wydał się być jedynie głosem rozczarowania związanym z brakiem współpracy i wymiany informacji pomiędzy naukowcami, a ekipą Tora okazał się jednak być niemal proroczy gdyż prezentacja została usunięta z grafiku konferencji. Ze zdawkowych na razie informacji wynika, że w sprawę musieli zaangażować się prawnicy uniwersytetu, którzy jak się wydaje zabronili komukolwiek mówienia czegokolwiek. Jedyne co jest pewne to, że prawnicy poinformowali organizatorów BlackHat o braku zgody placówki badawczej na wygłoszenie referatu. Biorąc pod uwagę, że badacze korzystali z zasobów uniwersytetu i prowadzili badania w ramach pracy naukowej uniwersytet może skutecznie zablokować upublicznienie efektów prac.
Jakie mogą być jednak przyczyny takiego obrotu spraw? Tor project zapewnia, że nie wnosili o wyłączenie prezentacji z planu konferencji – apelując jednocześnie o etyczne i odpowiedzialne prowadzenie badań związanych z siecią. Jak na razie najbardziej prawdopodobna wydaję się teoria, iż badacze – zapewne nieumyślnie – popełnili przestępstwo. Jeżeli prowadzili nasłuch sieci bez uzyskania zgody użytkowników (co jest niemal pewne) naruszyli Wiretap Act który zabrania nieuprawnionego przechwytywania komunikacji elektronicznej. Tłumaczyło by to również zdawkowe wyjaśnienia i brak komentarzy ze strony uniwersytetu, którego prawnicy dobrze wiedzą o potencjalnym ryzyko związanym z komentowaniem jakichkolwiek aspektów potencjalnego postępowania karnego. Oczywiście testowanie de facto ataku na sieć komputerową na rzeczywistych użytkownikach, a nie w warunkach laboratoryjnych, zakrawa co najmniej na lekkomyślność. Szczególnie dziwi to w obliczu doświadczenia obu badaczy – trudno uwierzyć, że równie chętnie testowali by np.: exploit umożliwiający zdalny dostęp. Być może odkrycie było tak ekscytujące, że twórcy zapomnieli skonsultować swoich działań z przepisami prawa.
Tak czy inaczej mam nadzieję, że prędzej czy później wyniki przeprowadzonych badań zostaną ujawnione. Wnioskują z opisu dostarczonego przez badaczy, który zakładał użycie łączy o wysokiej przepustowości i długi czas (kilka miesięcy) konieczny do skutecznego ataku. Niektórzy podejrzewają, że atak miał polegać na ustanowieniu kontrolowanych węzłów sieci. Duży transfer sprawiłby, że węzły te byłyby wybierane przez klientów podłączających się do sieci jak ‘entry guards’ które mają zapobiegać ujawnianiu użytkowników. Teoretycznie wybierane są one losowe i tylko one wybierane są jako pierwszy węzeł połączenia. Kontrolując zarówno entry guard jak i węzeł wyjściowy identyfikacja użytkowników byłaby już jak najbardziej możliwa.
To jak szybko rozwiązana zostanie zagadka prezentacji zależy w dużym stopniu od tego czy faktycznie doszło do popełnienia przestępstwa i czy władze USA zdecydują się na wszczęcie postępowania. Jeżeli prawnicy uniwersytetu uznają, że jest realna szansa na rozwiązanie sprawy w sądzie to komentarze będą ograniczone do minimum. Być może jednak udostępnione Tor project fragmenty prezentacji poskutkują oświadczeniem na temat faktycznej skuteczności ataku.
Google Spain v AEPD and Gonzáles and retention directive – European Court of Justice v Information Age
At first glance recent ruling by European Court of Justice in Google Spain v AEPD and Mario Costeja González was nothing but victory of privacy rights. Restriction in Google’s seemingly unlimited power in revealing or obscuring content related to personal data might be seen as a significant step towards transferring control over personal information back to those who are most interested in their flow. On the other hand isn’t it a form of censorship and ‘re-writing history’? As always with intersection of law and new technologies question remains whether there are technical means to implement the ruling – while everyone is aware that Google is able to control the search results content (eg SafeSearch) it appears that removing specific information about specific person is much more challenging – to begin with how many ‘Gonzalezes’ are there in Spain. Google v Gonzales is not first judgement of the year related to privacy and personal data. In April ECJ ruled that retention directive is invalid due to interference with fundamental rights – which from legal standpoint is even more interesting since at the time directive came into force, fundamental rights were not codified within European Union. However let’s begin with Google Spain v Gonzales.
Nowadays it is hard to find a place with less than 3 WiFi networks in range of our network card. Even though most of the access points are already protected by WPA, occasionally some are either not secured at all, or are secured by WEP (basically they are not secured either). When visiting a new place, or using laptop beyond reach of our internet access it is especially tempting to ‘perform penetration testing’ of such networks and eg check email. While most of these incidents will go unnoticed by owner of the access point and does little harm – which means that there is no enough reason to involve law enforcement resources and criminal prosecution – sometimes it turns into outright stealing of bandwidth and ‘free’ source of internet. Unfortunately it is hard to define what exactly constitutes of unauthorised access as well as proving guilt of perpetrator.
Most jurisdictions, as well as convention on cybercrime, includes crime of unauthorised access to computer network. Using often included very broad definitions, which commonly states that computer network is group of interconnected devices which perform automated data processing it is easy to say that accessing someone’s WiFi falls under this definition. The problem that arises is that most of the time stealing wireless connection is completely different felony that ‘unauthorised access to computer network’. It rarely includes breaking into other machines connected to hotspot and intercepting or altering data stored there – the very core of ‘hacking’. As a result either sanctions defined in statues have to be very broad to include all possible situations on the spectrum, or adequately high punishment could be applied to rather petty crime. Much more problems in this case however rises the very definition of unauthorised.
There are few topics as controversial and unambiguous at the same time as child pornography. While everyone agrees that sexual exploitation of children is heinous crime and lot of resources has to be concentrated on ending it, questions of what exactly constitutes of child pornography, how to fight to what extend it should be prohibited (production? possession or just gaining access?) remains unanswered. Furthermore due to sensitivity of subject it often causes knee jerk reaction and stream of emotional, rather than rational, arguments which is visible especially in public legislation debates. After all who would ever oppose laws that enables law enforcement to fight child pornography more efficiently, even if civil liberties are left behind in the process. However, even putting aside this aspect, laws often goes to far within their own frameworks or lack coordination between various bills that tries to grasp their straws. That was the case with convention on cybercrime as well as number of national laws.
Convention on cybercrime, signed in 2001 and effective for 10 years now, contains title on child pornography, defined as ‘content related offence’. Furthermore legislators went as far as providing definition of what is child pornography, definition which is rather strict as it includes “a person appearing to be a minor engaged in sexually explicit conduct” and “realistic images representing a minor engaged in sexually explicit conduct”. While reasoning behind such wording is not hard to explain – often it is hard to judge if person is really minor, the implications are quite serious. First of all, it is possible to prosecute someone for producing computer images of child pornography, which might be morally questionable but certainly no children are harmed in the process. Problem becomes even more complex given that many jurisdictions omits ‘realistic’ part in their statues. Case in Sweden, which reached Supreme Court, concerned manga translator who was fined for downloading drawings presenting minors in sexual context. As the case made its way through appeal process, important aspect was whether drawn figures could classified as a person. Prosecution argued that even specific characteristic which were common for manga characters (huge eyes, distinctive anatomy) did not change the overall qualification. While court of appeal upheld this line of reasoning, ultimately supreme court overruled the verdict, saying that drawings were not realistic enough to fall under legal definition. On the other in the US, man was given 15 moths in federal prison after pleading guilty to possession animated pornographic images of minors. While drawings were not manga characters there were not far off in terms of realism. As it is stated in plea agreement one of them depicted “Bart Simpson cartoon character (a minor) standing up and receiving oral sex from the Maggie Simpson cartoon character (a toddler) who is also nude“. Important to note that it is still plea agreement – not unlikely signed due to fear of harsher sentence. Similarly manga collection was ruled to be child pornography, after defendant entered plea bargain under advice of his lawyer. Attorney reasoned that due to obscenity of images he would be found guilty by jury (problem of entering plea bargains out of fear is a topic for another article). These examples from two sides of the Atlantic shows how important might be such distinction. The problem of stricter approach is obvious – people have gone to jail due to committing an act where no one was even remotely harmed. Furthermore it should be questioned what such statues aims to achieve. Is it in place to catch potential child abusers – which is a stretch and in many countries probably unconstitutional one, or perhaps even thoughts about intercourse with minors deserve punishment. However if the latter is the case, even leaving out thought crime aspect, why laws are limited to drawings? Would literary description be treated the same. Ultimately victimless crime aspect makes such provisions most disturbing, and it is hard not to think about slippery slope aspect.
Second, thinking about convention on cybercrime, essential is that in many cases law enforcement is solely responsible for discovering internet child pornography rings, way before public prosecution comes into action. In such scenario it is often up to computer forensic technicians to decided whether person depicted is minor or not. Also if person has to just ‘appear’ to be minor, what about professional pornography labelled as ‘schoolgirs’ and ‘teens’. Does fact that everybody really knows that porn stars are over 18, makes it exception to the law? Danger of this kind of approach is uncertainty of law and putting too wide interpretation margins in judiciary process. In case of criminal law, where convictions significantly burdens convicted it is unacceptable, especially that there are little advantages resulting from it. Finally the very inclusion of child pornography in cybercrime convention is questionable, and in my opinion is example of poor legislation. Catalogue of ‘cybercrimes’ could extended ad infinitum, by just adding ‘committed using computer’. While it could be argued that crime such as fraud significantly changed its structure and form by including computers, in case of distributing child pornography, other than scale of possible distribution, there is hardly difference between video tape, dvd, and hosting a hidden service. Bottom line is whether there is a point in adding another piece of legislation. If the aim of convention would be to harmonize legislation of different countries, than it has to be noted that there is already in place Convention on the Protection of Children against Sexual Exploitation and Sexual Abuse. Which does include its own articles on child pornography. Furthermore in case of convention on cybercrime, there is possibility of opting out of the ‘generated images’, ‘appearing as minor’, ‘possessing child pornography in a computer system or on a computer-data storage medium’ and ‘ procuring child pornography through a computer system for oneself or for another person’ parts which make it rather poor instrument of harmonization.
Unfortunately it seems that sensitive nature of the problem seriously hinders putting effective laws in place. Moral panic which leads to convicting people of possession manga certainly does not help with adequate distribution of law enforcement resources, always limited in case of computer crimes. Also it seems unlikely that significant changes will happen in near future, as once laws are in place there are few people who would try to soften them. The sad truth is that such process is counter productive to crime detection, something that we cannot afford in this case.
Recent report by Washington Post brings two equally strong feelings – one – kind of outrage diluted by number of earlier revelations about the scope of NSA surveillance program and – two – marvel that it is actually possible to store every phone call in the country (not metadata) and have the ability to rewind them whole month back and have effective search engine in place. Of course last part is somehow made up, one have to assume that there is actually some kind tool to browse such, for lack of better word, gianormous amount of data in order to bring any effectiveness to such infrastructure. However looking closer at the information, things get less sensationalistic, first of all which country are we talking about? The article lacks this crucial aspect – important to note – it is not US. It is needless to say that storing calls from Monaco, or Afghanistan (which might quite likely be the target) is much different that storing calls from France or Russia. Second while the premise looks impressive at first glance, the closer we look the things get more complex.
Unfortunately I had to significantly throttle down creating this blog recently – this is partially due to stacking up of ‘usual’ responsibilities, but also partially due to the fact that I’m involved in organization of law / IT conference – Net Attacks 2014 which happens at Nicolaus Copernicus University in Torun. It might be the only event in Poland that enables discussion between lawyers, netsec professionals and government agencies – be sure to check it out at http://www.atakisieciowe.umk.pl/. Beside taking part in organizing I’m also preparing lecture on law enforcement’s struggle with anonymity provide by Tor. Here I’d like to present sneak peak of my research combined with some thoughts that probably won’t make it to the final cut of the lecture / article.
It’s indisputable that Tor bundle changed fundamentally access to Internet anonymity. Ease of use and almost foolproof mechanism were the elements which guaranteed massive popularity, as well as made it perfect platform for some forms of criminal activity. Drug dealing and child pornography exchange are primary examples of such use. Level of protection delivered by Tor is more than enough to evade law enforcement and with minimal additional knowledge and care render conventional investigation techniques completely useless. In this circumstances LEA are basically left with three options: leveraging very design of Tor, utilize 0-day exploits on software of Tor bundle and basically hack the machines of criminals or use social engineering combined with leveraging carelessness of users to gain data sufficient to capture criminals. However, it is important to remember that law enforcement is bind by law which in many cases is far behind bleeding edge of technology. This situation is especially apparent in civil law countries where often every action taken by LEA have to be strictly detailed in law acts with very little room to adjust to changing situation. Of course it is equally important to keep in mind civil liberties and human rights aspect. Such detailed instruction makes all the operations very transparent and keep agents from abusing their power. On the other hand perhaps more relaxed in terms of legislation, but based on court warrants system allows better adaptation to specific cases.
Two greatest ‘weakness by design’ aspects of Tor are vulnerability to global passive adversary and lack of encryption of data leaving exit nodes. First still seems to remain in the realm of theory and it’s not likely it will become significant option for law enforcement. Even though experiments prove their effectiveness, resources required to pull such operation off and need for basically blanket approval to sniff on extremely large chunks of network make it impossible to use in any country with even elemental privacy safeguards. Second option (exit node eavesdropping) is definitely more interesting both in technical and legal terms. First of all it does work great! Experiment presented by Swedish researcher Dan Egerstad proved that setting up even small exit nodes in various locations can yield amazing results with captured emails from various embassies and government agencies. Furthermore Egerstad claimed that both some of these accounts were already compromised be people using similar technique and that some large exit nodes are just to conveniently placed in places like Washington D.C. and have to large bandwidth not to be set up by the government. And while up to this point everything sounds great it is still probably poor method for crime fighting. First of all blatant capture and analysis of all data that leaves certain node in on par with massive blanket surveillance that we are aware of now, after Snowden’s revelation. As such it should be discouraged, and if used will face the same problems with using it as evidence as NSA programs are facing now. Also let’s not omit the fact than exit node sniffing does not reveal IP addresses, only messages sent.
However, FBI took entirely different route when trying to break child pornography circles. After capturing creator of Freedom Hosting, and at the same time gaining control of its servers, agents injected malware on services hosted by FH. Malware wasn’t anything spectacular and required carelessness on the side of Tor user, but proved to be good enough for its job. At the same time though, it opens the discussion about limits of tools LEA can use. The exploit used was a 0 day for Firefox, using it meant basically exposing every other browser with the same configuration and same version to be attacked. On the other hand exploit was already outdated when released since latest release of Firefox was already patched against it. Since use of such technologies is relatively new it is not surprising that law is far behind. In Poland doing anything similar would be probably impossible to do, not even due to harsh restrains on LEAs but because there is nothing even remotely similar discussed in Polish legislation.
Finally there is a case of Dread Pirate Robers and whole series of events that lead to his identification. However if you would like to hear about that please join me at Net Attacks 2014 🙂
According to portal money.pl current value of 1 BTC is $622 with 8.2% drop. That is not surprising after recent Mt.Gox turmoil resulting in service being excluded from CoidDesk. Mt.Gox on the other hand recently announced that they discovered critical bug in BTC design, the “transaction malleability”, enabling deleting transaction information which might lead to resenting transaction. It was however not left without comment among community with claims that Mt.Gox explanation, to put it lightly, does not hold water. Today’s value is not unusually low, especially considering 50% fall when People’s Bank of China issued ban on merchants accepting Bitcoin and forbade banks and payment processors from converting Bitcoin into yuan.
Problem of volatility is constantly present since bitcoin gained significant value. What’s more important it is probably biggest thorn in paws of those who would like to see bts entering real retail and services payment. After all it is hardly comfortable to use currency which changes its value significantly on daily basis. Proponents suggests that it is just transition stage, with bts being still developed technological platform which will eventually mature into full blown currency. Opponents claim that it will be technological quirk with few option for utilizing currency, which stems from current problems, will ultimately lead to demise as the popularity will decline. The truth is that unfortunately bitcoin community does not contribute much to changing the volatile nature and lack of real uses for the currency. Let’s just take a look at reddit’s r/bitcoin – number of threads about real life applications and implementation is simply buried beneath discussions on gains from speculation. Such trend was especially visible after bts reached magical value of $1000, maybe even more visible was top link of the subreddit – phone number to suicide hotline – posted after price fall to $500. But perhaps even more disturbing is shortsightedness of supporters. Even commentators supporting bitcoin proliferation note that current state of the software is too clumsy, too unpolished to become real money instrument. Even if bts will reach such status it definitely won’t be in the current form.
Unfortunately, due to approaching finals lack of time is killing, so instead of full blown post, I’d like to present ‘bits of news’ that in my opinion are worth checking out:
Whistleblower Daniel Ellsber answers questions on reddit – this just came in as I started to write this post, and even though it’s not really an information piece it is a must for anyone interested in privacy / government transparency. For those of you how are unfamiliar wit Mr Ellsber – he was the man who in 1971 released so called ‘Pentagon Papers’ which revealed that US administration knew that Vietnam war is unwinnable yet did not informed public opinion about it and continued with military operations.
Mozilla asks user to audit code of Firefox in order to prevent surveillance – it is well known that open-source software is one of many requirements for users who would like to keep their privacy. Ability to check the code and prevent installation of backdoors is, as cooperations between NSA and various software and hardware producers became known, invaluable. Mozilla is quite known now for their privacy oriented business strategy – let’s just mention project lightbeam.
European Union opens consultation program regarding changes in copyright laws (here interactive online version) – it seems that European legal authorities become aware of massive problems arising from current state of copyright laws which are related to all sort of problems – from instrumental use of public prosecutors in war on piracy to limited access to literary works even if author is already deceased. What will be actual result of this action is yet to be known, however it’s definitely move in good direction.
Target’s data theft affects 70 millions customers – as expected story of massive data breach at American retail network unwinds. Furthermore as it turns out, Target wasn’t the only affected retailer. Neiman Marcus and maybe three others companies were also attacked, timing of the attack correlating with that of Target’s – totaling to over 100 millions possibly affected customers. Also details regarding method of the POS attack are slowly getting to light. Apparently malware used for attacks is modified version of BlackPOS – popular and available for sale designed to be installed on POS devices. As reported by Krebs on Security after installing malware attackers gained persistent access to network by logging to remote server. Analysis by McAfee labs suggests involvement of known among cybercrimes forums user ‘Rescator’. According to Seculert malware downloaded 11 GBs of data in over two weeks of its activity. Stolen data were then uploaded to FTP servers.
President Obama announces curbing NSA spying program – as planned earlier today Barack Obama made a public appearance regarding sweeping data collection programs. Unfortunately, nothing more than expected promises of limiting scope of surveillance resulted form the speech. Whether any changes towards civil liberties will happen, or just programs will be better concealed is yet to be seen (hopefully).
I hope that my timetable will allow to soon come back to ‘normal’ form of the posts. In the meantime wish me luck, and keep following lawsec.net!
Welcome in the new year! After bit longer than usual break I’m back to editing and creating this blog. Depending on how much time I will have available this post might be a beginning of a longer series of articles on data mining. On the other hand I’m afraid that afford to write on the subject on series will be hindered by need to comment on current / ongoing affairs. Anyway enjoy.
While it seems that today most attention is concentrated on government surveillance programs, it is important not to forget about less secret and probably much more prevalent problem of data mining methods used officially by both private enterprises and government institutions. Modern technology of data collection and analysis enables mining on global scale, making world of online user data borderless. Not even mentioning problems of copyright law regarding the fact that crawlers have to access and collect data from ie web pages, there is myriad of issues regarding privacy and ‘ownership’ of personal information. As reported by New York Times and Wall Street Journal specific profiles, based on data like estimated salary, history of sales, ads clicked and page history are sold almost every second to highest bidder. Furthermore it turns out that anonimisation of data is much more complex and less airtight than it seems. In many cases data miners collects data that are not directly personal information, but due to its nature – like e-mail – address they are just as good for identification as actual personal data. Research mentioned in WSJ article suggests that 56% of websites leaks that kind of information. What’s even more ‘like’ buttons from facebook or twitter track website activity even if user do not click on them.