Protecting Your Privacy at International Borders

Protecting Your Privacy at International Borders

via Schneier on Security by schneier on 1/11/12

The EFF has published a good guide.
My own advice is here and here.

Police May Be Monitored

Tom W. Bell at suggests a bumper sticker and magnetic sign for when you're pulled over:

This bumper sticker should help to put police on notice that you may record them during traffic stops, thus negating any claim to a reasonable expectation of privacy:

Traffic stops may be monitored
for quality control purposes

Why Whole Body Scanners Won't Work

http://www.thefreemanonline.org/headline/whole-body-imaging/

The TSA already subjects your carry-on bags to X-ray scanning that penetrates the “skin” to show what’s beneath. Yet screeners routinely fail to discern the guns, knives, and other contraband their monitors show. Sometimes undercover federal investigators are smuggling those weapons to test screeners; other times, passengers who’ve forgotten the pistol or ammunition in their knapsack turn themselves in when they reach their gate. Expecting screeners who overlook the hunting knife beside a paperback novel to find the explosives taped near a woman’s… Well, let’s just say the distractions of whole-body imaging are considerably greater than anything in the average carry-on.

There’s a far simpler, constitutional, and less offensive way to protect aviation than photographing two million passengers in their birthday suits each day: Free the airlines from the federal government’s stranglehold on security. Let each company determine what works best for its routes, customers, and specific risks. Does anyone seriously believe that politicians and bureaucrats know more about securing planes than pilots and executives who’ve spent their lives in the industry? Even baggage handlers could give Congress a lesson in preventing terrorists from hiding bombs in checked luggage – yet the Feds dictate to them instead.

Melancholy elephants

...was the title of a story by Spider Robinson.  Its premise was that we needed to decline to extend copyrights on works indefinitely, because sooner or later, everything worth producing would be produced, and it would be impossible to be creative without infringing on someone's copyright. (How many different possible one-measure pieces of music are there?)

Bruce Schneier looks at another reason why we need to be able to forget -- at least officially -- casual "ephemeral" conversations.

We chat in e-mail, over SMS and IM, and on social networking websites like Facebook, MySpace, and LiveJournal. We blog and we Twitter. These conversations -- with friends, lovers, colleagues, members of our cabinet -- are not ephemeral; they leave their own electronic trails.

We know this intellectually, but we haven't truly internalized it. We type on, engrossed in conversation, forgetting we're being recorded and those recordings might come back to haunt us later.

....

Cardinal Richelieu famously said, :If one would give me six lines written by the hand of the most honest man, I would find something in them to have him hanged." When all our ephemeral conversations can be saved for later examination, different rules have to apply. Conversation is not the same thing as correspondence. Words uttered in haste over morning coffee, whether spoken in a coffee shop or thumbed on a Blackberry, are not official pronouncements. Discussions in a meeting, whether held in a boardroom or a chat room, are not the same as answers at a press conference. And privacy isn't just about having something to hide; it has enormous value to democracy, liberty, and our basic humanity.

We can't turn back technology; electronic communications are here to stay and even our voice conversations are threatened. But as technology makes our conversations less ephemeral, we need laws to step in and safeguard ephemeral conversation. We need a comprehensive data privacy law, protecting our data and communications regardless of where it is stored or how it is processed. We need laws forcing companies to keep it private and delete it as soon as it is no longer needed. Laws requiring ISPs to store e-mails and other personal communications are exactly what we don't need.

Rules pertaining to government need to be different, because of the power differential. Subjecting the president's communications to eventual public review increases liberty because it reduces the government's power with respect to the people. Subjecting our communications to government review decreases liberty because it reduces our power with respect to the government. The president, as well as other members of government, need some ability to converse ephemerally -- just as they're allowed to have unrecorded meetings and phone calls -- but more of their actions need to be subject to public scrutiny.

But laws can only go so far. Law or no law, when something is made public it's too late. And many of us like having complete records of all our e-mail at our fingertips; it's like our offline brains.

In the end, this is cultural.

Indeed, this calls up another short story, this one by Isaac Asimov: "The Dead Past".  In this story, someone (re)invents a viewer that will display past events, going back a few centuries at most.  The sting in the tail, and the reason why the government has been monopolizing the technology so vigorously, is that the past also includes what has just now finished being the present.  If you can view events one second in the past, that's tantamount to spying on someone right now. Anywhere in the world.  Whether you've gotten permission or not.

This invention was placed in the public domain before the inventors had these facts pointed out to them.  The result was the absolute death of privacy.  Celebrities would be living in literal fish bowls.  Your only hope for privacy was obscurity, and everyone had at least one person who was interested in "looking in" on his private affairs.

Eventually, I suppose, the culture would adapt to this degree of transparancy, and whatever was observed through this viewer would be weighed against what would be seen if the viewer were turned upon anyone else -- the story ends before this period of adjustment had even started.

But with more and more of our lives winding up in databases or on the Web, we may find ourselves in the Dead Past -- make that the Transparent Present.  Anyone with access to the right databases and servers may be able to construct a detailed picture of our activities -- better, perhaps, than we're capable of remembering even in theory.  Surveillance systems can already potentially follow us every moment we spend outside our homes, and given behavioral modeling, may even be able to infer details about our private lives.

 

Cardinal Richelieu famously said, "If one would give me six lines written by the hand of the most honest man, I would find something in them to have him hanged." When all our ephemeral conversations can be saved for later examination, different rules have to apply.

If our casual conversations can be dragged into court to impeach our testimony in some legal action, how long before we see the casual conversations of judges and prosecutors dragged into those same cases to argue for recusal?  If six lines are enough to hang an honest man, maybe six lines will be enough to disqualify an honest judge.

 

The future will be here before you know it.

When anything can be shown on video

Jonathan Wilde at The Distributed Network discusses the increasingly available technology that can be used to show anyone doing anything you can imagine. Examples include a McCain/Obama dance-off and Nike's "what if" ad series.  People have valid concerns about universal surveillance.  Pretty soon, everyone will be on camera every moment they spend outside their home or any other private space.
One point that is raised is that in conjunction with the ability to remake video reality to suit your imagination is:

As Reason magazine showed the true power of ubiquitous surveillance technology on its June cover, the "What if?" commercial holds special significance within the larger context of the societal ramifications of bleeding-edge special effects technology. As the June issue focused on the benefits rather than drawbacks that come with the 'databasification' of society, the "What if?" commercial shows another reason why the future will not be a dystopian world of panopticon horrors. As the power of special effects technology grows, the fraction of verifiable information surveillance technology can produce falls.

"The camera doesn't lie" is no longer a truism.  "Photoshop" is now a verb, and "fauxtography" has made an appearance in newspapers.

One can imagine a hypothetical court trial in which the defendant "caught on tape" provides his own videotape in which the person seen committing the crime is none other than the judge himself. Or even John Kerry. When individuals take full advantage of the tools provided by cutting edge technology, an honest legal system would gain very little from simple video footage. Just as today, the usual forms of evidence will be necessary to make a conviction. The existence of easily falsifiable video evidence makes eyewitness accounts, fingerprints, fiber traces, entry and exit points, tracks, plausibility, and a logical explanatory chain of events all the more important. How can the evidence incriminating you hold up in an equitable court if it can be easily created on Photoshop or a future Pixar for Windows? When the billions of prying eyes produce evidence of guilt, who is going to believe it if just as convincing phony evidence can be created by hand?

Palin, Privacy, and Politics

Patterico reminds us that the left operates on a pronounced double standard as far as "rights" go. Any rights they defend have to be earned. You earn your rights by toeing the party line.

Attention conservatives: in case you didn’t understand it before, it should be clear now. There is strain of leftists out there who think that any violation of your privacy — any violation — is justified because of your political beliefs.

Smile!

Apparently, Obama was instrumental in pushing through a law, and one that I actually think is a good one.  (That's one...)

From Wizbang:

Barack Obama has exactly one achievement in his years and years of public service that I can give him full credit for -- the passage of a law in Illinois that required all police interrogations of suspects in capital crimes be videotaped.

That being said, what's the context?

Well...

...there's one area where I have to stand against the general expressed desires of the cops. And that's on the matter of people videotaping police officers performing their duties.

The latest incident to bring up this subject is in Oregon, where a man had his video camera taken away after videotaping police stop and question two men on the street.

As far as I am concerned, a police officer on duty and performing his or her duties has absolutely no right or expectation of privacy, and should behave as if they might be on film at any moment.

I can see certain exceptions, such as when the officers are changing clothes, in the bathroom, or acting undercover, but those are about it.

As I mentioned in a comment, though, I'd like to know what sort of teeth there are in that law Obama got passed.  If the police fail to videotape, then what?  "Oops, we screwed up.  Good thing we still have our written notes!"

The liberal argument against socialized medicine

Hat Tip:John Ray

Many liberals are up in arms these days over the USA PATRIOT Act and other recent assaults on our civil liberties. Hurray! Alas, many of these same liberals are chomping at the bit to implement even more intrusions upon our privacy. They want the government to know about your every throat swab, hemorrhoid exam, and AIDS test. That is, they are calling for some form of socialized medicine. Message to liberals: please reconsider!

Seriously, do you really want people like Dick Cheney to have access to your medical records? With any form of single-payer healthcare they will. You are probably envisioning single-payer healthcare as part of an overall victory by your party, and it would be -- temporarily. But even if the Republicans get a drubbing this fall, at some time they will be back in power, and then they will have access to records of every psychiatric exam, birth control prescription and abortion. Is that what you want?

....

But we wouldn't be thinking so much in terms of insurance if doctors and drugs were cheaper. Doctors are so expensive because we have a cartel in place; doctors are required for many tasks that could be done by health practitioners with lesser degrees. Imagine if it required a Ph.D. in computer science to put up a web page.

Drugs are so expensive in the U.S. because our FDA is far more cautious than equivalent agencies in other First World countries. We could cut drug prices by simply approving drugs that have been approved in other First World countries. If we wish to be cautious, we could require that such other country approvals be in place for several years to take advantage of their post-market monitoring.

Healthcare in the United States can be fixed without resort to a single-payer plan. But healthcare advocates have to want it. Otherwise, we are stuck with the choice between big corporations and Homeland Security having access to our medical records.
Let me end by conceding one advantage to single-payer healthcare: Roe v. Wade becomes moot. If the federal government has a record of every healthcare transaction, no one can argue with a straight face that medical decisions are a matter of personal privacy. Whether abortion is a legitimate medical procedure becomes a matter for legislatures to decide. What? You don't like this feature of single-payer healthcare? Too bad. The Religious Right will be aware of the line of reasoning above the moment single-payer gets implemented. I will make sure of it.

"I'll be watching you"

Automatic surveillance has gotten cheap and powerful enough that the police can keep an eye on everyone, 24 hours a day.

We have arrived at a unique moment in the history of surveillance. The price of both megapixels and gigabytes has plummeted, making it possible to collect a previously unimaginable quantity and quality of data. Advances in processing power and software, meanwhile, are beginning to allow computers to surmount the greatest limitation of traditional surveillance—the ability of eyeballs to effectively observe the activity on dozens of video screens simultaneously. Computers can't do all the work by themselves, but they can expand the capabilities of humans exponentially.

Liberty Island, name notwithstanding, is one of the most heavily surveilled places in America. Dozens of cameras record hundreds of hours of video daily, a volume that strains the monitoring capability of guards. The National Park Service has enlisted extra help, and as Emma and I strolled around, we weren't just being watched by people. We were being watched by machines.

Liberty Island's video cameras all feed into a computer system. The park doesn't disclose details, but fully equipped, the system is capable of running software that analyzes the imagery and automatically alerts human overseers to any suspicious events. The software can spot when somebody abandons a bag or backpack. It has the ability to discern between ferryboats, which are allowed to approach the island, and private vessels, which are not. And it can count bodies, detecting if somebody is trying to stay on the island after closing, or assessing when people are grouped too tightly together, which might indicate a fight or gang activity. "A camera with artificial intelligence can be there 24/7, doesn't need a bathroom break, doesn't need a lunch break and doesn't go on vacation," says Ian Ehrenberg, former vice president of Nice Systems, the program's developer.

And it's not just the police who'll be watching. It's everyone.

...I cruised the aisles of the neighborhood grocery store, a Pathmark, tossing items into my cart like a normal shopper would—Frosted Mini-Wheats, Pledge Wipes, a bag of carrots. Then I put them on the belt at checkout. My secret was on the lower level of the cart: a 12-pack of beer, concealed and undetectable. Or so I thought. Midway through checkout the cashier addressed me, no malice in her voice, but no doubt either. "Do you want to ring up that beer?"

...

(I know of a local pizzeria that warns customers with a posted sign: "Stop stealing the spice shakers! We know who you are, we have 24-hour surveillance!")

And by "everyone", I mean everyone

...As this month's cover story notes, the recent boom in video monitoring—by both the state and businesses—means we're all being watched. It's like something out of George Orwell's 1984. Except that, unlike Orwell's protagonist Winston Smith, we can watch back—and plenty of people are doing just that. Which makes a difference.

...

Ever since the Rodney King case, police have known that video images—whether recorded by citizens or by the authorities themselves—can provoke controversy. With video technology spreading so rapidly, such images are coming to light more often. In October 2007, an elite unit of the Chicago Police Department was disbanded after video emerged of its members shaking down barroom customers. A policeman in Puerto Rico is under FBI investigation because video—uploaded to YouTube—apparently shows him executing an unarmed man. And a Baltimore woman recently won a $180,000 false arrest and imprisonment lawsuit based on police videotape evidence that confirmed a different but similarly dressed woman was the one buying drugs.

Supporters of widespread surveillance often argue, "If you're obeying the law, you have nothing to fear." Why shouldn't the same go for police officers?

Why, indeed?

Reasserting privacy

Facebook's last straw seems to have been blabbing about users' online purchases.

Little brothers are watching you

Orwell's 1984 presented a vision of a future where Big Brother watched everyone in an electronic panopticon. The real future may be a bit different.

Wikipedia recalls a TV series called Probe in which fantastic "agents for a group known as 'World Securities,' who were outfitted with various electronic implants, and were equipped with a button-sized 'scanner' that contained a micro-miniaturized video camera, microphone and transmitter, which connected them with a team of technicians and experts who constantly monitored his surroundings, actions and vital signs, and were able to supply the Probe with encyclopedic information on any subject" fought crime on a weekly basis.

Currently that functionality and more is available from any camera-equipped cell phone that can browse the Internet that is available at any shopping mall. And today, "Samsung Electronics will launch in Europe this month its Mobile Blog 3G Phone (SGH-L760), which allows users to upload content directly to blog sites on the Internet. The phone is expected to further fuel the current boom in mobile Internet and user-created content services, as it can upload directly to popular UCC sites like YouTube, Ublog and Buzznet."

Not only is there a very good chance that anything interesting you do will be photographed, it's becoming increasingly likely that you will have no reasonable expectation of privacy any time you're in the presence of another person. With mobile phones capable of transmitting to your blog, any conversation could be uploaded to someone's website.

Being interviewed by a reporter you don't fully trust? Leave your phone on.

Think you may have a sexual harassment case? Leave your phone on.

The policeman who pulls someone over had better watch his language, because it may wind up on the motorist's blog.

Right now, "liveblogging" is the provence of one or two hard-core geeks. What happens when "liveblogging" is as easy as forgetting to shut off your cell phone?

Never write in your blog....

....Anything you wouldn't want to see on the front page of the newspaper.

Yet another person has learned this the hard way.

Prof. Jonathan Adler and Hugh Hewitt both link to this story about a Boston pediatrician, Robert P. Lindeman, who, while a defendant in a malpractice case, blogged about his case — even during the trial. As he was undergoing cross-examination on the witness stand, the plaintiff's lawyer asked what probably sounded to the jury and everyone else in the courtroom like a pair of throw-away questions: Did he have a medical blog? Yes, he said. Did he blog under the pseudonym "Flea"? Um, well, yes. And then the plaintiff's lawyer moved on to other topics until they broke for the day.

But the very next morning, before Dr. Lindeman returned to the witness stand for further cross-examination, "he agreed to pay what members of Boston's tight-knit legal community describe as a substantial settlement — case closed."

Follow the link to Beldar's blog for "the rest of the story". There's a lot to it, much of which has been deleted from Dr. Flea's Blog.

But the point is, if you write something in a blog, expect people to read it. If it can be used against you, don't be surprised if, someday, it is. Don't expect obscurity or even privacy software to save you.

I have a blog on a forum that supports "friends locking", a device which restricts the availability of posts to a list of friends. It also allows you to make a post "private" which means only the poster can (in theory) read it. I don't rely on these restrictions to keep my posts private. If I don't want it read by everyone on the planet, I don't put it online.

Not that I don't use these features – I do post stuff as "private". These are things like confirmation numbers for room reservations. I post them in my blog so I can get at them from anywhere with an internet connection, but they're private so no one else has to wade through the clutter. But it's not something where I'm taking a huge risk by someone else getting that information.

The moral, nevertheless, is this: While cross-examination under oath may famously be the most powerful engine ever devised for the ferreting out of reluctant truths, the internet is making it a potentially more powerful engine just about every day — especially when used against the blissfully unaware (or the self-deceiving). Caveat blogger!

Put the freeze on ID thieves

From the December 2-3 Wall Street Journal: "More states let consumers suspend credit files as an antifraud strategy".

If you put a "freeze" on your credit account, any new creditor who wants to open an account in your name has to provide a personal identification number, which the agencies issue the consumer once his account is frozen. The idea is, this number is one that a casual thief won't have. (Don't write it on your credit cards!!!)

(Yes, that should be obvious, but "Obviously, the obvious isn't obvious to everyone.")

Where to find instructions for freezing your credit files:

Equifax.com

Click "customer service", and then "How do I place a Security Freeze?"

Experian

Go to www.expereian.com/consumer/security_freeze.html

TransUnion.com

Click "Personal" then "Fraud and Identity Theft", then "Preventing".

Freezing requires a certified letter, containing some personal information. Thawing is easier, requiring a phone call or web access, and your personal identification number. Note, however, the thaw hotlines are not currently open 24 hours. TransUnion operates from 8:00 AM to 4:30 PM on weekdays, in every time zone.

Officially, it can take up to 72 hours to thaw, but in practice, it usually takes a few minutes.

Never write anything in your blog....

...that you wouldn't want to see on the front page of the paper in the morning.

This is old advice, dating back at least to the heyday of fanzines – about the 1930s to the 1990s. "Never put anything in your fanzine that you wouldn't want to see on the front page of the Times."

As technology has advanced, this warning has become equally apt for BBS postings, echoes, e-mail lists, and now blogs.

College student Michael Guinn thought the photos he posted of himself dressed in drag would be seen only by friends. But he made a mistake. And when someone showed the photos on Facebook to administrators at John Brown University, a Christian college in Siloam Springs, Ark., it was "the last straw for them," says Guinn, 22, who is gay.

In January, he was kicked out of school, his virtual paper trail of musings about boyfriends and visits to clubs a clear sign to administrators that, despite repeated warnings, Guinn's activities were in violation of campus conduct codes stating that behavior must "affirm and honor Scripture."

Michael Guinn just learned this advice the hard way. Other cases include:

In Costa Mesa, Calif., 20 students were suspended last month from TeWinkle Middle School for two days for participating in a MySpace group where one student allegedly threatened to kill another and made anti-Semitic slurs. The student accused of making the threat could face criminal charges and expulsion, says Bob Metz, assistant superintendent of the Newport-Mesa Unified School District.

An employer who was ready to hire a student from Vermont Technical College in Randolph Center changed his mind after seeing the student's Facebook page, says Lauri Sybel, director of the college career center. Since then, Sybel says she has checked other students' pages to make sure they weren't hurting their job prospects.

Face it. If you post something online, don't expect it to stay private. Even when services allow various forms of locking, such as Live Journal's friends lock, information will spread beyond the boundaries of your intended audiance.

Anonymity, authority, and accountability

I know a few people who say they don't trust what's written on blogs because they don't know who's writing them. In response, I've pointed out to these folks that they don't know I'm using my real name in any of my writings. All they really have to go by is my track record. Do I turn out to know what I'm talking about, or not?

Bruce Schneier looks at the same topic in the wake of the Wikipedia scandal tempest-in-a-teapot.

The problem isn't anonymity; it's accountability. If someone isn't accountable, then knowing his name doesn't help. If you have someone who is completely anonymous, yet just as completely accountable, then – heck, just call him Fred.

EBay's feedback system doesn't work because there's a traceable identity behind that anonymous nickname. EBay's feedback system works because each anonymous nickname comes with a record of previous transactions attached, and if someone cheats someone else then everybody knows it. Similarly, Wikipedia's veracity problems are not a result of anonymous authors adding fabrications to entries. They're an inherent property of an information system with distributed accountability.

An old rule

An old rule from the days of APAs: Never put anything in your fanzine that you wouldn't want on the front page of the Times.

Someone just learned that one the hard way.

An 18-year-old passenger who caused a fatal crash by pulling on the steering wheel pleaded guilty to DUI manslaughter after prosecutors discovered a confession on his online blog.

Why fear a national ID card?

(Hat tip: Norm Weatherby.)

A quick run through the reasons why even the innocent might not want to surrender their privacy.

They boil down to...

...continued in full post...

Loss of control – you depend on the government's good will to access services;

Mistakes – 25% of data in databases is wrong. Want to depend on error-free data entry to access your ATM when you want to buy groceries?

Laws change. Many drugs that used to be illegal now aren't. Many kinds of gun used to be legal. Many legal guns might become illegal in the future. A future government might not use information in its database to charge you with something that was legal at the time you did it. But if the Database shows you once used a drug that's now illegal, is that probable cause?

Also, as I've mentioned elsewhere, governments like to exercise power. They like to show who's in charge, and they like to point out that It's Not You. Possession of a database linked to a national ID grants power, and power gets used.

Maybe paper was better

Unlike paper, E-mail lasts forever.

The cases are now legion in which confidential e-mails are getting hung out to dry like so much dirty linen. Executives have been embarrassed on the witness stand (Bill Gates), fired (Harry Stonecipher) and ordered off to jail (Frank Quattrone) for hitting the "send" button after typing something inappropriate for public consumption.

People have taken the advice to back up their data to heart. Even if you delete your mail and scrub the disk, backup copies abound. And so do opportunities.

One company's legal headache is another's livelihood. A Marsh & McLennan subsidiary, Kroll Ontrack, is in the business of helping lawyers find needles in haystacks. A recent assignment had it helping a corporation respond to a government antitrust inquiry by sorting 3.5 terabytes (3.5 trillion characters) of electronic documents, roughly half of them e-mail, so that an army of lawyers, working three shifts a day, 450 at a time, could probe them for telltale words.

One safeguard would be to encrypt your e-mail. Then, just hope the recipient doesn't archive it or forward it in the clear.

Eavesdropping on your keyboard...

An eavesdropper can tell what someone is typing from the sound the keyboard makes.

The idea is that different keys tend to make slightly different sounds, and although you don't know in advance which keys make which sounds, you can use machine learning to figure that out, assuming that the person is mostly typing English text. (Presumably it would work for other languages too.)

the recognizer bootstrapped this way can even recognize random text such as passwords: In our experiments, 90% of 5-character random passwords using only letters can be generated in fewer than 20 attempts by an adversary; 80% of 10-character passwords can be generated in fewer than 75 attempts. Our attack uses the statistical constraints of the underlying content, English language, to reconstruct text from sound recordings without any labeled training data.

Soon, high-security keyboards will have to generate spurious noises that mimic the sounds of keys. Maybe it would suffice to record the sound of a key being struck, and replicate it some number of times sith some random delay between iterations.

It might still be possible to work out the mapping between the sounds and the keys, but it should still be very hard to work out which keys are being struck precisely when.

---

From a comment to Bruce's post: One of those projection keyboards, which projects a keyboard layout onto a convenient flat surface and detects where your fingers hit, would also circumvent this attack. You might want to program the display to black out and shift to a slightly different location every few minutes.

Privacy

Byron York reports on a poll asking what people think "privacy" means.

In anticipation of the Roberts hearings, Republican pollster David Winston asked a question to measure public sentiment on one of the most contentious issues to come up in the sessions:

When you think of the right to privacy, what comes closer to how you think of that right? A) The right to be free from government intrusion -- including private phone calls, private mail, private medical and financial information, and the right to raise your children as you see fit. B) The right to make decisions free from government interference, such as the right to choose abortion.

The results:

Respondent	A Freedom from government intrusion	A Freedom from government interference	A No opinion / other / no answer
All polled	66%	26%	8%
Republicans	75%	15%	10%
Independents	64%	27%	9%
Democrats	55%	38%	7%
Women	63%	29%	8%

(Afterthought half an hour later – – Pity the poll didn't ask how many would have responded "both".)