Posts

Showing posts from August, 2019

EFF: As Ola Bini Prosecutors Wrap Up Investigation, Amnesty Calls Out Human Rights Violations in His Case

Image
As Ola Bini Prosecutors Wrap Up Investigation, Amnesty Calls Out Human Rights Violations in His Case Today marks the last day that the Ecuadorean prosecution has to investigate its case against Ola Bini, the Swedish free software programmer  who was arrested there in April and detained for over two months without trial and without clear charges. On Thursday, the judge accepted a plea by the prosecutors to change the nature of the charges, switching from one part of Ecuador’s broad cybercrime statute to another. It seems likely that the prosecution will rely on evidence uncovered a few weeks ago that depicted Bini accessing an open, publicly available telnet service : an act that is, in itself, entirely legal under any reasonable interpretation of the law The sudden swapping out of charges at the last moment is just the latest twist in a politically charged and technically confused prosecution. It should be no surprise, then, that Amnesty International this week released a stateme

EFF: Don't Play in Google's Privacy Sandbox

Don't Play in Google's Privacy Sandbox Last week, Google announced a plan to “build a more private web.” The announcement post was, frankly, a mess. The company that tracks user behavior on over ⅔ of the web said that “Privacy is paramount to us, in everything we do.”  Google not only doubled down on its commitment to targeted advertising, but also made the laughable claim that blocking third-party cookies -- by far the most common tracking technology on the Web, and Google’s tracking method of choice -- will hurt user privacy. By taking away the tools that make tracking easy, it contended, developers like Apple and Mozilla will force trackers to resort to “opaque techniques” like fingerprinting. Of course, lost in that argument is the fact that the makers of Safari and Firefox have shown serious commitments to shutting down fingerprinting, and both browsers have made real progress in that direction. Furthermore, a key part of the Privacy Sandbox proposals is Chr

EFF: Don't Play in Google's Privacy Sandbox

Don't Play in Google's Privacy Sandbox Last week, Google announced a plan to “build a more private web.” The announcement post was, frankly, a mess. The company that tracks user behavior on over ⅔ of the web said that “Privacy is paramount to us, in everything we do.”  Google not only doubled down on its commitment to targeted advertising, but also made the laughable claim that blocking third-party cookies -- by far the most common tracking technology on the Web, and Google’s tracking method of choice -- will hurt user privacy. By taking away the tools that make tracking easy, it contended, developers like Apple and Mozilla will force trackers to resort to “opaque techniques” like fingerprinting. Of course, lost in that argument is the fact that the makers of Safari and Firefox have shown serious commitments to shutting down fingerprinting, and both browsers have made real progress in that direction. Furthermore, a key part of the Privacy Sandbox proposals is Chr

EFF: Harvard Student’s Deportation Raises Concerns About Border Device Searches and Social Media Surveillance

Harvard Student’s Deportation Raises Concerns About Border Device Searches and Social Media Surveillance Media outlets reported this week that an international student at Harvard University was deported back to Lebanon after border agents in Boston searched his electronic devices and confronted him about his friends’ social media posts. These allegations raise serious concerns about whether the government is following its own policies regarding border searches of electronic devices, and the constitutionality of these searches and of social media surveillance by the government. As the Harvard Crimson reported, Ismail Ajjawi alleges that after he arrived at Logan International Airport, U.S. Customs and Border Protection (CBP) officers subjected him to hours of questioning, including about his religious practices. Officers also had him unlock his cell phone and laptop, and took the devices out of his sight for approximately five hours. A CBP officer ultimately confronted Ajjawi abou

EFF: Five Concerns about Amazon Ring’s Deals with Police

Five Concerns about Amazon Ring’s Deals with Police More than 400 police departments across the country have partnered with Ring, tech giant Amazon’s “smart” doorbell program, to create a troubling new video surveillance system. Ring films and records any interaction or movement happening at the user’s front door, and alerts users’ phones. These partnerships expand the web of government surveillance of public places, degrade the public’s trust in civic institutions, purposely breed paranoia, and deny citizens the transparency necessary to ensure accountability and create regulations. You can read more about EFF’s thoughts on how this technology threatens privacy, encourages racial profiling, and stifles freedom here . Amazon is aggressively pursuing these worrisome partnerships with police throughout the country. Yet it should be communities themselves, and not spy tech vendors, who ultimately decide whether their police may use new systems of surveillance of public places. Rep

EFF: EFF and Mozilla Release Public Letter to Venmo

EFF and Mozilla Release Public Letter to Venmo EFF is teaming up with the Mozilla Foundation to tell Venmo to clean up its privacy act. In a public letter sent to President/CEO Dan Schulman and COO Bill Ready today, we are telling Venmo to make transactions private by default and let users hide their friend lists. Both EFF and Mozilla have voiced concern with Venmo’s privacy practices in the past. Venmo is marketed as a way for friends to send and receive money, so people can easily split bills like restaurant checks or concert tickets. However, those transactions are public by default, which can reveal private details about who you spend time with and what you do with them. While users do have an option to hide their transactions if they dig into Venmo’s privacy settings, there is no way for users to hide their friend lists. That means that anyone can uncover who you pay regularly, creating a public record of your personal and professional community. Venmo is out of excuses

EFF: EFF and Mozilla to Venmo: Clean Up Your Privacy Settings

EFF and Mozilla to Venmo: Clean Up Your Privacy Settings Popular Payment App Reveals Sensitive Data by Default San Francisco – The Electronic Frontier Foundation (EFF) and Mozilla have teamed up in an open letter to Venmo, telling the popular payment app to clean up its privacy settings, which leaves sensitive financial data exposed to the public. Venmo is marketed as a way for friends to send and receive money, so people can easily split bills like restaurant checks or concert tickets. However, those transactions are public by default, which can reveal private details about who you spend time with and what you do with them. While users do have an option to hide their transactions if they dig into Venmo’s privacy settings, there is no way for users to hide their friend lists. That means that anyone can uncover who you pay regularly, creating a public record of your personal and professional community. “Your bank doesn’t put details of your financial transactions into a publ

EFF: EFF Sues DHS To Uncover Information About Border Agents Using GPS Devices Without a Warrant To Track Vehicles

EFF Sues DHS To Uncover Information About Border Agents Using GPS Devices Without a Warrant To Track Vehicles ICE and CBP Defying 2012 Supreme Court Ruling Banning the Practice Washington, D.C.—The Electronic Frontier Foundation (EFF) sued the Department of Homeland Security (DHS) and its component agencies today to obtain information about the agencies’ warrantless use of global positioning system (GPS) devices to track vehicles entering the U.S. In 2012, the Supreme Court unanimously ruled in a landmark decision in U.S. v. Jones that such warrantless GPS tracking inside the U.S. is unconstitutional under the Fourth Amendment. When Immigration and Customs Enforcement (ICE) and Customs and Border Protection (CBP) disclosed in court filings in 2018 that they used GPS devices without a warrant at the border, the federal judge overseeing the case extended the Supreme Court’s ban to include such searches at the border. EFF’s Freedom of Information Act (FOIA) lawsuit seeks to

EFF: U.S. Export Controls and “Published” Encryption Source Code Explained

U.S. Export Controls and “Published” Encryption Source Code Explained Throughout our long history of defending encryption, EFF has taken a special interest in ensuring that researchers and programmers who help build and strengthen digital security are not prevented from sharing their knowledge. Because of this history, we periodically get requests about the status of U.S. export controls and how they affect open source software that uses encryption. It can be a daunting topic to research, and our friends at the Internet Systems Consortium (with help from the terrific export regulation attorney Roz Thomsen ) just helped us to refresh our understanding.  We thought it might be also useful for the community to have a refresher as well.  First, a disclaimer: as part of our Coders’ Rights Project , EFF frequently provides pro bono ( free!) assistance to coders, hackers, and security researchers who face legal challenges as a result of their work. But this post isn’t intended as legal

EFF: There Are No Magic Words That You Can Post to Change Instagram’s Terms of Service

There Are No Magic Words That You Can Post to Change Instagram’s Terms of Service Every so often, a rash of identical posts starts to take over social media. This isn’t the work of bots, but the result of a number of people believing that these words will have an effect on the terms of service of Facebook, or, in this most recent case, Instagram. In fact, there is nothing you can post online that will change a social network’s terms of service. And currently, Instagram’s terms aren’t even changing in the first place. Here’s how this goes: people hear there is going to be a change to a company’s terms of service. It usually takes the form of “there’s going to be a new rule that means Instagram owns the copyright of my pictures.” It’s often not even true—there is no new rule. These companies do require users to license —not give—user-posted content to them so that companies can share them. On all of the major social media platforms, users keep the copyrights in the photos and videos

EFF: Telnet Is Not A Crime: Unconvincing Prosecution Screenshot Leaked in Ola Bini Case

Image
Telnet Is Not A Crime: Unconvincing Prosecution Screenshot Leaked in Ola Bini Case Since EFF visited Ecuador three weeks ago , the investigation into open source developer Ola Bini has proceeded as we described then: drawn out, with little evidence of wrong-doing, but potentially compromised by acts of political theater outside the bounds of due process and a fair trial. Last week — shortly after prosecutors successfully extended the investigation for another 30 days and informed Bini that they would also be opening new investigations into his taxes and visa status — Ecuadorean TV and newspapers published leaked imagery and conversations from evidence collected in the trial, together with claims from sources that this imagery proved Bini hacked the systems of Ecuador’s national communications provider, ECN. The evidence offered was a screenshot, said to be taken from Bini’s mobile phone. The press reported that the phone was unlocked by police after seized security footage revea

EFF: Ninth Circuit Goes a Step Further to Protect Privacy in Border Device Searches

Ninth Circuit Goes a Step Further to Protect Privacy in Border Device Searches The U.S. Court of Appeals for the Ninth Circuit issued a new ruling in U.S. v. Cano [.pdf] that offers greater privacy protection for people crossing the border with their electronic devices, but it doesn’t go as far as we sought in our amicus brief . Cano had attempted to cross the border near San Diego when cocaine was found in his car. He was arrested at the port of entry and border agents manually and forensically searched his cell phone. He was prosecuted for importing illegal drugs and moved to suppress the evidence found on his phone. The Ninth Circuit held that the searches of his cell phone violated the Fourth Amendment and vacated his conviction. In U.S. v. Cotterman (2013), the Ninth Circuit had circumscribed the border search exception as it applies to electronic devices. The court held that the Fourth Amendment required border agents to have had reasonable suspicion—a standard between n

EFF: Browsers Take a Stand Against Kazakhstan’s Invasive Internet Surveillance

Browsers Take a Stand Against Kazakhstan’s Invasive Internet Surveillance Yesterday, Google Chrome , Mozilla Firefox , and Apple’s Safari browsers started blocking a security certificate previously used by Kazakh ISPs to compromise their users’ security and perform dragnet surveillance. We encourage other browsers to take similar security measures. Since the fix has been implemented upstream in Chromium , it shouldn’t take long for other Chromium-based browsers, like Brave, Opera, and Microsoft’s Edge, to do the same. What Happened, and Why Is It a Problem? Back in July, Kazakhtelecom, Kazakhstan’s state telecommunications operator, began regularly intercepting encrypted web ( HTTPS ) connections. Usually, this kind of attack on encrypted HTTPS connections is detectable and leads to loud and visible browser warnings or other safeguards that prevent users from continuing. These security measures work because the certificate used is not trusted by user devices or browsers. How