NATIONAL SECURITY VS. PRIVACY in the Modern Age Javaria Mughal

Total Page:16

File Type:pdf, Size:1020Kb

NATIONAL SECURITY VS. PRIVACY in the Modern Age Javaria Mughal 1st Place Essay Contest Winner High School Category NATIONAL SECURITY VS. PRIVACY in the Modern Age Javaria Mughal overnment surveillance has May 7; Condon, 2013, June 12). Such justifiably developed problems demonstrate a need to a negative connotation due reevaluate the scope of intelligence Gto governments’ mass accumulation operations, and the regulations that of the personal and communications govern them. However, surveillance data of millions of citizens, remains a necessary component in misleading or overblown claims securing a nation and protecting its about the effectiveness of these bulk constituent citizens. surveillance programs in preventing terrorist attacks (Bergen, Sterman, Today, terrorism poses a legitimate Schneider, and Cahall, 2014), and threat to Western countries, as the dubious legal footing of these illustrated by the events of 9/11, programs (Associated Press, 2015, threats from extremist groups such 4 FRASERINSTITUTE.ORG as ISIS, and attempted plots on differed. Consequently, prosecutors Western countries (Bergen, Sterman, found it difficult to establish a Schneider, and Cahall, 2014). The comprehensive picture of the night’s attacks on 9/11 and the conflicts events. The presence of CCTV created by extremist groups in the cameras or other visual surveillance Middle East demonstrate these equipment could have more clearly terrorist organizations’ significant established the facts and better capacities for destruction. To enabled the successful prosecution prevent potentially catastrophic of George Zimmerman, or attacks on Western countries, corroborated his innocence as ruled governments must use preemptive by the court (Bilton, 2013, July 16). measures to identify and neutralize Too often do the facts surrounding possible strikes before they injustices come down to the word occur. Without monitoring highly of those with unreliable knowledge, suspected persons’ communications or reason to lie, and too often do we and activities, government fail to bring justice, or know if justice NATIONAL security programs are less able has been brought, to those actually to assess the severity of threats, guilty or innocent. as their only intelligence sources would be intermittent tips. US SECURITY To prevent potentially catastrophic intelligence claims to have already stopped dozens of attacks through attacks on Western countries, VS. PRIVACY preemptive investigation and governments must use preemptive response, yet some analysts believe measures to identify and neutralize in the Modern Age that these numbers are exaggerated possible strikes before they occur. (Bergen, Sterman, Schneider, and Javaria Mughal Cahall, 2014). Having established the usefulness of surveillance, the next step Today, terrorism poses a legitimate becomes determining the extent to threat to Western countries, as which surveillance is appropriate. illustrated by the events of 9/11 In 2013, Edward Snowden leaked and threats from extremist groups evidence of the US government’s such as ISIS... bulk surveillance programs, including the PRISM program for collecting Internet communications of the Government surveillance can be bulk telephony metadata extraction useful in many domains other justified under Section 215 of the US than terrorism. Cases involving Patriot Act (Granick and Sprigman, unwarranted police violence, 2013, June 27). Since this release, assault, theft, and murder can be US government officials have aided through CCTV cameras. In consistently stressed the need for the State of Florida vs. George these programs. President Obama Zimmerman case, eyewitness defended them as integral to the accounts of the conflict between protection of American citizens Zimmerman and Trayvon Martin all (Baker, 2013, June 17). NSA Director CANADIAN STUDENT REVIEW WINTER 2016 5 Gen. Keith Alexander stated before Programs Stop Terrorists? Congress that “the information determined that NSA surveillance gathered from these programs only initiated 7.5% of investigations, provided the US government with of which 1.8% involved bulk critical leads to help prevent over telephony metadata under Section 50 potential terrorist events in more 215 of the USA Patriot Act, 4.4% than 20 countries around the world” involved surveillance under Section (United States Congress, 2013, June 702 of the FISA Amendments Act, 18). However, a report from the New and 1.3% involved an unidentified American Foundation casts doubt on authority. On the other hand, these claims. traditional investigative methods, including the use of tips, informants, intelligence from traditional How large a role does bulk CIA and FBI sources, routine surveillance play in counter- law enforcement, militants’ self- terrorism efforts? disclosure, and reports of suspicious activity initiated 60% of investigations. The initiation methods in 27.6% of By analyzing 225 cases involving cases are unclear; though possible, individuals charged with some it is unlikely that NSA surveillance terrorism crime, the authors of the initiated these investigations, as the report Does NSA’s Bulk Surveillance government would have then likely 6 FRASERINSTITUTE.ORG indicated such key contributions in Basaaly Moalin with al-Shabaab, an order to emphasize the benefit of its al-Qaeda affiliate. The FBI discovered surveillance programs. Either way, that Moalin was in contact with these statistics are inconsistent with al-Shabaab officials when he was US officials’ claims about the large caught providing $8,500 to an role that bulk surveillance plays in al-Shabaab affiliate. Though bulk counter-terrorism efforts (Bergen, collected metadata was apparently Sterman, Schneider, and Cahall, 2014). used, it is noteworthy that the FBI did not start investigating Moalin In fact, available evidence suggests until two months after the NSA first that bulk collection is not necessary. provided a tip. Furthermore, this During a Senate Judiciary one case which US officials use to Committee hearing in October 2013, argue the necessity of mass data NSA Director Alexander admitted collection does not even illustrate a that the bulk collection of American need for sweeping bulk collection of telephone metadata had only metadata, but rather the collection prevented one known terrorist attack of metadata for communications in in the US (United States Senate, which one party is a known or highly 2013). In this case, the government suspected terrorist. Such a metadata used telephone metadata to collection method would also have connect San Diego cab driver sufficed in other investigations, CANADIAN STUDENT REVIEW WINTER 2016 7 such as that of Najibullah Zazi. Zazi, Many people perceive mass who was planning to bomb the New government surveillance of York City subway system in 2009, individuals’ communications and was communicating with an email actions as intrusive and ultimately address known to belong to an al- discomforting (CBC News, 2015, Qaeda figure five months prior to January 28). Surveillance advocates the NSA’s interception of Zazi’s email quickly dismiss such apprehensions (Bergen, Sterman, Schneider, and with the phrase, “If you have Cahall, 2014). nothing to hide, you have nothing to fear.” But as computer security expert Bruce Schneier counters, the The failure to prevent the “nothing to hide” argument is built September 11th attacks despite on a premise that “privacy is about the slew of warnings suggests hiding a wrong” (Schneier, 2006, that what intelligence agencies May 18). Privacy does not necessitate require is not more data, but better misdeed, and is a valued right that responsiveness and appropriate provides citizens immense comfort information-sharing within and satisfaction. Thus, privacy is government. worth protecting. Privacy does not necessitate We are often presented with a misdeed, and is a valued right that dichotomy that has the 2001 terrorist provides citizens immense comfort attacks on one side, and government and satisfaction. surveillance on the other. However, US intelligence agencies were repeatedly informed of possible More complications arise when intelligence agencies seek to attacks by Osama bin Laden for interpret the massive datasets they several months leading up to the have extracted. Innocent jokes or September 11th attacks. In the spring statements can be misinterpreted as of 2001, top officials were briefed by terrorist threats when taken out of reports indicating the existence and their proper context. For instance, advancement of bin Laden’s plans. a man named Joe Lipari spent two These warnings continued through years fighting charges after he the summer with reports indicating paraphrased a quote from the film continuing plans for bin Laden’s Fight Club. The literal meaning of attacks and imminent threats his statement seemed to threaten (Eichenwald, 2012, September an Apple store, but in context, it 10). The failure to prevent the was a harmless joke written without September 11th attacks despite the the intention of pursuing violent slew of warnings suggests that what action (Booth, 2010, September intelligence agencies require is not 24). Due to the clandestine nature more data, but better responsiveness of government surveillance and appropriate information-sharing operations, it is difficult to precisely within government. quantify the number of individuals 8 FRASERINSTITUTE.ORG incorrectly deemed a threat and The government’s mass accumulation inconvenienced by false charges. of telephony and Internet data is However, the fundamental issue of unnecessary for ensuring national
Recommended publications
  • Blockchain Beyond Cryptocurrency Or Is Private Chain a Hoax Or How I Lose Money in Bitcoin but Still Decide to Get in the Research
    Blockchain Beyond Cryptocurrency Or Is Private Chain a Hoax Or How I Lose Money in Bitcoin but still Decide to Get in the Research Hong Wan Edward P. Fitts Department of Industrial and Systems Engineering Sept 2019 In this talk: • Blockchain and trust • Different kinds of blockchain • Cases and Examples • Discussions First Things First https://images.app.goo.gl/JuNznV8dZKTaHWEf9 Disclaimer Block and Chain https://youtu.be/SSo_EIwHSd4 https://youtu.be/SSo_EIwHSd4 Blockchain Design Questions • Who can access data: Private vs. Public • Who can validate data/add block: Permissioned vs Permissionless • Consensus to be used: Trade-off among security and efficiency. https://www.google.com/url?sa=i&rct=j&q=&esrc=s&source=images&cd=&ved=2ahUKEwinjN2s7_DkAhXlmeAKHXxhAIUQjRx6BAgBEAQ&url=ht tps%3A%2F%2F101blockchains.com%2Fconsensus-algorithms-blockchain%2F&psig=AOvVaw23pKh4qS8W_xgyajJ3aFl9&ust=1569669093339830 Bad News First • “Private blockchains are completely uninteresting… -- the only reason to operate one is to ride on the blockchain hype…” Bruce Schneier Tonight we will talk about cryptocurrencies… .everything you don’t understand money combined by everything you don’t understand about computers…. Cryptocurrencies: Last Week Tonight with John Oliver (HBO) https://www.schneier.com/blog/archives/2019/02/blockchain_and_.html http://shorturl.at/ahsRU, shorturl.at/gETV2 https://www.google.com/url?sa=i&rct=j&q=&esrc=s&source=images&cd=&ved=2ahUKEwj- https://d279m997dpfwgl.cloudfront.net/wp/2017/11/Trustp72L7vDkAhVjQt8KHU18CjsQjRx6BAgBEAQ&url=https%3A%2F%2Fwww.wbur.org%2Fonpoint%2F2017%2F11%2F20%2Fwho-can-cropped.jpg-you-
    [Show full text]
  • Impossible Differentials in Twofish
    Twofish Technical Report #5 Impossible differentials in Twofish Niels Ferguson∗ October 19, 1999 Abstract We show how an impossible-differential attack, first applied to DEAL by Knudsen, can be applied to Twofish. This attack breaks six rounds of the 256-bit key version using 2256 steps; it cannot be extended to seven or more Twofish rounds. Keywords: Twofish, cryptography, cryptanalysis, impossible differential, block cipher, AES. Current web site: http://www.counterpane.com/twofish.html 1 Introduction 2.1 Twofish as a pure Feistel cipher Twofish is one of the finalists for the AES [SKW+98, As mentioned in [SKW+98, section 7.9] and SKW+99]. In [Knu98a, Knu98b] Lars Knudsen used [SKW+99, section 7.9.3] we can rewrite Twofish to a 5-round impossible differential to attack DEAL. be a pure Feistel cipher. We will demonstrate how Eli Biham, Alex Biryukov, and Adi Shamir gave the this is done. The main idea is to save up all the ro- technique the name of `impossible differential', and tations until just before the output whitening, and applied it with great success to Skipjack [BBS99]. apply them there. We will use primes to denote the In this report we show how Knudsen's attack can values in our new representation. We start with the be applied to Twofish. We use the notation from round values: [SKW+98] and [SKW+99]; readers not familiar with R0 = ROL(Rr;0; (r + 1)=2 ) the notation should consult one of these references. r;0 b c R0 = ROR(Rr;1; (r + 1)=2 ) r;1 b c R0 = ROL(Rr;2; r=2 ) 2 The attack r;2 b c R0 = ROR(Rr;3; r=2 ) r;3 b c Knudsen's 5-round impossible differential works for To get the same output we update the rule to com- any Feistel cipher where the round function is in- pute the output whitening.
    [Show full text]
  • Episode 230: Click Here to Kill Everybody
    Episode 230: Click Here to Kill Everybody Stewart Baker: [00:00:03] Welcome to Episode 230 of The Cyberlaw Podcast brought to you by Steptoe & Johnson. We are back and full of energy. Thank you for joining us. We're lawyers talking about technology, security, privacy, and government. And if you want me to talk about hiking through the rain forest of Costa Rica and just how tough my six-year-old granddaughter is, I'm glad to do that too. But today I'm joined by our guest interviewee Bruce Schneier, an internationally renowned technologist, privacy and security guru, and the author of the new book, Click Here to Kill Everybody: Security and Survival in a Hyper-Connected World. We'll be talking to him shortly. For the News Roundup, we have Jamil Jaffer, who's the founder of the estimable and ever-growing National Security Institute. He's also an adjunct professor at George Mason University. Welcome, Jamil. Jamil Jaffer: [00:00:57] Thanks, Stewart. Good to be here. Stewart Baker: [00:00:58] And David Kris, formerly the assistant attorney general in charge of the Justice Department's National Security Division. David, welcome. David Kris: [00:01:07] Thank, you. Good to be here. Stewart Baker: [00:01:08] And he is with his partner in their latest venture, Nate Jones, veteran of the Justice Department, the National Security Council, and Microsoft where he was an assistant general counsel. Nate, welcome. Nate Jones: [00:01:23] Thank you. Stewart Baker: [00:01:25] I'm Stewart Baker, formerly with the NSA and DHS and the host of today's program.
    [Show full text]
  • Bruce Schneier 2
    Committee on Energy and Commerce U.S. House of Representatives Witness Disclosure Requirement - "Truth in Testimony" Required by House Rule XI, Clause 2(g)(5) 1. Your Name: Bruce Schneier 2. Your Title: none 3. The Entity(ies) You are Representing: none 4. Are you testifying on behalf of the Federal, or a State or local Yes No government entity? X 5. Please list any Federal grants or contracts, or contracts or payments originating with a foreign government, that you or the entity(ies) you represent have received on or after January 1, 2015. Only grants, contracts, or payments related to the subject matter of the hearing must be listed. 6. Please attach your curriculum vitae to your completed disclosure form. Signatur Date: 31 October 2017 Bruce Schneier Background Bruce Schneier is an internationally renowned security technologist, called a security guru by the Economist. He is the author of 14 books—including the New York Times best-seller Data and Goliath: The Hidden Battles to Collect Your Data and Control Your World—as well as hundreds of articles, essays, and academic papers. His influential newsletter Crypto-Gram and blog Schneier on Security are read by over 250,000 people. Schneier is a fellow at the Berkman Klein Center for Internet and Society at Harvard University, a Lecturer in Public Policy at the Harvard Kennedy School, a board member of the Electronic Frontier Foundation and the Tor Project, and an advisory board member of EPIC and VerifiedVoting.org. He is also a special advisor to IBM Security and the Chief Technology Officer of IBM Resilient.
    [Show full text]
  • Data Encryption Standard
    Data Encryption Standard The Data Encryption Standard (DES /ˌdiːˌiːˈɛs, dɛz/) is a Data Encryption Standard symmetric-key algorithm for the encryption of electronic data. Although insecure, it was highly influential in the advancement of modern cryptography. Developed in the early 1970s atIBM and based on an earlier design by Horst Feistel, the algorithm was submitted to the National Bureau of Standards (NBS) following the agency's invitation to propose a candidate for the protection of sensitive, unclassified electronic government data. In 1976, after consultation with theNational Security Agency (NSA), the NBS eventually selected a slightly modified version (strengthened against differential cryptanalysis, but weakened against brute-force attacks), which was published as an official Federal Information Processing Standard (FIPS) for the United States in 1977. The publication of an NSA-approved encryption standard simultaneously resulted in its quick international adoption and widespread academic scrutiny. Controversies arose out of classified The Feistel function (F function) of DES design elements, a relatively short key length of the symmetric-key General block cipher design, and the involvement of the NSA, nourishing Designers IBM suspicions about a backdoor. Today it is known that the S-boxes that had raised those suspicions were in fact designed by the NSA to First 1975 (Federal Register) actually remove a backdoor they secretly knew (differential published (standardized in January 1977) cryptanalysis). However, the NSA also ensured that the key size was Derived Lucifer drastically reduced such that they could break it by brute force from [2] attack. The intense academic scrutiny the algorithm received over Successors Triple DES, G-DES, DES-X, time led to the modern understanding of block ciphers and their LOKI89, ICE cryptanalysis.
    [Show full text]
  • Designing Encryption Algorithms for Optimal Software Speed on the Intel Pentium Processor
    Fast Software Encryption: Designing Encryption Algorithms for Optimal Software Speed on the Intel Pentium Processor Bruce Schneier Doug Whiting Counterpane Systems Stac Electronics 101 E Minnehaha Parkway 12636 High Bluff Drive Minneapolis, MN 55419 San Diego, CA 92130 [email protected] [email protected] Abstract. Most encryption algorithms are designed without regard to their performance on top-of-the-line microprocessors. This paper dis- cusses general optimization principles algorithms designers should keep in mind when designing algorithms, and analyzes the performance of RC4, SEAL, RC5, Blowfish, and Khufu/Khafre on the Intel Pentium with respect to those principles. Finally, we suggest directions for algo- rithm design, and give example algorithms, that take performance into account. 1 Overview The principal goal guiding the design of any encryption algorithm must be se- curity. In the real world, however, performance and implementation cost are always of concern. The increasing need for secure digital communication and the incredible processing power of desktop computers make performing software bulk encryption both more desirable and more feasible than ever. The purpose of this paper is to discuss low-level software optimization tech- niques and how they should be applied in the design of encryption algorithms. General design principles are presented that apply to almost all modern CPUs, but specific attention is also given to relevant characteristics of the ubiquitous Intel X86 CPU family (e.g., 486, Pentium, Pentium Pro). Several well-known algorithms are examined to show where these principles are violated, leading to sub-optimal performance. This paper concerns itself with number of clock cy- cles per byte encrypted|given a basic encryption algorithm \style." Factors of two, three, four, or more in speed can be easily obtained by careful design and implementation, and such speedups are very significant in the real world.
    [Show full text]
  • With Bruce Schneier ’84
    Friday, October 5 2–3 p.m. 1400 Wegmans Hall Securing a World of Physically Capable Computers With Bruce Schneier ’84 Computer security is no longer about data; it’s about life and property. This change will shake up our industry in many ways. First, data authentication and integrity will become more important than confidentiality. And second, our largely regulation-free Internet will become a thing of the past. Soon we will no longer have a choice between government regulation and no government regulation; our choice will be between smart government regulation and stupid government regulation. It’s vital that we look back at what we’ve learned from past attempts to secure these systems and forward at what technologies, laws, regulations, economic incentives, and social norms we need to secure them. Internationally renowned security technologist Bruce Schneier ’84, called a security guru by the Economist, is the author of 14 books, including the New York Times best-seller Data and Goliath: The Hidden Battles to Collect Your Data and Control Your World, and hundreds of articles, essays, and academic papers. His influential newsletter Crypto-Gram and blog Schneier on Security are widely read. Schneier is a fellow at the Berkman Klein Center for Internet and Society at Harvard University; a lecturer in public policy at the Harvard Kennedy School; a board member of the Electronic Frontier Foundation, AccessNow, and the Tor Project; and an advisory board member of EPIC and VerifiedVoting.org. PHOTOGRAPH BY DAVID BETTS DAVID BY PHOTOGRAPH GOERGEN INSTITUTE FOR DATA SCIENCE DISTINGUISHED RESEARCH SEMINAR SERIES • PRESENTED BY THE GOERGEN INSTITUTE FOR DATA SCIENCE IN COOPERATION WITH THE NATIONAL SCIENCE FOUNDATION RESEARCH TRAINEESHIP DATA-ENABLED SCIENCE AND ENGINEERING (NRT-DESE) AWARD FOR GRADUATE TRAINING IN DATA-ENABLED RESEARCH INTO HUMAN BEHAVIOR AND ITS COGNITIVE AND NEURAL MECHANISMS.
    [Show full text]
  • Data Encryption Standard (DES)
    6 Data Encryption Standard (DES) Objectives In this chapter, we discuss the Data Encryption Standard (DES), the modern symmetric-key block cipher. The following are our main objectives for this chapter: + To review a short history of DES + To defi ne the basic structure of DES + To describe the details of building elements of DES + To describe the round keys generation process + To analyze DES he emphasis is on how DES uses a Feistel cipher to achieve confusion and diffusion of bits from the Tplaintext to the ciphertext. 6.1 INTRODUCTION The Data Encryption Standard (DES) is a symmetric-key block cipher published by the National Institute of Standards and Technology (NIST). 6.1.1 History In 1973, NIST published a request for proposals for a national symmetric-key cryptosystem. A proposal from IBM, a modifi cation of a project called Lucifer, was accepted as DES. DES was published in the Federal Register in March 1975 as a draft of the Federal Information Processing Standard (FIPS). After the publication, the draft was criticized severely for two reasons. First, critics questioned the small key length (only 56 bits), which could make the cipher vulnerable to brute-force attack. Second, critics were concerned about some hidden design behind the internal structure of DES. They were suspicious that some part of the structure (the S-boxes) may have some hidden trapdoor that would allow the National Security Agency (NSA) to decrypt the messages without the need for the key. Later IBM designers mentioned that the internal structure was designed to prevent differential cryptanalysis.
    [Show full text]
  • On the Twofish Key Schedule
    On the Two sh Key Schedule ? ?? ??? y Bruce Schneier , John Kelsey , Doug Whiting ,David Wagner , Chris z x Hall , and Niels Ferguson Abstract. Two sh is a new blo ck cipher with a 128 bit blo ck, and a key length of 128, 192, or 256 bits, which has b een submitted as an AES candidate. In this pap er, we brie y review the structure of Two sh, and then discuss the key schedule of Two sh, and its resistance to attack. We close with some op en questions on the securityofTwo sh's key schedule. 1 Intro duction NIST announced the Advanced Encryption Standard AES program in 1997 [NIST97a]. NIST solicited comments from the public on the prop osed standard, and eventually issued a call for algorithms to satisfy the standard [NIST97b]. The intention is for NIST to make all submissions public and eventually, through a pro cess of public review and comment, cho ose a new encryption standard to replace DES. Two sh is our submission to the AES selection pro cess. It meets all the required NIST criteria|128-bit blo ck; 128-, 192-, and 256-bit key; ecienton various platforms; etc.|and some strenuous design requirements, p erformance as well as cryptographic, of our own. Two sh was designed to meet NIST's design criteria for AES [NIST97b]. Sp eci cally, they are: { A 128-bit symmetric blo ck cipher. { Key lengths of 128 bits, 192 bits, and 256 bits. { No weak keys. { Eciency, b oth on the Intel Pentium Pro and other software and hardware platforms.
    [Show full text]
  • Block Ciphers & the Data Encryption Standard 4/10/20
    Block Ciphers & The Data Encryption Standard 4/10/20 CS 330 Block Ciphers 1 Administrivia • “Live” lecture on Monday (4/13) instead of recording • Expect new HW assignment soon • Talk by Lauren Harris (‘14) on Tuesday CS 330 Block Ciphers Guest Speaker! • Secure File Transfer Protcol by Trang Tran CS 330 Block Ciphers There are two kinds of cryptography in this world: cryptography that will stop your kid sister from reading your files, and cryptography that will stop major governments from reading your files. -- Preface to Applied Cryptography by Bruce Schneier CS 330 Block Ciphers 4 Modern computer-based ciphers • modern cipher systems take the idea of using multiple, changing substitution alphabets from the mechanical systems developed during WW2 and extend them to the binary representation of data in modern computers. • still two basic types of systems – substitution, which comes in two flavors • symmetric, and • asymmetric – and transposition CS 330 Block Ciphers 5 Symmetric cipher systems • Issues – key management – speed – key-length – ease of programming (and embedding in hardware) – ease of use • the ideal is to make the system invisible to the user. CS 330 Block Ciphers 6 Block vs. Stream Ciphers • block ciphers process messages in blocks, each of which is then en/decrypted – like a substitution on very big characters – or like the polygraphic systems we looked at (Playfair) – 64-bits or more – most current symmetric cipher algorithms are block ciphers (e.g., DES, AES, Blowfish, Twofish, IDEA, TEA) CS 330 Block Ciphers 7 Block vs. Stream Ciphers • stream ciphers process messages a bit or byte at a time when en/decrypting – these systems also may change the key as they encipher, attempting to emulate a one-time pad.
    [Show full text]
  • Supreme Court of the United States
    No. 19-783 IN THE Supreme Court of the United States NATHAN VAN BUREN, Petitioner, v. UNITED STATES, Respondent. ON WRIT OF CERTIORARI TO THE UNITED STATES CouRT OF APPEALS FOR THE ELEVENTH CIRcuIT BRIEF OF AMICI CURIAE COMPUTER SECURITY RESEARCHERS, ELECTRONIC FRONTIER FOUNDATION, CENTER FOR DEMOCRACY & TECHNOLOGY, BUGCROWD, RAPID7, SCYTHE, AND TENABLE IN SUPPORT OF PETITIONER ANDREW CROCKER Counsel of Record NAOMI GILENS ELECTRONic FRONTIER FOUNDATION 815 Eddy Street San Francisco, California 94109 (415) 436-9333 [email protected] Counsel for Amici Curiae 296514 A (800) 274-3321 • (800) 359-6859 i TABLE OF CONTENTS Page TABLE OF CONTENTS..........................i TABLE OF CITED AUTHORITIES ..............iii INTEREST OF AMICI CURIAE ..................1 SUMMARY OF ARGUMENT .....................4 ARGUMENT....................................5 I. The Work of the Computer Security Research Community Is Vital to the Public Interest...................................5 A. Computer Security Benefits from the Involvement of Independent Researchers ...........................5 B. Security Researchers Have Made Important Contributions to the Public Interest by Identifying Security Threats in Essential Infrastructure, Voting Systems, Medical Devices, Vehicle Software, and More ...................10 II. The Broad Interpretation of the CFAA Adopted by the Eleventh Circuit Chills Valuable Security Research. ................16 ii Table of Contents Page A. The Eleventh Circuit’s Interpretation of the CFAA Would Extend to Violations of Website Terms of Service and Other Written Restrictions on Computer Use. .................................16 B. Standard Computer Security Research Methods Can Violate Written Access Restrictions...........................18 C. The Broad Interpretation of the CFAA Discourages Researchers from Pursuing and Disclosing Security Flaws ...............................22 D. Voluntary Disclosure Guidelines and Industry-Sponsored Bug Bounty Programs A re Not Sufficient to Mitigate the Chill .
    [Show full text]
  • Antonio Tajani MEP President of the European Parliament [email protected]
    Antonio Tajani MEP President of the European Parliament [email protected] 12 June 2018 Mr President, Article 13 of the EU Copyright Directive Threatens the Internet As a group of the Internet’s original architects and pioneers and their successors, we write to you as a matter of urgency about an imminent threat to the future of this global network. The European Commission’s proposal for Article 13 of the proposed Directive for Copyright in the Digital Single Market Directive was well-intended. As creators ourselves, we share the concern that there should be a fair distribution of revenues from the online use of copyright works, that benefits creators, publishers, and platforms alike. But Article 13 is not the right way to achieve this. By requiring Internet platforms to perform automatic filtering all of the content that their users upload, Article 13 takes an unprecedented step towards the transformation of the Internet from an open platform for sharing and innovation, into a tool for the automated surveillance and control of its users. Europe has been served well by the balanced liability model established under the Ecommerce Directive, under which those who upload content to the Internet bear the principal responsibility for its legality, while platforms are responsible to take action to remove such content once its illegality has been brought to their attention. By inverting this liability model and essentially making platforms directly responsible for ensuring the legality of content in the first instance, the business models and investments of platforms large and small will be impacted. The damage that this may do to the free and open Internet as we know it is hard to predict, but in our opinions could be substantial.
    [Show full text]