Boston—An FBI search warrant used to hack into thousands of computers around the world was unconstitutional, the Electronic Frontier Foundation (EFF) told a federal appeals court today in a case about a controversial criminal investigation that resulted in the largest known government hacking campaign in domestic law enforcement history.

The Constitution requires law enforcement officers seeking a search warrant to show specific evidence of a possible crime, and tie that evidence to specific persons and places they want to search. These fundamental rules protect people from invasions of privacy and police fishing expeditions.

But the government violated those rules while investigating “Playpen,” a child pornography website operating as a Tor hidden service. During the investigation, the FBI secretly seized servers running the website and, in a controversial decision, continued to operate it for two weeks rather than shut it down, allowing thousands of images to be downloaded. While running the site, the bureau began to hack its visitors, sending malware that it called a “Network Investigative Technique” (NIT) to visitors’ computers. The malware was then used to identify users of the site. Ultimately, the FBI hacked into 8,000 devices located in 120 countries around the world. All of this hacking was done on the basis of a single warrant. The FBI charged hundreds of suspects who visited the website, several of whom are challenging the validity of the warrant.

In a filing today in one such case, U.S. v. Levin, EFF and the American Civil Liberties Union of Massachusetts urged the U.S. Court of Appeals for the First Circuit to rule that the warrant is invalid and the searches it authorized unconstitutional because the warrant lacked specifics about who was subject to search and what locations and specific devices should be searched. Because it was running the website, the government was already in possession of information about visitors and their computers. Rather than taking the necessary steps to obtain narrow search warrants using that specific information, the FBI instead sought a single, general warrant to authorize its massive hacking operation. The breadth of that warrant violated the Fourth Amendment.

“No one questions the need for the FBI to investigate serious crimes like child pornography. But even serious crimes can’t justify throwing out our basic constitutional principles. Here, on the basis of a single warrant, the FBI searched 8,000 computers located all over the world. If the FBI tried to get a single warrant to search 8,000 houses, such a request would unquestionably be denied. We can’t let unfamiliar technology and unsavory crimes lead to an erosion of everyone’s Fourth Amendment rights,” said EFF Senior Staff Attorney Mark Rumold.

EFF filed a brief in January in a similar case in the Eighth Circuit Court of Appeals, and will be filing briefs in Playpen cases in the Third and Tenth Circuits in March. Some trial courts have upheld the FBI’s actions in dangerous decisions that, if ultimately upheld, threaten to undermine individuals’ constitutional privacy protections over information on personal computers. 

“These cases will be cited for the future expansion of law enforcement hacking in domestic criminal investigations, and the precedent is likely to impact the digital privacy rights of all Internet users for years to come,” said Andrew Crocker, EFF Staff Attorney. “Recent changes to federal rules for issuing warrants may allow the government to hack into thousands of devices at a time. These devices can belong not just to suspected criminals but also to victims of botnets and other hacking crimes. For that reason, courts need to send a very clear message that vague search warrants that lack the required specifics about who and what is to be searched won’t be upheld.”

For the brief:
https://www.eff.org/document/us-v-levin-eff-amicus-brief

Washington, D.C. – On Thursday, February 2, at 9:30 am, the Electronic Frontier Foundation (EFF) and the law firms of Jones Day and Robins Kaplan will urge an appeals court to let an American continue his suit against the Ethiopian government for infecting his computer with custom spyware and monitoring his communications for weeks on end.

With the help of EFF and the Citizen Lab, the plaintiff in this case found Ethiopian government spyware on his personal computer in Maryland several years ago. Our investigation concluded that it was part of a systemic campaign by the Ethiopian government to spy on perceived opponents.

The plaintiff uses the pseudonym of Mr. Kidane in order to protect the safety and wellbeing of his family both in the United States and in Ethiopia. Kidane is a critic of the Ethiopian government, and came to the U.S. over 20 years ago, obtaining asylum and eventually citizenship. He currently lives with his family in Maryland.

Kidane first brought suit against Ethiopia in 2014, but the federal court held that no foreign government could be held accountable for wiretapping an American citizen in his own home, so Kidane appealed to the U.S Court of Appeals for the District of Columbia Circuit. Jones Day partner Richard Martinez will argue Thursday that foreign governments should not be allowed to spy on Americans in America with impunity.  

WHAT:
Kidane v. Ethiopia

WHEN:
Thursday, February 2
9:30 am

WHERE:
E. Barrett Prettyman U.S. Courthouse
333 Constitution Ave., NW
Washington, D.C.  20001
D.C. Circuit Courtroom 31

For more on Kidane v. Ethiopia:
https://www.eff.org/cases/kidane-v-ethiopia

Cincinnati—The Electronic Frontier Foundation (EFF) urged a federal appeals court to uphold a judge’s ruling that the identity of an anonymous blogger found to have infringed copyright should remain secret, arguing that courts must balance litigants’ needs to unmask online speakers against the First Amendment protections afforded to those relying on anonymity.

Maintaining one’s anonymity online may be warranted even in cases—like this one—where a court ruled that a blogger infringed a copyright, EFF said in an amicus brief filed with the U.S. Court of Appeal for the Sixth Circuit. The balancing test required by the First Amendment to protect speakers who choose to mask their identity must be applied at every stage of a lawsuit, including after a court finds an anonymous speaker violated the law, EFF said.

EFF believes Signature Management Team LLC v. John Doe marks the first case to consider whether speakers can remain anonymous even after a court rules that they broke the law.

“Plaintiffs don’t get to unmask anonymous bloggers just because they prove liability. The First Amendment requires that judges balance the need for anonymity against the needs of litigants at every stage of a lawsuit,” said Aaron Mackey, EFF Frank Stanton Legal Fellow. “Being able to speak online anonymously allows citizens to air dissenting views without fear of retaliation. Unmasking anonymous bloggers without proper justification can discourage people from speaking out or commenting online, which chills the free speech rights of all Americans.”

The plaintiff is a multi-level marketing (MLM) company that won a judgment against the owner of Amthrax.com, a website and blog that criticizes Amway and other MLM companies. The owner is a former Amway marketer who blogs anonymously. Signature Management sued John Doe for infringing the copyright of its book, which was posted on Amthrax.com.

After a judge ruled its copyright had been infringed, Signature Management sought a court order revealing the identity of John Doe, who feared he would face a slew of abusive comments and threats once his identity was known. The trial judge refused. In doing so, the judge correctly balanced the needs of the plaintiff with the First Amendment protections of the blogger.

For the brief:

https://www.eff.org/document/smt-v-doe-amicus-brief

San Francisco - The Electronic Frontier Foundation (EFF) today released Privacy Badger 2.0—a free browser extension for Chrome, Firefox, and Opera with new upgrades to help protect shoppers from online tracking.

“If you or your family does holiday shopping on the Internet, it’s likely that advertisers and other data collectors are learning a lot about you and the things you are interested in buying,” said EFF Staff Technologist Cooper Quintin, lead developer of Privacy Badger. “Privacy Badger 2.0 gives you more control over this data collection, spotting many of the sneaky trackers that follow you without your knowledge, and blocking them from transmitting information about you.”

Online trackers are embedded in images, scripts, or advertising on many webpages. Just visiting a page with a tracker can allow it collect a record of the page you are visiting and merge it with a database of what you visited before and after. One of the results of this tracking are the ads that seem to follow you around the web, reflecting your past browsing history. If Privacy Badger spots a tracker following you without your permission, it blocks all content from the tracker or screens out the tracking scripts or cookies.

Hundreds of thousands of users have already installed earlier releases of Privacy Badger. The new version allows you to import and export your data and preferences across browsers, allows for incognito mode, and has an improved experience with many more websites, along with many other upgrades.

“Neither you nor your loved ones should have to sacrifice your privacy to data miners in order to use the Internet,” said Quintin. “Installing Privacy Badger on your family’s computers is a practical and effective way to fight abuses in the online advertising industry, and make your family’s online experience safer and more secure.”

Privacy Badger works in tandem with the Do Not Track (DNT) policy. Users set the DNT flag in their browser settings or by installing Privacy Badger. Privacy Badger won’t block ads or third-party services that promise to honor all DNT requests.

For your free download of Privacy Badger:
https://www.eff.org/privacybadger

The Internet Archive published a formerly secret national security letter (NSL) today that includes misinformation about how to contest the accompanying gag order that demanded total secrecy about the request. As a result of the Archive’s challenge to the letter, the FBI has agreed to send clarifications about the law to potentially thousands of communications providers who have received NSLs in the last year and a half.

The NSL issued to the Archive said the library had the right to “make an annual challenge to the nondisclosure requirement.” But in 2015, Congress updated the law to allow for more than one request a year, so that communications providers could speak out about their experience without unneeded delay. Represented by the Electronic Frontier Foundation (EFF), the Archive informed the FBI that it did not have the information the agency was seeking and pointed out the legal error. The FBI agreed to drop the gag order in this case and allow the publication of the NSL.

“The free flow of information is at the heart of the Internet Archive’s work, but by using national security letters in conjunction with unconstitutional gag orders, the FBI is trying to keep us all in the dark,” said Brewster Kahle, founder and digital librarian of the Internet Archive. “Here, it’s even worse: that secrecy helped conceal that the FBI was giving all NSL recipients bad information about their rights. So we especially wanted to make this NSL public to give libraries and other institutions more information and help them protect their users from any improper FBI requests.”

The Archive received this NSL in August, more than a year after Congress changed the law to allow more gag order challenges. In its letter removing the gag order, the FBI acknowledged that it issued other NSLs that included the error, and stated that it will inform all recipients about the mistake. Given that the FBI has said that it issued about 13,000 NSLs last year, thousands of communications providers likely received the false information, and potentially delayed petitioning the court for the right to go public.

“The opaque NSL process—including the lack of oversight by a court—makes it very vulnerable to errors of law.  Add to that the routine use of gags and enforced secrecy, and those errors become difficult to find and correct,” said EFF Staff Attorney Andrew Crocker. “We are grateful to the Internet Archive for standing up to the FBI and shining some light on this error. We hope that others who receive the correction will also step forward to have their gags lifted and shine more light on these unconstitutional data collection tools.”

This is the second NSL that the Internet Archive has published after battling with the FBI. In 2007, the Archive received an NSL that exceeded the FBI’s authority to issue demands to libraries. With help from EFF and the American Civil Liberties Union (ACLU), the FBI withdrew the letter and agreed to let the Archive go public in May of 2008.

But many gag orders are still in place. Yesterday, CREDO Mobile confirmed it was at the center of EFF's long-running fight against NSLs after a three-year-old gag order was finally revoked. Along with CREDO's case, EFF is litigating two other challenges to NSL gag orders on behalf of communications providers who are still gagged.

For the national security letter published by the Internet Archive:
https://www.eff.org/document/national-security-letter-sent-internet-archive

For more on the fight against NSLs:
https://www.eff.org/deeplinks/2016/12/fighting-nsl-gag-orders-help-our-friends-credo-and-internet-archive

San Francisco - User reports of censorship of social media posts show a deep frustration with companies’ content moderation policies, according to an analysis by Onlinecensorship.org, a project of the Electronic Frontier Foundation (EFF) and Visualizing Impact.

In “Censorship in Context: Insights from Crowdsourced Data on Social Media Censorship,” researchers analyzed reports of content takedowns received from users of Facebook, Google+, Instagram, Twitter, and YouTube from April to November of 2016. At a time when many are asking for more content moderation—like calls for Facebook to crack down on “fake news”—election-related censorship complaints focused on the desire of users to speak their minds and share information about a tight election without worrying that their posts will disappear.

“Social media is where we receive news, debate, and organize. These companies have enormous impact on the public sphere, yet they are still private entities with the ability to curate the information we see and the information we don’t see at their sole discretion,” said Jillian C. York, EFF Director for International Freedom of Expression and co-founder of Onlinecensorship.org. “The user base is what powers these social media tools, yet users are feeling like they don’t have any control or understanding of the system.”

“Censorship in Context” recommends best practices for social media content moderation, including transparency in how company policies are enforced and any available remedies. The researchers also urge strengthening systems of redress when content is removed in error, and doing a better job of educating users about what is acceptable on a given platform and what isn’t.

“Many people depend on Facebook to talk to friends, family, clients, and fans, and to debate the issues of the day,” said Project Strategist Sarah Myers West. “While these companies have the right to set their own rules, the least they can do is to tell everyone how they’re enforced.”

Onlinecensorship.org was launched in November of 2015 to spot trends in content removals and learn how these takedowns impact different communities. The site also includes a guide to appealing a content takedown and hosts a collection of news reports on content moderation practices.

For the full whitepaper:
https://onlinecensorship.org/news-and-analysis/onlinecensorship-org-launches-second-report-censorship-in-context-pdf

Washington, D.C.—Cell phone location data, which can provide an incredibly detailed picture of people’s private lives, implicates our Fourth Amendment rights against unreasonable searches, requiring police to obtain a warrant to gain access, the Electronic Frontier Foundation (EFF) told the Supreme Court today.

Weighing in on separate cases where two courts have applied 1970s-era law to digital communications in the information age, EFF urged the nation’s highest court to step in and establish that Americans have the right to expect location data generated from their cell phones is private and protected by the Constitution against unreasonable searches and seizures.

Cell phones constantly connect to cell towers and antennas—which number in the hundreds of thousands—that handle traffic from an estimated 378 million U.S. cell phone accounts. The data generated about these connections, known as cell-site location information (CSLI), create a highly detailed picture of people’s private lives. We carry our cell phones when we leave our homes each day, when we walk into a therapist or lawyer’s office, visit a gun shop, attend a political meeting or sleep at a friend’s. Location information about these private activities is tracked and stored, for years, by cell service providers.

Defendants in U.S. v. Carpenter and U.S. v. Graham were convicted after police obtained, without warrants, hundreds of days of location data produced by their phones to connect them to crimes. The defendants maintained that the use of CSLI violated their Fourth Amendment rights. But the appeals courts in both cases followed Smith v. Maryland, a Supreme Court decision from 1979, when many Americans used rotary-dial land-line phones. In Smith, the Court said that people who voluntarily give certain information to third-parties—such as banks or the phone company—have no expectation of privacy in this information, and thus the government does not need a warrant to access it.

“Cell phone users don’t voluntarily provide location data to their providers—it happens automatically without their control and is generated whether or not the phone is being used,” said EFF Senior Staff Attorney Jennifer Lynch. “Other federal courts and judges in several states have recognized that the so-called ‘third party doctrine’ doesn’t apply to CSLI. It’s time for the Supreme Court to consider whether a decision it made before the existence of commercial cell phones, which are now ubiquitous and reveal our every move, can still be used to override Fourth Amendment protections.”

In 2014, the high court recognized in a unanimous ruling that the astounding amount of sensitive data stored on modern cell phones requires police to obtain a warrant before accessing data on an arrestee’s device. And in a landmark 2012 decision, the court held that GPS tracking is a search under the Fourth Amendment. Yet police are obtaining extensive historic cell-site information without warrants.

“CLSI can give law enforcement far more information about a person’s movement than GPS tracking—cell phones go everywhere their owners go,” said EFF Staff Attorney Andrew Crocker. “If GPS tracking implicates Americans’ Fourth Amendment rights, prolonged cell-site data collection—which provides sensitive details about where we went, who we met with, and what we did—should also be protected against warrantless searches. We’re asking the court to grant review of these important cases and address the Fourth Amendment privacy implications of CSLI.”

EFF filed identical petitions in U.S. v. Carpenter and U.S. v. Graham.

For the brief:
https://www.eff.org/document/eff-petition-graham-v-us

For more on these cases:
https://www.eff.org/cases/united-states-v-graham

Washington, D.C.—Ethiopia must be held accountable in the United States for an illegal malware and digital spying attack on an American citizen, the Electronic Frontier Foundation (EFF) told a federal appeals court today in a case where a foreign government claims it is immune from liability for wiretapping a man’s Skype calls.

Malicious digital surveillance and malware attacks against perceived political opponents, dissidents, and journalists have become all-too-common tactics used by governments with poor human rights records, such as Ethiopia, Kazakhstan, and Vietnam. When foreign governments carry out these digital attacks on Americans in their homes, violating our wiretapping and privacy laws, their victims must be allowed to take them to court, EFF and its co-counsels said in a filing at the U.S. Court of Appeals for the District of Columbia Circuit.

EFF, Robins Kaplan LLP, and Guernica 37: International Justice Chambers represent a Maryland man whose home computer was infected by state-sponsored malware known as FinSpy. The program recorded his private Skype calls, monitored his web searches and emails, and tracked his family’s use of the computer for weeks. Forensic analysis showed the information was surreptitiously sent to a secret server located in Ethiopia and controlled by the Ethiopian government. EFF’s client is an Ethiopian by birth who is a U.S. citizen and has worked with other members of the Ethiopian diaspora. The courts have allowed him to use the pseudonym Mr. Kidane to protect himself and his family from retaliation.

The spying program unleashed on Mr. Kidane was contained in an attachment to a Microsoft Word document that Mr. Kidane inadvertently opened. A government agent in Ethiopia planted the malware on the Word document, but the program to wiretap his conversations resided on his computer in Maryland and automatically began recording, with no one in Ethiopia having to pull the trigger.

The Ethiopian government, which hasn’t denied it wiretapped Mr. Kidane, won dismissal of a 2014 lawsuit after claiming it has immunity because the malware attack was initiated in Ethiopia and thus outside the reach of U.S. courts. It has made the absurd assertion that spyware—marketed to repressive regimes by companies like Gamma International and Hacking Team—gives countries the ability to invade Americans’ homes, wiretap their conversations, violate their privacy, and face no consequences.

“The court’s decision is out of step with the times and completely ignores how other laws treat computer attacks, allowing a prosecution or lawsuit to be brought where the attacked computer is. The appeals court should overturn this ruling and let Mr. Kidane have his day in court,” said EFF Executive Director Cindy Cohn, “Cybersecurity is one of the most important issues of our time, and when foreign governments invade Americans’ privacy, just as with foreign-based criminals, our laws must let victims like Mr. Kidane go to court to hold them accountable.”

If a foreign state’s agent had placed a recording device in Mr. Kidane’s home or on his telephone line, Mr. Kidane could indisputably sue the government in U.S. courts, said EFF Senior Staff Attorney Nate Cardozo. The fact that Ethiopia used software instead of a person to launch a wiretap attack against Kidane in no way allows the country to evade legal liability.

“Today, all governments have to do to illegally spy on people is purchase the right software,’’ said Cardozo. “The D.C. Circuit should recognize that the malware in this case took the place of a human spy, and reinstate Mr. Kidane’s lawsuit.”

“Giving Ethiopia immunity for state-sponsored hacking would strip away one of the few protections Americans have against cyberattacks by foreign powers,” said Scott Gilmore, counsel at Guernica 37. “The invasion of our client’s home, through his computer, could happen to any of us. We all should have the right to seek justice.”

For the brief:
https://www.eff.org/document/opening-brief-appellant-kidane-v-ethiopia

For more on Kidane v. Ethiopia:
https://www.eff.org/cases/kidane-v-ethiopia

San Francisco - An appeals court published redacted briefing by the Electronic Frontier Foundation (EFF) today arguing that national security letters (NSLs) and their accompanying gag orders violate the free speech rights of companies who want to keep their users informed about government surveillance.

EFF represents two service providers in challenging the NSL statutes in front of the United States Court of Appeals for the Ninth Circuit. Most of the proceedings have been sealed since the case began five years ago, but some redacted documents have been released after government approval.

“Just this week we’ve seen Open Whisper Systems—the company behind the Signal messaging service—successfully fight a government gag order attached to a subpoena for customer information. Meanwhile, Yahoo is facing criticism for allowing the government wide-ranging access to its users’ communications,” said EFF Staff Attorney Andrew Crocker. “Our clients want to join this conversation, using their own experiences as a basis to talk about what kind of government surveillance is appropriate and what reform is needed—but NSL gags prevent them from doing so. We’re asking the court to strike down this unconstitutional statute so we can have the robust and inclusive debate that this issue deserves.”

The NSL statutes have been highly controversial since their use was expanded under the USA PATRIOT Act. With an NSL, the FBI—on its own, and without court approval—can issue a secret letter to a communications provider, demanding information about its customers. In this case and nearly all others, the NSL is issued in conjunction with a gag order, preventing the companies from notifying users of the demand or discussing the letter at all. Congress changed some parts of the statute in 2015, but retained the basic elements of the gags. In fact, EFF’s clients still cannot identify themselves publicly or share their experiences as part of the debate over government surveillance of technology services.

“Our clients want to be able to issue accurate transparency reports and talk to their customers about how they try to defend users from overreaching government investigations,” Crocker said. “But instead, the FBI instituted indefinite gag orders to shield its demands for information. This is an unconstitutional restriction of our clients’ First Amendment rights.”

For the full redacted brief:
https://www.eff.org/document/16-16067-opening-brief-redacted

For more on national security letters:
https://www.eff.org/issues/national-security-letters

Washington, D.C.—The Electronic Frontier Foundation (EFF) asked a court Thursday for an order that would prevent the government from prosecuting its client, security researcher Matthew Green, for publishing a book about making computer systems more secure.  

Green is writing a book about methods of security research to recognize vulnerabilities in computer systems. This important work helps keep everyone safer by finding weaknesses in computer code running devices critical to our lives—electronic devices, cars, medical record systems, credit card processing, and ATM transactions. Green’s aim is to publish research that can be used to build more secure software.

But publishing the book, tentatively entitled Practical Cryptographic Engineering, could land Green in jail under an onerous and unconstitutional provision of copyright law. To identify security vulnerabilities in a device he has purchased, Green must work directly with copyrighted computer code, bypassing control measures meant to prevent the code from being accessed. Even though this kind of research is traditionally a “fair use” permitted by copyright law, Digital Millennium Copyright Act  (DMCA) Section 1201 threatens criminal and civil penalties— including jail time—for performing it or publishing information about the methods of security research. The exemptions Congress included in the 1998 DMCA to protect security researchers from prosecution are vague, limited, and provide inadequate assurance against the serious legal ramifications of Section 1201 lawsuits—something the government itself has acknowledged.

“Under Section 1201, computer researchers can face serious penalties just for selling a book that would help people build better, more secure computer systems,” said EFF Legal Director Corynne McSherry. “As we explained when we filed a legal challenge to the law in July, such penalties violate the First Amendment and threaten ordinary people for publishing research or even talking about circumventing computer code that’s embedded in nearly everything we own. With the lawsuit underway, we’re asking the court to bar the government from prosecuting Dr. Green so he can publish a book that’s clearly in the public interest.”

“If we want our communications and devices to be secure, we need to protect independent security researchers like Dr. Green,” said EFF Staff Attorney Kit Walsh. “Researchers should be encouraged to educate the public and the next generation of computer scientists. Instead, they are threatened by an unconstitutional law that has come unmoored from its original purpose of addressing copyright infringement. We’re going to court to protect everyone whose speech is squelched by this law, starting with Dr. Green and his book.”

EFF filed the Section 1201 lawsuit and Thursday's request for a court order with co-counsel Brian Willen, Stephen Gikow, and Lauren Gallo White of Wilson Sonsini Goodrich & Rosati.

For the motion for preliminary injunction:
https://www.eff.org/document/green-v-doj-motion-preliminary-injunction

For more about this case:
https://www.eff.org/cases/green-v-us-department-justice

Seattle, Washington—The Electronic Frontier Foundation (EFF) told a federal court today that the government is violating the U.S. Constitution when it fails to notify people that it has accessed or examined their private communications stored by Internet providers in the cloud. 

EFF is supporting Microsoft in its lawsuit challenging portions of the Electronic Communications Privacy Act (ECPA) that allow the Department of Justice (DOJ) to serve a warrant on the company to get access to customers’ emails and other information stored on remote servers—all without telling users their data is being searched or seized. In a brief filed in Microsoft v. Department of Justice in U.S. District Court in Seattle, EFF, joined by Access Now, New America’s Open Technology Institute, and legal scholar Jennifer Granick, said Fourth Amendment protections against unreasonable searches and seizures by the government apply to all of our information—no matter what the format or where it’s located.

“Whether the government has a warrant to rifle through our mail, safety deposit boxes, or emails stored in the cloud, it must notify people about the searches,” said EFF Senior Staff Attorney Lee Tien. “When electronic searches are done in secret, we lose our right to challenge the legality of law enforcement invasions of privacy. The Fourth Amendment doesn’t allow that, and it’s time for the government to step up and respect the Constitution.”

Microsoft sued DOJ earlier this year challenging ECPA provisions enacted 30 years ago, long before the emergence of ubiquitous cloud computing that now plays a vital role in the storage of private communications. The government has used the transition to cloud computing as an opening to conduct secret electronic investigations by serving search warrants on Internet service providers seeking users’ emails, the lawsuit says. The government, which wants the case thrown out, doesn’t let account holders know their data is being accessed because of the unconstitutional ECPA provision, while service providers like Microsoft are gagged from telling customers about the searches.

“When people kept personal letters in a desk drawer at home, they knew if that information was about to be searched because the police had to knock on their door and show a warrant,” said EFF Staff Attorney Sophia Cope. “The fact that today our private emails are kept on a server maintained by an Internet company doesn’t change the government’s obligations under the Fourth Amendment. The Constitution requires law enforcement to tell people they are the target of a search, which enables them to vindicate their rights and provides a free society with a crucial means of government accountability.” 

EFF thanks Seattle attorney Venkat Balasubramani of FocalLaw P.C. for his assistance as local counsel. 

For the brief:
https://www.eff.org/document/microsoft-v-justice-department-amicus-brief

About this case:
https://www.eff.org/cases/microsoft-v-department-justice

San Francisco - The Electronic Frontier Foundation (EFF) is pleased to announce the distinguished winners of the 2016 Pioneer Awards: Malkia Cyril of the Center for Media Justice, data protection activist Max Schrems, the authors of the “Keys Under Doormats” report that counters calls to break encryption, and the lawmakers behind CalECPA—a groundbreaking computer privacy law for Californians.

The award ceremony will be held the evening of September 21 at Delancey Street’s Town Hall Room in San Francisco. The keynote speaker is award-winning investigative journalist Julia Angwin, whose work on corporate invasions of privacy has uncovered the myriad ways companies collect and control personal information. Her recent articles have sought to hold algorithms accountable for the important decisions they make about our lives. Tickets are $65 for current EFF members, or $75 for non-members.  

Malkia A. Cyril is the founder and executive director of the Center for Media Justice and co-founder of the Media Action Grassroots Network, a national network of community-based organizations working to ensure racial and economic justice in a digital age. Cyril is one of few leaders of color in the movement for digital rights and freedom, and a leader in the Black Lives Matter Network—helping to bring important technical safeguards and surveillance countermeasures to people across the country who are fighting to reform systemic racism and violence in law enforcement. Cyril is also a prolific writer and public speaker on issues ranging from net neutrality to the communication rights of prisoners. Their comments have been featured in publications like Politico, Motherboard, and Essence Magazine, as well as three documentary films. Cyril is a Prime Movers fellow, a recipient of the 2012 Donald H. McGannon Award for work to advance the roles of women and people of color in the media reform movement, and won the 2015 Hugh Hefner 1st Amendment Award for framing net neutrality as a civil rights issue.

Max Schrems is a data protection activist, lawyer, and author whose lawsuits over U.S. companies’ handling of European Union citizens’ personal information have changed the face of international data privacy. Since 2011 he has worked on the enforcement of EU data protection law, arguing that untargeted wholesale spying by the U.S. government on Internet communications undermines the EU’s strict data protection standards. One lawsuit that reached the European Court of Justice led to the invalidation of the “Safe Harbor” agreement between the U.S. and the EU, forcing governments around the world to grapple with the conflict between U.S. government surveillance practices and the privacy rights of citizens around the world. Another legal challenge is a class action lawsuit with more than 25,000 members currently pending at the Austrian Supreme Court. Schrems is also the founder of “Europe v Facebook,” a group that pushes for social media privacy reform at Facebook and other companies, calling for data collection minimization, opt-in policies instead of opt-outs, and transparency in data collection.

The “Keys Under Doormats” report has been central to grounding the current encryption debates in scientific realities. Published in July of 2015, it emerged just as calls to break encryption with “backdoors” or other access points for law enforcement were becoming pervasive in Congress, but before the issue came into the global spotlight with the FBI’s efforts against Apple earlier this year. “Keys Under Doormats” both reviews the underlying technical considerations of the earlier encryption debate of the 1990s and examines the modern systems realities, creating a compelling, comprehensive, and scientifically grounded argument to protect and extend the availability of encrypted digital information and communications. The authors of the report are all security experts, building the case that weakening encryption for surveillance purposes could never allow for any truly secure digital transactions. The “Keys Under Doormats” authors are Harold Abelson, Ross Anderson, Steven M. Bellovin, Josh Benaloh, Matt Blaze, Whitfield Diffie, John Gilmore, Matthew Green, Susan Landau, Peter G. Neumann, Ronald L. Rivest, Jeffrey I. Schiller, Bruce Schneier, Michael Specter, and Daniel J. Weitzner. Work on the report was coordinated by the MIT Internet Policy Research Initiative.

CalECPA—the California Electronic Communications Privacy Act—is a landmark law that safeguards privacy and free speech rights. CalECPA requires that a California government entity gets a warrant to search electronic devices or compel access to any electronic information, like email, text messages, documents, metadata, and location information—whether stored on the electronic device itself or online in the “cloud.” CalECPA gave California the strongest digital privacy law in the nation and helps prevent abuses before they happen. In many states without this protection, police routinely claim the authority to search sensitive electronic information about who we are, where we go, and what we do—without a warrant. CalECPA was introduced by California State Senators Mark Leno (D-San Francisco) and Joel Anderson (R-Alpine), who both fought for years to get stronger digital privacy protections for Californians. Leno has been a champion of improved transportation, renewable energy, and equal rights for all, among many other issues. Anderson regularly works across party lines to protect consumer privacy in the digital world.

“We are honored to announce this year’s Pioneer Award winners, and to celebrate the work they have done to make communications private, safe, and secure,” said EFF Executive Director Cindy Cohn. “The Internet is an unprecedented tool for everything from activism to research to commerce, but it will only stay that way if everyone can trust their technology and the systems it relies on. With this group of pioneers, we are building a digital future we can all be proud of.”

Awarded every year since 1992, EFF’s Pioneer Awards recognize the leaders who are extending freedom and innovation on the electronic frontier. Previous honorees have included Aaron Swartz, Citizen Lab, Richard Stallman, and Anita Borg.

Sponsors of the 2016 Pioneer Awards include Adobe, Airbnb, Dropbox, Facebook, and O’Reilly Media.

To buy tickets to the Pioneer Awards:
https://www.eff.org/Pioneer2016

San Francisco—Journalists and political activists critical of Kazakhstan’s authoritarian government, along with their family members, lawyers, and associates, have been targets of an online phishing and malware campaign believed to be carried out on behalf of the government of Kazakhstan, according to a new report by the Electronic Frontier Foundation (EFF).

Malware was sent to Irina Petrushova and Alexander Petrushov, publishers of the independent newspaper Respublika, which was forced by the government of Kazakhstan to stop printing after years of exposing corruption but has continued to operate online. Also targeted are family members and attorneys of Mukhtar Ablyazov, co-founder and leader of opposition party Democratic Choice of Kazakhstan, as well as other prominent dissidents.

The campaign—which EFF has called “Operation Manul,” after endangered wild cats found in the grasslands of Kazakhstan—involved sending victims spearphishing emails that tried to trick them into opening documents which would covertly install surveillance software capable of recording keystrokes, recording through the webcam, and more. Some of the software used in the campaign is commercially available to anyone and sells for as little as $40 online.

Spearphishing emails and malware sent to members of the Ablyazov family while they were in exile in Italy may have helped track the whereabouts of Mukhtar Ablyazov’s wife and young daughter.  Despite having legal European resident permits, the two were taken into custody in Italy in 2013 and forcibly deported to Kazakhastan. Many targets of the malware campaign are also involved in litigation with the government of Kazakhstan, including the publishers of Respublika noted above. EFF represented Respublika in a U.S. lawsuit during the course of which the government has attempted to censor the site and discover Respublika’s confidential sources

Kazakhstan is a former Soviet republic that heavily restricts freedom of speech and assembly, and where torture is a serious problem, according to Human Rights Watch. The republic was ranked 160 out of 180 countries tracked by Reporters Without Borders for attacks on journalistic freedom and independence.

“The use of malware to spy on and intimidate dissidents beyond their borders is an increasingly common tactic employed by oppressive governments,” said Eva Galperin, Global Policy Analyst at EFF and one of the report’s authors. “As we have seen in places like Syria and Vietnam, journalists and political opposition leaders are being attacked in both the physical and digital worlds. Regimes are turning to covertly installed malware to track, harass, and silence those who seek to expose corruption and inform the public about human rights abuses—especially targets that have moved beyond the regime's sphere of control. Based on available evidence, we believe this campaign is likely to have been carried out on behalf of the government of Kazakhstan.”

EFF researchers, along with technologists at First Look Media and Amnesty International, examined data about suspected espionage groups and found overlaps between Operation Manul and Appin Security Group, an Indian company that has been linked with several other attack campaigns.

“Appin has been linked by cybersecurity firm Norman Shark to cyber-attacks against a Norwegian telecom company, Punjabi separatists, and others," said EFF Staff Technologist Cooper Quintin. “We found that some of the technology infrastructure used in those cyber attacks overlapped with the infrastructure used in Operation Manul. “

“Our research shows that such cheap, commercially available malware can have a real impact on vulnerable populations,” said Galperin. “Much of the past research in this area has exposed campaigns carried out by governments using spy software which they have purchased. In this case, the evidence suggests that the government of Kazakhstan hired a company to carry out the attacks on their behalf.”

For the report:
https://www.eff.org/files/2016/08/03/i-got-a-letter-from-the-government.pdf

Washington D.C.—The Electronic Frontier Foundation (EFF) sued the U.S. government today on behalf of technology creators and researchers to overturn onerous provisions of copyright law that violate the First Amendment.

EFF’s lawsuit, filed with co-counsel Brian Willen, Stephen Gikow, and Lauren Gallo White of Wilson Sonsini Goodrich & Rosati, challenges the anti-circumvention and anti-trafficking provisions of the 18-year-old Digital Millennium Copyright Act (DMCA). These provisions—contained in Section 1201 of the DMCA—make it unlawful for people to get around the software that restricts access to lawfully-purchased copyrighted material, such as films, songs, and the computer code that controls vehicles, devices, and appliances. This ban applies even where people want to make noninfringing fair uses of the materials they are accessing. 

Ostensibly enacted to fight music and movie piracy, Section 1201 has long served to restrict people’s ability to access, use, and even speak out about copyrighted materials—including the software that is increasingly embedded in everyday things. The law imposes a legal cloud over our rights to tinker with or repair the devices we own, to convert videos so that they can play on multiple platforms, remix a video, or conduct independent security research that would reveal dangerous security flaws in our computers, cars, and medical devices. It criminalizes the creation of tools to let people access and use those materials.

Copyright law is supposed to exist in harmony with the First Amendment. But the prospect of costly legal battles or criminal prosecution stymies creators, academics, inventors, and researchers. In the complaint filed today in U.S. District Court in Washington D.C., EFF argues that this violates their First Amendment right to freedom of expression.

“The creative process requires building on what has come before, and the First Amendment preserves our right to transform creative works to express a new message, and to research and talk about the computer code that controls so much of our world,” said EFF Staff Attorney Kit Walsh. “Section 1201 threatens ordinary people with financial ruin or even a prison sentence for exercising those freedoms, and that cannot stand.”

EFF is representing plaintiff Andrew “bunnie” Huang, a prominent computer scientist and inventor, and his company Alphamax LLC, where he is developing devices for editing digital video streams. Those products would enable people to make innovative uses of their paid video content, such as captioning a presidential debate with a running Twitter comment field or enabling remixes of high-definition video. But using or offering this technology could run afoul of Section 1201.

“Section 1201 prevents the act of creation from being spontaneous,’’ said Huang. “Nascent 1201-free ecosystems outside the U.S. are leading indicators of how far behind the next generations of Americans will be if we don’t end this DMCA censorship. I was born into a 1201-free world, and our future generations deserve that same freedom of thought and expression.”

EFF is also representing plaintiff Matthew Green, a computer security researcher at Johns Hopkins University who wants to make sure that we all can trust the devices that we count on to communicate, underpin our financial transactions, and secure our most private medical information. Despite this work being vital for all Americans' safety, Green had to seek an exemption from the Library of Congress last year for his security research.

“The government cannot broadly ban protected speech and then grant a government official excessive discretion to pick what speech will be permitted, particularly when the rulemaking process is so onerous,” said Walsh. “If future generations are going to be able to understand and control their own machines, and to participate fully in making rather than simply consuming culture, Section 1201 has to go.”

For the complaint:
https://www.eff.org/document/1201-complaint

San Francisco—The Electronic Frontier Foundation (EFF), the Tor Project, and dozens of other organizations are calling today on citizens and website operators to take action to block a new rule pushed by the U.S. Justice Department that would greatly expand the government’s ability to hack users’ computers and interfere with anonymity on the web.

EFF and over 40 partner organizations are holding a day of action for a new campaign—noglobalwarrants.org—to engage citizens about the dangers of Rule 41 and push U.S. lawmakers to oppose it. The process for updating these rules—which govern federal criminal court processes—was intended to deal exclusively with procedural issues. But this year a U.S. judicial committee approved changes in the rule that will expand judicial authority to grant warrants for government hacking.

“The government is attempting to use a process designed for procedural changes to expand its investigatory powers,” said EFF Activism Director Rainey Reitman. “Make no mistake: these changes to Rule 41 will result in a dramatic increase in government hacking. The government is trying to avoid scrutiny and sneak these new powers past the public and Congress through an obscure administrative process.”

Right now, Rule 41 only authorizes federal magistrate judges to issue warrants to conduct searches in the judicial district where the magistrate is located. The new Rule 41 would for the first time authorize magistrates to issue warrants when “technological means,” like Tor or virtual private networks (VPNs), are obscuring the location of a computer. In these circumstances, the rule changes would authorize warrants to remotely access, search, seize, or copy data on computers, wherever in the world they are located.

“Tor users worldwide could be affected by these new rules,” said Kate Krauss, Director of Public Policy and Communications for the Tor Project. “Tor is used by journalists, members of Congress, diplomats, and human rights activists who urgently need its protection to safeguard their privacy and security—but these rules will give the Justice Department new authority to snoop into their computers."

The changes to Rule 41 would also take the unprecedented step of allowing a court to issue a warrant to hack into the computers of innocent Internet users who are themselves victims of a botnet, EFF and its partners said in a letter to members of Congress today.

EFF and its partners launched noglobalwarrants.org, a campaign page outlining problems with the changes to Rule 41 and listing over 40 Internet companies, digital privacy providers, and public interest groups that support the project. The coalition is asking website owners to embed on their sites unique code that will display a banner allowing people to email members of Congress or sign a petition opposing Rule 41. The groups are also calling on citizens to speak out against Rule 41 on social media and blogs. The aim is to send a message to Congress that it should not authorize this expansion of government hacking and must reject Rule 41 changes.

For the coalition letter:
https://www.eff.org/document/rule-41-coalition-letter

For noglobalwarrants.org:
https://noglobalwarrants.org/

West Palm Beach, Florida—The Electronic Frontier Foundation (EFF) filed a lawsuit today against a well-known patent troll that tried to shake down a small business owner for tens of thousands of dollars on bogus claims of infringement on patents that were never used and were expired or invalid.

Defendant Shipping & Transit LLC has filed hundreds of lawsuits asserting frivolous patent infringement claims as part of its business model to intimidate and extort money from people, EFF alleged in a complaint filed with co-counsel Julie Turner of California-based Turner Boyd and Matthew Sarelson with Miami-based Kaplan Young & Moll Parrón. Shipping & Transit sends out letters accusing businesses of patent infringement and demanding thousands of dollars to license the patents or settle the matter. It then routinely sues those who don’t pay up to extort “nuisance value” settlements.

In a lawsuit filed in the U.S. District Court for the Southern District of Florida, EFF is representing Jason Cugle, who last year began running a small business selling accessories for electronic cigarettes. Cugle, a Maryland resident, received a letter accusing his company and website (Triple7vaping.com) of violating Shipping & Transit’s patents, which relate to ideas for monitoring and reporting the status of delivery vehicles. Cugle simply sent customer shipments through the U.S. Postal Service (USPS) and manually emailed each customer a message saying the package had been shipped and providing the USPS tracking number. Florida-based Shipping & Transit claims its patents cover a variety of methods of notifying people when a vehicle is about to reach its destination, including Cugle’s.

“The claims are absurd. Not only did three of the four patents expire two years before Mr. Cugle started his mail order business, they are not valid in the first place and he hasn’t infringed anything,” said EFF Staff Attorney Vera Ranieri. “What is worse, Shipping & Transit tried to force Mr. Cugle to sign a vaguely-worded affidavit swearing that he wasn’t using ‘monitoring systems’ and threatened him with a document that made it look like there was a lawsuit against him, though the complaint wasn’t filed in any court. These are the tactics of patent trolls who hope to intimidate and bully innocent people and businesses into paying them money to avoid the high costs of a lawsuit.”

Shipping & Transit used to be known as ArrivalStar, a notorious patent troll that sued towns and cities claiming that notifying citizens when a bus was due to arrive infringed its patents.

“Filing complaints in bad faith, asserting infringement of unenforceable patents, falsely accusing people of infringing, and abusing the court system to wrangle settlements out of people violate Maryland law,” said Ranieri. “We are asking the court to hold Shipping & Transit accountable for its improper tactics, and also rule that the patents aren’t valid and were not infringed. Shipping & Transit’s baseless patent infringement claims and shady tactics must be stopped.”

For the complaint:
https://www.eff.org/document/cugle-v-shipping-transit

San Francisco—On Tuesday and Wednesday, May 24-25, Electronic Frontier Foundation (EFF) Staff Attorney Kit Walsh and Senior Staff Attorney Mitch Stoltz will participate in public roundtable discussions about the impact of U.S. copyright law on freedoms to investigate and improve the software embedded in everyday products, devices, and appliances.

The discussions, being held at University of California Hastings College of the Law in San Francisco, are hosted by the U.S. Copyright Office, which is studying copyright issues related to the “Internet of Things” and the consequences of Section 1201 of the Digital Millennium Copyright Act (DMCA). Section 1201, while intended to prevent infringement of copyrighted media, has also blocked people from accessing software that controls everything from their mobile phones and video games to cars and insulin pumps.

Section 1201 was enacted to combat copyright infringement of digital works by making it unlawful to circumvent access controls on those works, such as the encryption on a DVD. Because of the broad definition of a copyrighted work, however, Section 1201 gives legal teeth to manufacturers who want to lock product owners out of the ability to tinker with, repair, or modify their own software-enabled devices. The restrictions have also prevented independent researchers from evaluating the software in cars and other devices for impacts on security, safety, privacy, and even the environment.

At the roundtable discussions, Walsh will speak about how overly-broad copyright restrictions on everyday products combine with one-sided end user license agreements to frustrate user freedom, research, and innovation. Stoltz will speak about Section 1201's overreaching restriction on circumventing technologies that control devices and products, and the burdensome, every-three-year procedure to get exemptions from Section 1201.

What:
U.S. Copyright Office Roundtables for Software-Enabled Computer Products and Section 1201 Studies

Who:
EFF Staff Attorney Kit Walsh
EFF Senor Staff Attorney Mitch Stoltz

When:
Tuesday, May 24, 9 am to 2:45 pm
Wednesday, May 25, 9 am to 4:15 pm

Where:
UC Hastings College of the Law
Alumni Reception Center
200 McAllister St.
San Francisco, CA 94102

Update: This hearing has been vacated. In an order issued late Tuesday, the judge asked for supplemental briefing from the parties. A new hearing date may be set once that briefing is complete.

San Francisco – On Thursday, May 19, at 10 am, the Electronic Frontier Foundation (EFF) will urge a federal judge to let the public see records about “Hemisphere,” a massive drug enforcement database containing decades of telephone metadata.

Reporters at the New York Times uncovered the Hemisphere program in 2013. Funded by the Drug Enforcement Agency (DEA) and the White House’s Office of National Drug Control Policy, Hemisphere places AT&T employees inside law enforcement agencies to facilitate quick access to call records data—including who called who, when, and how long they spoke—typically without any court oversight. The New York Times found that investigators were encouraged to keep Hemisphere “under the radar” by using “parallel subpoenas” and then “walling off” Hemisphere information from public scrutiny.

EFF filed a Freedom of Information Act (FOIA) request to learn more about the program and how it was used by law enforcement, but the government released only a small amount of heavily redacted records in response. At Thursday's hearing, EFF Senior Staff Attorney Adam Schwartz will argue that the government must stop misusing public records law to hide information about Hemisphere.

What:
Electronic Frontier Foundation v. Department of Justice

Who:
EFF Senior Staff Attorney Adam Schwartz

When:
10 am
Thursday, May 19

Where:
United States District Court
450 Golden Gate Avenue, 15th Floor, Courtroom B
San Francisco, CA

For more about Hemisphere and EFF’s FOIA lawsuit:
https://www.eff.org/cases/hemisphere

San Francisco - The “sharing” or “gig” economy is booming—you can get rides with companies like Uber, hire people to run errands with services like Taskrabbit, or find a place to stay on websites like Airbnb. These companies connect people offering services to people purchasing them, and in the process they have access to vast amounts of personal data. But how well do these companies protect your information from the government? The sixth annual “Who Has Your Back” report from the Electronic Frontier Foundation (EFF) surveyed the biggest providers in the gig economy to find out.

“These companies collect information on what you buy, where you sleep, and where you travel—whether you are offering services, or purchasing them,” said EFF Activism Director Rainey Reitman. “Often they go even further, collecting contents of communications and geolocation information from your cell phone. But are these companies respecting their users’ rights when the government comes knocking? For much of the gig economy, the answer is no.”

This year’s report analyzed ten companies, and only Uber and Lyft earned credit in all the categories we assessed, including transparency around government access requests, advocacy on the federal level for user privacy, and commitment to providing users with notice about law enforcement data requests. FlipKey, Airbnb, and Instacart also received stars in some categories, but Getaround, Postmates, Taskrabbit, Turo, and VRBO received no credit in any category.

“We see a clear trend in our report: while some sharing economy companies have prioritized standing up for user privacy in the face of government demands, many others have not,” said EFF Senior Staff Attorney Nate Cardozo. “This is a wake-up call to the gig economy companies and the people who use them. It’s time for these services to catch up with the rest of the industry and safeguard our data from government overreach—ensuring that law enforcement access to this trove of information is fair, just, and only in accordance with the rule of law.”

EFF has published its Who Has Your Back report—an annual overview of the public policies and practices of major technology and communications companies in response to law enforcement requests—for six years. While no company achieved credit in every category in the first report back in 2011, more than half of the companies got stars in four or five categories in 2015, and 23 of 24 followed industry best practices. As the first set of companies we looked at has improved so substantially, we decided it was time to turn to the sharing economy.

“Shifts in industry momentum can take time. It took several years before we saw widespread adoption of the best practices promoted in our first Who Has Your Back reports,” said EFF Deputy Executive Director Kurt Opsahl. “The users are the lifeblood of these companies, and next year’s report will provide them an opportunity to adopt best practices and stand up for the people who make their businesses work.”

For the full Who Has Your Back report:
https://www.eff.org/who-has-your-back-2016

San Francisco - A federal judge has unsealed her ruling that National Security Letter (NSL) provisions in federal law—as amended by the USA FREEDOM Act—don’t violate the Constitution. The ruling allows the FBI to continue to issue the letters with accompanying gag orders that silence anyone from disclosing they have received an NSL, often for years. The Electronic Frontier Foundation (EFF) represents two service providers in challenging the NSL statutes, who will appeal this decision to the United States Court of Appeals for the Ninth Circuit.

“Our heroic clients want to talk about the NSLs they received from the government, but they’ve been gagged—one of them since 2011,” said EFF Deputy Executive Director Kurt Opsahl. “This government silencing means the service providers cannot issue open and honest transparency reports and can’t share their experiences as part of the ongoing public debate over NSLs and their potential for abuse. Despite this setback, we will take this fight to the appeals court, again, to combat USA FREEDOM’s unconstitutional NSL provisions.”

This long-running battle started in 2011, after one of EFF’s clients challenged an NSL and the gag order it received. In 2013, U.S. District Court Judge Susan Illston issued a groundbreaking decision, ruling that the NSL power was unconstitutional. However, the government appealed, and the Ninth Circuit found that changes made by the USA FREEDOM Act passed by Congress last year required a new review by the District Court.

In the decision unsealed this week, the District Court found that the USA FREEDOM Act sufficiently addressed the facial constitutional problems with the NSL law. However, she also ruled that the FBI had failed to provide a sufficient justification for one of our client’s challenges to the NSLs. After reviewing the government’s justification, the court found no “reasonable likelihood that disclosure … would result in danger to the national security of the United States,” or other asserted dangers, and prohibited the government from enforcing that gag. However, the client still cannot identify itself because the court stayed this portion of the decision pending appeal.

“We are extremely disappointed that the superficial changes in the NSL statutes were determined to be good enough to meet the requirements of the First Amendment,” said EFF Staff Attorney Andrew Crocker. “NSL recipients still can be gagged at the FBI’s say-so, without any procedural protections, time limits or judicial oversight. This is a prior restraint on free speech, and it’s unconstitutional.”

The NSL statutes have been highly controversial since their use was expanded under the USA PATRIOT Act. With an NSL, the FBI—on its own, without any judge’s approval—can issue a secret letter to communications service providers, requiring the service to turn over subscriber and other basic non-content information about their customers. The gag orders that the FBI routinely issues along with an NSL have hampered discussion and debate about the process.

For the full unsealed order:
https://www.eff.org/document/redacted-order

For more on National Security Letters:
https://www.eff.org/issues/national-security-letters

Washington, D.C. - Content takedowns based on unfounded copyright claims are hurting online free expression, the Electronic Frontier Foundation (EFF) told the U.S. Copyright Office Friday, arguing that any reform of the Digital Millennium Copyright Act (DMCA) should focus on protecting Internet speech and creativity.

EFF’s written comments were filed as part of a series of studies on the effectiveness of the DMCA, begun by the Copyright Office this year. This round of public comments focuses on Section 512, which provides a notice-and-takedown process for addressing online copyright infringement, as well as “safe harbors” for Internet services that comply.

“One of the central questions of the study is whether the safe harbors are working as intended, and the answer is largely yes," said EFF Legal Director Corynne McSherry. “The safe harbors were supposed to give rightsholders streamlined tools to police infringement, and give service providers clear rules so they could avoid liability for the potentially infringing acts of their users. Without those safe harbors, the Internet as we know it simply wouldn’t exist, and our ability to create, innovate, and share ideas would suffer.”

As EFF also notes in its comments, however, the notice-and-takedown process is often abused. A recent report found that the notice-and-takedown system is riddled with errors, misuse, and overreach, leaving much legal and legitimate content offline. EFF’s comments describe numerous examples of bad takedowns, including many that seemed based on automated content filters employed by the major online content sharing services. In Friday’s comments, EFF outlined parameters endorsed by many public interest groups to rein in filtering technologies and protect users from unfounded blocks and takedowns.

“A significant swath of lawful speech is getting blocked from the Internet, just because it makes use of a copyrighted work,” said EFF Staff Attorney Kit Walsh. “The Internet needs fewer bad copyright claims—not more burdensome copyright laws—to protect speech.”

For EFF’s full comments to the copyright office:
https://www.eff.org/document/eff-512-study-comments

Riverside, California—The Electronic Frontier Foundation (EFF) and 46 technology industry experts, including inventors of modern cryptography, told a federal court today that forcing Apple to write and sign computer code disabling crucial iPhone security features that protect millions of users violates the company’s free speech rights.

The Federal Bureau of Investigation (FBI) should not be allowed to, in effect, stand over the shoulders of Apple programmers and force them to create and sign off on code that would decimate the iPhone’s security, EFF said. The signed code would send a clear message that it’s OK to undermine encryption that users rely on—a view the government endorses but Apple fiercely opposes. EFF made its arguments in a friend-of-the-court brief filed today in U.S. District Court for the Central District of California. The brief was signed by 46 technologists, security researchers, and cryptographers, including digital signature pioneers Martin Hellman and Ronald Rivest.

The phone at issue was used by a suspect in December’s San Bernardino mass shooting who was killed after the attack. A federal court issued a preliminary order that would require Apple to edit iOS to disable security features that protect the phone’s contents from surveillance, hackers, and thieves. The code must be digitally signed by Apple in order to run on the iPhone—a signature that guarantees the code is approved and endorsed by Apple.

“The court order is akin to the government dictating a letter endorsing backdoors and forcing Apple to sign its forgery-proof name at the bottom,’’ said EFF Civil Liberties Director David Greene.  “In our democracy, no one—not technology companies, coders, or average citizens—can be forced to write an article, carry a sign, post an update on Facebook or write and sign computer code that communicates or endorses a government idea that they don’t agree with. What the FBI asked the court to do violates free speech rights and puts the security and privacy of millions of people at risk. We are asking the court to throw out this dangerous and unconstitutional order.”

EFF has particular expertise in the First Amendment issues in this court battle, as it spearheaded cases in the early 1990s and 2000s leading courts to recognize computer code merited protection under the Constitution.  

A magistrate judge in Riverside, California, granted the FBI’s request under the All Writs Act—a statute that gives judges the ability to command an entity or person assist in the enforcement of an order, as long as it’s necessary and legal. But the order fails to meet that standard for many reasons, including that it violates Apple’s constitutionally guaranteed right against being compelled to speak for the government.

“Apple has said that it believes the best thing for the world is for all of us to have uncompromised security, not compromised security,” said EFF Executive Director Cindy Cohn. “What the FBI is demanding is that Apple publicly capitulate to the government’s views, and the fact that it would have to do so through writing and signing code makes no difference. This is far more than simply requiring Apple to turn over evidence that it has in its custody; this violates the First Amendment.”

For the full amicus brief:

https://www.eff.org/files/2016/03/03/16cm10sp_eff_apple_v_fbi_amicus_court_stamped.pdf

For more on this case:

https://www.eff.org/cases/apple-challenges-fbi-all-writs-act-order

San Francisco - The Electronic Frontier Foundation (EFF) and an international coalition of groups representing Internet users, consumers, and scholars are calling for reform of the negotiation of global trade agreements in order to protect Internet and other digital rights for communities around the world.

The “Brussels Declaration on Trade and the Internet” was signed by 20 groups and individuals concerned about secretive and closed trade negotiations, like the ones that were behind the Trans-Pacific Partnership agreement (TPP).  The TPP is now awaiting ratification from 12 countries but was under development for seven years before the completed text was released for the public to see. However, advisors for big corporations were allowed to view and comment on draft texts. As a result, TPP includes restrictive copyright enforcement regulations that will hurt free expression, innovation, and privacy on the Internet and elsewhere.

“We need an international trading system that is fair, sustainable, democratic, and accountable,” said EFF Global Policy Analyst Jeremy Malcolm. “But you can only achieve that result through public participation. The secrecy we’ve seen in the TPP and similar agreements locks out important views from the global digital rights community and other experts. That’s insight we need to make sure we are protecting rights for everyone around the world.”

The declaration makes six specific recommendations for countries participating in global trade agreements, including regular releases of draft proposals, ample opportunity for public comment and feedback, and engagement of organizations and experts representing Internet users and consumers.

“Digital policy must be shaped through open and participatory means,” said Steve Anderson from OpenMedia. “If trade agreements are going to impact Internet governance they must ensure effective participation from experts and the public.”

“Trade agreements like the Trans-Pacific Partnership are shaping complex aspects of Internet policy but Internet users have no insight into the negotiations," says Denelle Dixon-Thayer, Mozilla’s Chief Legal and Business Officer. "At Mozilla, we believe that when policy is not developed in the open, users lose as a result. We want to change that.”

The Brussels Declaration on Trade and the Internet stems from a meeting in Belgium earlier this year on catalyzing reform of trade negotiation processes. Experts from four continents took part.

For the Brussels Declaration on Trade and the Internet:
https://www.eff.org/files/2016/02/22/brussels_declaration.pdf

For more on the declaration and its importance:
https://www.eff.org/deeplinks/2016/02/global-alliance-condemns-internet-rulemaking-through-closed-trade-agreements

San Francisco - The Electronic Frontier Foundation (EFF) urged the Department of Education today to protect university students’ right to speak anonymously online, warning that curtailing anonymous speech as part of anti-harassment regulations would not only violate the Constitution but also jeopardize important on-campus activism.

“Battling gender and racial harassment and threats on college campuses is vitally important,” said EFF Legal Director Corynne McSherry. “But some are calling for blanket bans on the use of platforms that allow anonymous comments, and that’s a counterproductive strategy. Online anonymity is crucial for students who fear retaliation for their political and social commentary. It helps many people avoid being targets of harassment in the first place.”

EFF’s letter to the Department of Education comes after a number of groups pressed for new federal guidelines for fighting online harassment. EFF agrees with the majority of the recommendations, including ensuring prompt reporting and investigation of all reports of harassment, and disciplining and/or prosecuting perpetrators. However, preemptively removing access to anonymous online speech platforms violates all students’ First Amendment rights—threatening projects like the USG Girl Mafia at the University of Southern California, where students anonymously map locations of assault reports on campus. Anonymity was also essential for student activists at Guilford College in North Carolina, who used an online form to collect anonymous testimonials about racial violence from those who felt unsafe revealing their identities.

Additionally, online speech bans are problematic because any technical restriction—like blocking on-campus access through the university’s wireless network, or limiting where students can access particular mobile applications or websites—will not prevent any student from going off-campus or joining another wireless network to comment anonymously.

“The Internet has an unmatched ability to help groups of people organize and communicate and be a force for positive social change,” said EFF Frank Stanton Legal Fellow Aaron Mackey. “Taking away choices for anonymous speech will curtail these activities without meaningfully preventing illegal harassment and threats. We urge the Department of Education to find solutions that protect all students.”

For the full letter to the Department of Education:
https://www.eff.org/document/effs-letter-office-civil-rights