Motherboard TV documentary about Free Network Foundation. More information here.

Soldier at the 9/11 Memorial at the Pentagon.
Photograph by Matt McClain, The Washington Post/Getty Images.
Image credit: National Geographic

Being a sequence of quotations from contemporary articles contextualizing the visit of the rising Vice President of China amidst a conspicuously timed introduction of unprecedented domestic cybersecurity legislation.

National Post Full Comment (Feb 14) – “From bitter gruel, Xi Jinping to ascend to China’s top job” by Peter Goodspeed
http://fullcomment.nationalpost.com/2012/02/14/xi-jinping/

He arrives in Washington Tuesday on the first stop of a week-long tour of the United States in one of the final diplomatic rituals he must undergo before becoming China’s next leader.

Now vice-premier, Mr. Xi is widely expected to replace President Hu Jintao as secretary-general of the Chinese Communist Party in October, when China will change 60% of the members of the party’s Central Committee and replace seven of the nine members on the ruling Standing Committee of the Politburo.

By spring 2013, he should replace Mr. Hu as president, then become chairman of the Central Military Commission.

Meanwhile…

Hillicon Valley (Feb 13) – “Senate cybersecurity bill would let firms appeal Homeland Security regulations” by Gautham Nagesh
http://thehill.com/blogs/hillicon-valley/technology/210349-senate-cybersecurity-bill-would-let-firms-appeal-regulations

The legislation would task the Department of Homeland Security with determining which sectors of the economy would be covered by new cybersecurity regulations, after risk assessments in consultation with the private sector, the intelligence community and others.

But designated sectors would have the right to appeal whether the regulations apply to them. Several groups representing portions of the private sector considered part of the critical infrastructure have expressed concern about the impact of the regulations on both security and the bottom line.

“Passing the bill is crucial for national security, but not if the provisions on critical infrastructure regulation are watered down. This will be a real test for this Congress,” said James Lewis, senior fellow and director at the Center for Strategic and International Studies.

James A. Lewis is one of the star witnesses for the Senate Homeland Security and Governmental Affairs Committee’s hearing this Thursday on what has been termed “comprehensive” cybersecurity legislation being unveiled by Majority Chair Joe Lieberman and co-sponsor Minority Chair Susan Collins. Senator John (Jay) Rockefeller IV is the other primary co-sponsor, and will be the first witness at Thursday’s hearing.

Examples of sectors considered likely to fall under the new regulations are utilities, water treatment plants and transportation providers. Some sectors, such as major financial institutions and telecom providers, may ask for exemptions based on a demonstrated ability to secure their systems.

After determining which firms are critical infrastructure, DHS would then, in consultation with the private sector, determine cybersecurity performance requirements for firms in the covered sectors.

…

“There would be a huge market incentive for designated sectors to meet the security standards. But if they don’t DHS and the AG would decide on penalties,” said the spokesman.

What about international cybersecurity standards and practices?

WSJ (Jan 27) – “China’s Cyber Thievery is National Policy—And Must Be Challenged” by former NSA Director Mike McConnell, former Secretary of DHS Michael Chertoff, and former Deputy Secretary of Defense William Lynn.
http://online.wsj.com/article/SB10001424052970203718504577178832338032176.html
This appears to be a copy liberated from between the lines of Rupert Murdoch’s curious digital divide:
http://defense-technologynews.blogspot.com/2012/02/dtn-news-defense-intelligence-news.html

The bottom line is this: China has a massive, inexpensive work force ravenous for economic growth. It is much more efficient for the Chinese to steal innovations and intellectual property—the source code of advanced economies—than to incur the cost and time of creating their own. They turn those stolen ideas directly into production, creating products faster and cheaper than the U.S. and others.

Cyberspace is an ideal medium for stealing intellectual capital. Hackers can easily penetrate systems that transfer large amounts of data, while corporations and governments have a very hard time identifying specific perpetrators.

Stewart A. Baker, another witness for Thursday’s hearing, on the metaphorical wall isolating domestic and foreign intelligence gathering: “I thought that the civil liberties dangers it was supposed to ward off were probably more theoretical than real.”
http://www.skatingonstilts.com/skating-on-stilts/tired-of-reading-chapters-backwards.html

Continuing with the perspectives expressed in the WSJ:

The report to Congress notes that the U.S. intelligence community has improved its collaboration to better address cyber espionage in the military and national-security areas. Yet today’s legislative framework severely restricts us from fully addressing domestic economic espionage. The intelligence community must gain a stronger role in collecting and analyzing this economic data and making it available to appropriate government and commercial entities.

Congress and the administration must also create the means to actively force more information-sharing. While organizations (both in government and in the private sector) claim to share information, the opposite is usually the case, and this must be actively fixed.

National Journal (Feb 13) – “Feinstein Introduces Information-Sharing Bill Ahead Of Senate Cybersecurity Debate” by Josh Smith
http://techdailydose.nationaljournal.com/2012/02/feinstein-introduces-informati.php

Feinstein’s proposal would require the government to designate an agency as a “cybersecurity exchange” to coordinate information sharing; allow the government to share classified cybersecurity information with certain private-sector organizations; and provide liability protection for companies that share information.

“Alongside terrorism, cybersecurity is perhaps the number one threat facing our nation today, but many obstacles exist that prevent the cooperation and coordination needed to deter this growing threat,” Feinstein said in a statement.

NextGov (Feb 13) – “DHS budget would double cyber spending to $769 million” by Aliya Sternstein
http://www.nextgov.com/nextgov/ng_20120213_7454.php

There is bipartisan support for improving computer network defenses, so the outlook may be positive for obtaining much of the proposed $769 million from Congress. The funding would go toward the National Cyber Security Division for protecting federal networks and coordinating with the private sector on safeguarding critical infrastructure systems such as utility grids.

For perspective:

U.S. Department of Defense (Feb 13) – “DOD Releases Military Intelligence Program Requested Top Line Budget for Fiscal 2013″
http://www.defense.gov/releases/release.aspx?releaseid=15058

The Department of Defense released today the military intelligence program (MIP) requested top line budget for fiscal 2013. The total request, which includes both the base budget and Overseas Contingency Operations appropriations, is $19.2 billion.

The department determined that releasing this top line figure does not jeopardize any classified activities within the MIP. No other MIP budget figures or program details will be released, as they remain classified for national security reasons.

What is the mood of the Senate, and the posture towards the private sector?

United States Senate Democrats (Feb 9) – ‘[Senate Majority Leader Harry] Reid Outlines Process For Cybersecurity Legislation, Including “Fair and Open” Amendment Process [in letter to US Chamber of Commerce CEO Tom Donohue]‘:
http://democrats.senate.gov/2012/02/09/reid-outlines-process-for-cybersecurity-legislation-including-%E2%80%9Cfair-and-open%E2%80%9D-amendment-process/

I was struck by the testimony of the leaders of our Intelligence Community at recent Intelligence Committee hearings. Director of National Intelligence James Clapper called cyber security “a profound threat to this country, to its future, its economy, and its very being.” And Robert Mueller, Director of the Federal Bureau of Investigation (FBI), stated that, “stopping terrorist attacks with the FBI is the present number one priority, but down the road, the cyberthreat, which cuts across all programs, will be the number one threat to the country.” Think about that: in the years to come, malicious cyber activity will pose a threat to our country greater than terrorism. We simply cannot afford to repeat the mistakes of the past by failing to prepare for the leading threats of the future.

Yet, addressing cyber security is not simply a matter of staving off a future threat; it demands that we stop the hemorrhaging of national security secrets, intellectual property, and jobs already underway. In a recent letter to Senate Republican Leader McConnell and myself, eight former high-ranking national security officials led by Secretary of Homeland Security Michael Chertoff and Secretary of Defense William Perry pointed out that, not only are critical infrastructure such as power plants and hospitals at risk; moreover, “foreign states are waging sustained campaigns to gather American intellectual property – the core assets of our innovation economy – through cyber-enabled espionage.” They counseled that the “constant barrage of cyber assaults has inflicted severe damage to our national and economic security, as well as to the privacy of individual citizens. The threat is only going to get worse. Inaction is not an acceptable option.”

At this point, all signs indicate informed consensus for this legislation to pass quickly through Committee into an opportunity for debate culminating in passage through the Senate.

In closing, witness Stewart A. Baker from his text Skating on Stilts: Why We Aren’t Stopping Tomorrow’s Terrorism, (Stanford, California: Hoover Institution Press, 2010), p. 5-6.
http://www.skatingonstilts.com/skating-on-stilts/tired-of-reading-chapters-backwards.html

In the 1990s, after a term as the National Security Agency’s top lawyer, I spoke out in favor of keeping a wall between spies and cops. The idea was simple enough. Agencies like the National Security Agency (NSA) gathered intelligence on a global scale, and they rarely observed the legal constraints that applied to domestic policemen. To protect the civil liberties of Americans, it only made sense to separate intelligence gathered in that way from evidence assembled in a criminal investigation. With a wall between the two, criminal investigators from agencies like the Federal Bureau of Investigation (FBI) would be forced to observe the legal restrictions that went with criminal investigative tools. They wouldn’t be tempted to take the shortcut of using intelligence that had been gathered with less attention to civil liberties.

That was the theory, anyway. In practice, the wall crippled our last, best chance to catch the hijackers before September 11, 2001. In August of that year, the wall kept the FBI from launching a fullscale criminal search for the hijackers—even though all of our security agencies were expecting an imminent al Qaeda attack, and even though both the FBI and the Central Intelligence Agency (CIA) knew that two dangerous al Qaeda operatives had entered the United States. The failure to track those operatives down wasn’t a matter of incompetence or a failure to communicate, at least not in the last weeks. FBI criminal investigators spent the last part of August begging for a chance to track the terrorists. They were shut down cold—by lawyers who told them the wall simply could not be breached.

I wasn’t the most enthusiastic proponent of the wall. I thought that the civil liberties dangers it was supposed to ward off were probably more theoretical than real. But I saw no harm in building in an extra margin of protection for civil liberties. If nothing else, the wall would reassure privacy advocates in the courts, in the newspapers, and on Capitol Hill that intelligence would not be misused. It was insurance, not just for civil liberties, but for the intelligence agencies themselves. For both reasons, I thought, it was best to keep the wall high.

It made eminent sense inside the Beltway.

Until the world outside the Beltway broke through, just a few yards from where I’m standing.

Will the world outside the Beltway be heard in the composition of these new laws and during the creation of these new authorities? Are the new cyber sabers already rattling?

High-tech law enforcement under scrutiny

This post concludes EFF Austin’s investigation of DART’s #OpWardrive; here’s our initial post, announcement of operation cancellation, and update on the open records request.

In our last post, we summarized our inquiry into the City of Austin Police Department’s Digital Analysis Response Team’s (DART) Operation Wardrive, concluding that it was now up to the City to provide the documents responsive to our open records request which the Office of the Attorney General (OAG) declared were not exempt from disclosure. In a letter dated December 16th (notably well within the ten calendar day deadline initiated on December 13th), the City of Austin responded by postal mail with copies of the remaining documents.

Here’s the cover letter and documents:

Operation Wardrive Open Records Request – City of Austin Response – December 16, 2011

Included were two new documents: an “Operational Briefing” and a “Synopsis of Operation.” The operation objective is worth reproducing in full:

Operation Objective
Crack down on unsecured wireless networks in residential neighborhoods.

The Austin Police DART Unit plans to conduct a ‘wardriving’ mission around select Austin neighborhoods in an effort to educate its citizens to secure their wireless networks.

‘Wardriving’ refers to the technique of searching for unsecured wireless networks by driving the streets armed simply with a laptop or smartphone seeking network connections. When unsecured networks are found, the Police detectives will pay a friendly visit to the household or small business, informing them of the risks they are exposing themselves to and attempt to assist in securing their wireless network.

The Synopsis provides a little additional information:

Detectives should log the locations where they have made contact with residents and identify them on provided activity sheet.

There are a few items worth emphasizing here:

1. EFF Austin requested “All documents and communications related to the selection and identification of Austin locations, neighborhoods, and/or individual citizens that will be targeted by ‘Operation Wardrive’”. The Briefing specifies target locations as “Austin Neighborhoods,” while the objective mentions “select Austin neighborhoods.” We are left to presume the neighborhoods selected would be left to the recognizance of DART detectives or decided and communicated off-the-record, perhaps during the 30-minute briefing on September 22nd prior to the operation.
2. EFF Austin requested “All documents and communications related to the devices, software, and other technologies that will be utilized to identify Austin locations with unencrypted broadband networks.” The Briefing indicates wardriving may be practiced “simply with a laptop or smartphone seeking network connections” but does not explicitly declare this as the tools or techniques DART would be deploying.
3. EFF Austin requested “All documents and communications related to the policies governing the protection and security of the information obtained during ‘Operation Wardrive’”. The Synopsis instructs detectives to log the names and addresses of individual citizens they paid “friendly visit[s]” to, thus creating public records of open wireless access points – one of EFF Austin’s original concerns.
4. Perhaps most revealingly, EFF Austin requested “All documents and communications related to The City of Austin’s, Austin Police Department’s, the Digital Analysis Response Team’s, or other Austin governmental agency’s recommendations and/or suggested practices for securing wireless broadband networks.” We did not receive a single document, nor can we find a single sentence responsive to this inquiry, leaving one to ask: how could DART “Crack down on unsecured wireless networks in residential neighborhoods” if the City of Austin was unable to locate a single document explaining how citizens or detectives are supposed to go about securing those networks?

Perhaps DART detectives have received special training towards that end…

Standard Operating Procedures

The last document included in the City’s response was an unredacted version of the APD DART Standard Operating Procedures (SOP), available in the embed above. The City provided EFF Austin with a redacted version of the SOP while appealing to the Office of the Attorney General, insisting that disclosure might interfere with law enforcement and crime prevention efforts. The OAG disagreed, forcing the City to release the complete document. It is an interesting read we encourage you to review, revealing the marching orders of one of the most venerable computer forensics and cybercrime prevention units in the country.

Within the previously censored sections of the document, EFF Austin found an item that might be worth further exploration.

The duties of the Sergeant of DART, the ranking officer of what appears to be a team of five detectives, are described in section .05.C.1 under “Personnel Duties, Authority, and Responsibilities.” Item “aa” on page 5 states:

Act as unit coordinator with the Austin Metro High Tech Foundation (AMHTF) Board of Directors:

1. Prepare annual budget for December meeting which projects anticipated expenditures of the AMHTF monies over the upcoming calendar year.
2. Supervise expenditures of these budgeted monies over the budget year and authorize all expenditures from these monies.
3. Prepare annual reports for the board of directors meetings itemizing budgeted expenditures for the previous year.
4. Prepare reimbursement request(s) for the AMHTF, as needed, to recover monies from authorized expenditures. Provide a receipt for all items in the reimbursement request.
5. Authorize disbursements from and provide accounting on the travel and training fund provided by the AMHTF.

What is the Austin Metro High Tech Foundation? Some historical perspective can be found at what appears to be the Foundation’s most recent website, a lonely Geocities relic worthy of review for its quirky mid-90′s Internet aesthetic alone. Quoting from the site:

The Austin Metro High Tech Foundation (AMHTF) is an organization founded by local companies and law enforcement personnel to battle high-tech crime in the Austin Metro area. The Foundation began in mid-1994, when seven area security managers decided to join with local law enforcement to form a policing unit dedicated to investigating high-tech crimes.

Since 1994, the Foundation membership has grown, along with the expertise of the law enforcement personnel assigned to high-tech crimes.

And what does the Foundation do – or rather what did the Foundation do at this time?

Foundation members provide funds, training and in-kind donations to support the law enforcement community’s high-tech crime efforts. The funds are used for education, equipment and travel required by law enforcement personnel. The benefit to members is the increase in prosecutions and restitution associated with high-tech crimes.

This 1999 LA Times story (“Tech Firms Pay Police Agencies to Fight Cyber Crime”) mentions the Austin foundation, and its byline (“Law enforcement: Intel funds sheriff’s unit that chases computer pirates. Some fear conflict of interest.”) hints at reasons why AMHTF may opt for a low profile.

This is not to say funding from the Foundation is without cause or merit; from the article:

When losses mounted from armed robberies at computer chip plants in Austin in the early ’90s, the city’s high-tech companies decided to finance a private nonprofit group to train officers to deal with the problem. Through the Austin Metro High Tech Foundation, firms including IBM and Dell Computer Corp. annually donate up to $10,000 each for investigators’ training, travel and equipment.

In return, businesses–including Applied Micro Devices, National Instruments and Motorola Corp.–say they expect law enforcement to treat computer crime as seriously as drugs and gang violence.

In 1999, according to the article’s author, public sentiment was decidedly mixed on the appropriateness of private corporations funding specific law enforcement efforts narrowly focused on crime prevention within their business sector. Is that the cause for AMHTF deciding to assume a low public profile? Is that the reason why public servants of the City of Austin attempted to perpetuate the Foundation’s low profile through selective application of the secrecy attendant on the darkness of redaction?

In the cleansing sunlight, perhaps we’ll see.

Official seal of the Office of the Attorney General of Texas

In late September, the Austin Police Department (APD) aimed to identify open residential wireless access points around the city and educate their owners about the risks of providing free Internet access. The initiative, dubbed Operation Wardrive, was announced by an APD Public Information Office press release which was quickly picked up by local ABC-affiliate KVUE. Word circulated throughout the community and back to local officials, who quashed the nascent effort by APD’s Digital Analysis Response Unit (DART) prior to deployment. It remains uncertain whether the project will be restarted.

One facet of the community response to #OpWardrive was an open records request filed by EFF Austin with the City of Austin’s Communications and Public Information Office on September 21st. We made ten distinct requests for information, ranging from details about the inception and planning of the initiative, to the technologies and techniques DART intended to employ to reliably associate an omnidirectional access point signal with a particular residence in a densely populated metropolitan area.

Why did we make these requests? If the Austin Police Department gathers data about open wireless access points operated by local citizens and organizations, we think it’s important to have a full and complete understanding of both intention and process. How will this data be used? Where will it be stored? Will it be retained and mapped? Is there a surveillance aspect to this activity? IF this activity is limited in scope, as suggested by one email we acquired suggesting that the wardrive would be only one time for a few hours, what is the target area, and why was it selected?

As compared to other states, Texas has admirable Open Records laws defined in Chapter 552 of the Texas Government Code. Conforming with § 552.301(b), the City of Austin (CoA) responded to our request on October 5th (within 10 business days) providing a handful of documents responsive to our inquiry while simultaneously requesting a decision from the Office of the Attorney General (OAG) on the disclosure of additional records.

Operation Wardrive Open Records Request – City of Austin Response (Oct 5, 2011) – Letters

The documents withheld are alleged to fall under the protection of the attorney-client privilege (§ 552.107(1)) or potentially interfere with law enforcement and crime prevention efforts (§ 552.108(b)(1)). The documents provided to EFF Austin included emails discussing the Operation Wardrive press release and a heavily redacted document detailing APD DART’s Standard Operating Procedures (SOP).

Operation Wardrive Open Records Request – City of Austin Response (Oct 5, 2011) – Records

The Texas Attorney General had 45 business days to issue a ruling on the CoA’s request, and dutifully responded on December 13th (EFF Austin opted not to exercise its right to comment in support of the release of the requested materials as described in § 552.304). The Office of the Attorney General concurred with the City of Austin concerning records protected by attorney-client privilege, but did not entirely agree with the assertion that the remaining documents could be withheld for fear of disrupting law enforcement efforts. The remaining documents include an “operational briefing” and the redacted sections of the SOP (with the exception of the cellular phone numbers of DART detectives, which are wisely protected pursuant to Open Records Decision 506 at 2 (1988)).

Operation Wardrive Open Records Request – Attorney General Response (Dec 13, 2011)

The City of Austin now has ten calendar days to either provide the requested information or access to it, or contest the OAG’s decision in court. We’ll post updates as the story unfolds.

The Joy of Tech #354 - They always dreamed of having a home in the range

On Wednesday September 21st, EFF Austin [ @EFFaustin ] was notified about the Austin Police Department’s (APD) Digital Analysis Response Team’s [ DART, @APDDART ] “Operation Wardrive” [ #OpWardrive ] via the KVUE [ @KVUE ] news article that originally appeared at the following URI (it’s relatively common for journalism operations to reuse the same URI to track stories as they develop, sometimes redirecting to new articles):
http://www.kvue.com/news/local/APD-conductiong-Operation-Warfare-to-keep-internet-users-safe-130218768.html

For reference, the text of the original KVUE article is cited in EFF Austin’s response.

Beginning with KVUE’s article, which appears to have been the only source of information and perspective on APD’s intent, a largely uncoordinated but similarly informed collective action took place across multiple points of interface and communication with APD and the Austin City Council [ @AustinTexasGov, #ATXCouncil ]. This seems to have ensured that officials and decision makers in a position to intervene were made aware of public sentiment in a timely manner. Sufficient public concern was observed to motivate officials towards action.

There is uncertainty about whether “Operation Wardrive” has been canceled or postponed, as reflected in this sequence of tweets from KVUE’s account on Thursday morning.

@KVUE (Thu Sep 22 10:23am, 10:20am, 9:30am CST)

APD Chief of Police Art Acevedo is more clear in his email response (Thu Sep 22 10:13:55am CST) to Austinite Mark Boyden‘s thoughtful email addressed to all Austin City Council members, several local activists, Acevedo, and APD Public Information Office Manager Anna Sabana.

Thank you for sharing your concerns with me. This WarDrive idea was not approved by APD Executive Staff and in fact has been disapproved. We will be releasing a statement later today. Although the involved unit’s intent was noble (educating the public about the risks to your personal information), a PSA or other educational effort would be much more effective. To place you further at ease, the idea was killed before actual implementation.

The APD Public Information Office did not publish a formal statement on Thursday via APD News Releases nor the City of Austin Communications and Public Information Office.

KVUE’s Shelton Green [ @SheltonG_KVUE, bio, email ] reached out to EFF Austin seeking our perspective for a follow-up story. EFF Austin President Jon Lebkowsky [ @jonl, wikipedia, homepage ] sat for that interview, which was crafted into the following story, which led the news on KVUE last night (Thu Sep 22 10:00pm).

What’s Next?

As Shelton Green mentions at the end of the story, EFF Austin would like to work with the Austin Police Department Digital Analysis Response Team to craft a winning public education campaign on the risks as well as the virtues of operating an open, publicly-accessible wireless access point. We’ve begun to compile information and gather existing recommendations in this space (if you have sources, please add as a comment or mention to @EFFaustin with hashtag #OpWardrive).

EFF Austin has also decided to continue with our Texas Public Information Act Open Records request. We expect to receive an assessment of the viability of each of our 10 specific inquiries along with an estimate of fees we must pay to have the records processed.

Yesterday, some members of the EFF Austin Board of Directors were frankly shocked by the arrival of an unsolicited $10 donation. I had forgotten we even have a Paypal account. But it made us feel good, and reminded us that we are embarking on a path which will have attendant fees and expenses. We would like to help serve the public interest by walking that path, and would therefore like to ask if you can help support our efforts. If you like what we’re doing, please consider donating (we’re a nonprofit) to help us defray approaching expenses. There’s a Paypal donate button at the upper right of this page.

We believe in transparency and sunlight’s powers of disinfection. EFF Austin will provide transparency into our expenses and you can be sure we will sing praises to our supporters for their role in helping us act. Thank you.

If you’d like to get more involved, consider following us on Twitter, liking us on Facebook, joining our interesting email discussion list, or coming to our next meetup.

Open Wireless Access Points - security threat?

Update (Sep 22 @ 1:07pm) – The Austin Police Department has decided to cancel Operation Wardrive and focus on the public education facet of this work. See Mark Boyden’s comment, an email response from APD Chief Art Acevedo. Thanks go to Scott Henson at Grits For Breakfast for his attention to this matter.

Yesterday (September 20th @ 2:46pm CST), KVUE News published an article relaying the Austin Police Department‘s intention to identify open residential wireless access points (WAPs) throughout the city.

Police will soon conduct an operation to find open wireless Internet connections in the city.

The APD Digital Analysis Response Team, or DART, will hold “Operation Wardrive” Thursday, Sept. 22. DART unit members will make contact with residents who have open wireless connections and teach them the importance of securing them.

This raises a number of immediate questions, perhaps the most simplistic and potentially revealing being simply: “why?” The answer to that question appears to be the same answer provided for lots of questions lately: safety.

From the article:

Leaving your wireless network open invites a number of problems:

• You may exceed the number of connections permitted by your Internet service provider.
• Users piggy-backing on your internet connection might use up your bandwidth and slow your connection.
• Users piggy-backing on your internet connection might engage in illegal activity that will be traced to you.
• Malicious users may be able to monitor your Internet activity and steal passwords and other sensitive information.
• Malicious users may be able to access files on your computer, install spyware and other malicious programs, or take control of your computer.

The EFF Austin Board of Directors finds nothing wrong with this analysis of the potential risks Internet users undertake when intentionally or unintentionally leaving their wireless access points open for shared use. In fact, we could cite a few more. However, these are much the same risks that Internet users undertake when using ANY shared wireless access point, such as those provided by cafés, public parks, or the Austin Public Library.

Missing from the cited analysis is any recognition of potential benefits to be gained from publicly sharing one’s wireless access point. Lately, the virtues of contributing to any shared commons tends to be overshadowed by fears of bad actors (both real and imagined). For some facts, it’s worth reviewing cryptographer and computer security specialist Bruce Schneier‘s discussion on the virtues and risks of running an open wireless network.

More importantly, missing from the cited analysis is any recognition of the unintended consequences of APD collecting this information. The Austin Police Department is a public agency and is thus subject to the Texas Public Information Act (TPIA), Chapter 552 of the Texas Government Code, which guarantees the public’s access to information in the custody of government agencies. As a result of undertaking “Operation Wardrive” the records generated by that operation are subject to open records requests. That information is potentially valuable to perpetrators interested in undertaking the kind of malfeasance outlined in the KVUE article.

The EFF Austin Board is not interested in this data beyond knowing what is collected and why. We are more interested in the provenance of this Austin Police Department operation, and doing what we can to help APD increase public education about the virtues and risks of running an open wireless access point. To that end, we have decided to file an Open Records request today seeking information on this operation.

“Operation Wardrive” Open Records Request (Sep 21, 2011)

Earlier: BART’s Protest Position Does Not Withstand Legal Scrutiny

Thanks to everyone who came out last month to hear Jon Lebkowsky [ @JonL ] guide us through and to the past and future Internet.

This month, we’ll be hearing former EFF Austin Board member Michael Hathaway present information from the world of modernizing electric utilities and the regulatory bodies that love them in a talk entitled “Smart Grid and the Internet.” Here’s the summary:

Michael Hathaway, CEO of Tiga Energy Services, Inc, www.tigaenergy.com, will share his unique and controversial perspective on the Smart Grid as it mirrors the evolution of the Internet.

He will outline the similarities between these two industries, explore lessons learned from the Internet and ponder the various scenarios for Smart Grid ranging from it transforming our lives to becoming a dot-com bubble.

This will not be a conventional industry overview of the Smart Grid, so bring an open mind and lots of questions!

Michael Hathaway is a technology executive whose career spans the the early days of digital audio, the broadband & multimedia revolution, to the rapid evolution of the energy industry occurring today. He currently heads up Tiga Energy Services, a network communications and cyber security firm that serves the energy industry.

Michael is always an engaging and passionately rational speaker and conversationalist. It’ll be a good talk and we’re all sure to learn.

We meet on First Wednesdays at The Flying Saucer [ @FlyingSaucerAus ] from 7-9pm. So that puts us on Wednesday September 7th. Parking is available on the surface lots, in the garages, and in the field adjacent to the SFC Farmer’s Market, which takes place every Wednesday in the commons field. We’re in the reserved room in the back right corner as you walk into the Saucer. We’re raising bandwidth issues with Flying Saucer, so for now bring your wireless access device of choice if you got em; any less pressure on the network infrastructure helps. And we have our own VGA cable this time to avoid that “everything is yellow” jaundiced-effect. Power strips will be available on side tables.

Map

When: 7PM Wednesday, September 7th, 2011
Where: Flying Saucer, 815 W 47th St at the Triangle.
Hashtag: #EFFatx

You can also sign up for the event on the Facebook. Like us if you do.

Trouble up and down the line for BART

Before beginning, it’s worth stating that EFF-Austin [ @EFFaustin ] is based in…well, Austin. Our statements have no association with national EFF [ @EFF ], based in San Francisco, beyond the principles we share (see here for details on that history if you’re interested; our hearts go out to you guys during this challenge, you have our support). As such, EFF-Austin’s analysis is restricted to online sources and documents.

That analysis has revealed a discrepancy in the first public statement made by Lynette Sweet, a Director on BART’s board, in the wake of BART’s shutdown of cellphone and 911 service for passengers last Thursday between 4-7pm PST at least between the Civic Center and Embarcadero stations. Sweet provided an interview to San Francisco’s CBS affiliate KCBS in which she roundly condemned BART’s action. The statement that interested us occurs at the beginning of the interview (audio excerpt below):

“The BART board was alerted just a few hours before they planned to do this without having it as an agenda item. We really couldn’t talk much about it.”

That directed us to the Agenda for the board meeting in question, available on the BART website. That meeting was scheduled to begin at 9AM PST on Thursday August 11th. The cellphone shutdown occurred at 4pm PST that very same day.

#BART – Board Meeting (August 11, 2011) – Agenda

According to this version of the document, there is in fact a relevant agenda item listed on page 3:

10. CLOSED SESSION (Room 303, Board Conference Room)
A. THREAT TO PUBLIC SERVICES OR FACILITIES:
Consultation with: Chief of Police; Acting Manager, Rail Security
Programs; and Assistant General Manager – Operations
Government Code Section: 54957(a)

That’s some important information.

BART board meetings are scheduled in advance and a “Notice of Meetings” is sent out, sometimes with attachments. A notice for Thursday’s BART board meeting was sent out on August 5th, and included the agenda as an attachment. Here’s that notice:

San Francisco Bay Area Rapid Transit District – Notice of Meetings (Aug 5, 2011)

So, the agenda for Thursday’s BART board meeting—which includes reservation of a closed session timeslot for discussion of “THREAT TO PUBLIC SERVICES OR FACILITIES”—was ready to go by August 5th. Our analysis of the metadata embedded in the agenda document confirms this.

• Document Author: Pat Williams (would love to chat!)
• xap:CreatorTool: Microsoft Word 2007
• Document Last Modified: 8/5/11 6:46:45pm

If this document is to be believed then a timeslot was reserved for a closed session with the board fully six days prior to the event. It’s important to emphasize that this does NOT necessarily mean that the subject matter of that meeting was determined in advance (I guess it’s equally important to emphasize it might mean just that!). At a minimum, it signifies awareness that a meeting might be necessary. That’s an important item to keep in mind as questions swirl about whether the BART board COULD have had time to deliberate a formal policy decision.

By now you might be wondering, as we were, about the people who participated in the meeting and what their responsibilities are. With a little help from the index of BART Job Descriptions and Google, we were able to identify these folks for future reference:

Kenton W. Rainey, BART Police Chief
Image credit: Oakland North - A new chief for the BART police seeks to heal community ties

• BART Chief of Police: Kenton W. Rainey
  • Job Description (Word document)

Sgt. Eugene Wong, left, and Sgt. Kevin Franklin patrol a San Francisco BART line.
Chronicle photo by Frederic Larson.
Image credit: SFGate (October 23, 2004)

• BART Acting Manager, Rail Security Program: Kevin Franklin
  • Job Description (Word document)
  • Confirmed via “Point of View” Volume 39, Number 2 (April 2011), p. 29. See “Transfers from Patrol”.
  • Reports to the General Manager.
  • For historical context, Franklin was present at the BART police shooting of Oscar Grant on New Year’s Day 2009.
  • Earlier in his career (October 2004), Franklin was part of a series of controversial “high-profile” patrols on BART trains “carrying assault rifles and gas masks and clad in SWAT uniforms”.

Paul Oversier (far left) at the BART Police Department Review (November 11, 2009)
Image credit: Indybay

• BART Assistant General Manager – Operations: Paul Oversier
  • Job Description (Word document)
  • Confirmed via @SFAppeal (April 14) – “BART Hires Sherwood Wakeman as Interim General Manager”
  • Reports to General Manager; elsewhere described as ‘second in command.’

A few things seem clear to your observers from Texas. It seems like the BART Board has been having its own internal trouble for quite some time. And it seems like there is an adversarial relationship between the board and other parts of the BART organization. And it seems like the BART system in general is in trouble both financially and in terms of customer satisfaction; their biannual customer satisfaction survey (p. 16) indicates “40 out of 47 ratings (85%) of specific service attributes were lower in 2010 compared to 2008.” And it seems like BART just keeps digging the hole deeper, such as with this over produced video—completed overnight on Thursday August 11 in time for publication to YouTube and promotion by 8:38am PST Friday morning—which could be characterized as a “preemptive strike” seeking to justify BART’s actions on Thursday night:

Unless BART gets their act together, and stops taking an adversarial stance to world opinion, this debacle could truly result in greater formally codified civil liberties for Americans as an example for the rest of the world to follow. But I guess that’s what America is supposed to be all about, right?

I present BART with these questions three, answer rite we might forgive ye:

1. When did the cellphone shutdown option become the subject of the timeslot reserved sometime before Friday August 5th, 2011 at 6:46:45pm PST?
2. When was the cellphone shutdown option conceived?
3. Why wasn’t the BART board of directors notified of the cellphone shutdown option some time  between  times A and B?

Thank you, and help us do the right thing now, BART.

Next: BART’s Protest Position Does Not Withstand Legal Scrutiny
Earlier: Statement on San Francisco BART cellphone service shutdown

Repressive foreign governments – in China, Egypt, Iran and Syria, to name just a few – have cut off communications (the Internet, mobile service and landline) as a means to repress dissent or expressive acts the regime deems inconvenient. Often, the repressive regime asserts that silencing their citizens was necessary to maintain the peace, or prevent damage to property. US authorities have been quick to condemn this denial of free speech. Indeed, according to several reports the US is funding an effort to develop means to deploy the “Internet in a suitcase” and “independent cell phone networks” that “dissidents can use to undermine repressive governments that seek to silence them by censoring or shutting down telecommunications networks.”

Sascha Meinrath [ @SaschaMeinrath ] of the New America Foundation [ @NewAmerica ] opens up the “Internet in a suitcase.”

The first use of this US-funded detour around censors, however, may need to be right here at home if recent events involving the San Francisco Bay area, within the metropolitan transit system known as BART, are repeated.

Connectivity to traditional radio towers to obtain mobile phone and data service is often difficult in large, dense buildings, and it is practically undeliverable in subways or below-ground trains. The larger mobile service providers sometimes cooperate with the owners of such venues to place repeaters or smaller microcells using the mobile provider’s licensed frequencies. A few years ago, BART made arrangements with several of the mobile providers to do so in several of its locales. BART also contracted with a company that provides Wi-Fi capability, although the service is not free.

On July 3, 2011 a transit police officer fatally shot a man. The police assert that the suspect threw a vodka bottle at the officer, then came at him and another officer with a knife. A protest about a week after the shooting had disrupted service on BART.

BART officials apparently learned that another protest was being planned for August 11. According to BART, the protest was intended to once again shut down the system and it was going to be coordinated using online tools, with virtual real-time reporting about the number and location of law enforcement. BART officials decided to disable communications by powering down the mobile service repeaters/microcells and the Wi-Fi routers in order to inhibit this planned on-line coordination. The protest never happened, but all transit users suffered from the loss of connectivity.

Bart (Simpson) suggests penance for #MuBARTek debacle.
Image credit: San Francisco Citizen - Nice One, BART - You Went and Pissed Off #Anonymous With Your Cell Phone Hijinks

While EFF-Austin [ @EFFaustin ] cannot condone illegal activity, we strongly support the right of citizens to peaceably assemble, to organize such assemblies, and to exercise their First Amendment rights using modern communications. We see no material difference between BART’s take-down decision, its immediate and subsequent justification, and what has happened with sad regularity in other parts of the world. The most recent news indicates that the BART board has now realized it committed a grave error and plans to take steps to ensure it is not repeated. That is encouraging.

We do find it somewhat interesting that the mobile service providers claim to have had no involvement in, or previous knowledge of, the decision and action to take down. If this is true, then it appears there have been at least two separate violations of federal law. BART’s action probably violated section 333 of the Communications Act. The mobile providers’ decision to give control over the mobile service repeaters/microcells to BART also probably violated the terms of their licenses and FCC rules, 47 C.F.R. sections 22.383 and 22.527, and possibly others. The FCC noted only a few months ago that “the Commission’s rules and policies adopted pursuant to section 310(d) require that licensees maintain control over and responsibility for their assigned spectrum, equipment, and operations. Similarly, section 1.903 established that stations in wireless services may only be operated with an FCC authorization (i.e., license).” Violations are punishable by fines and forfeitures. Although the FCC is considering changing these rules—in an effort to encourage further use of repeaters and signal boosters by users—the rule changes have not yet gone into effect.

We are glad that BART may have realized the grave nature of its mistake, and hope that they commit to not doing this again. Our government is developing alternative mobile technologies under the presumption they would be deployed in countries subject to repressive regimes bent on denying free expression. The sad but delicious irony is their first use may be required right here at home – because a repressive local, state or national governmental body has decided to deny free expression using the same excuses heard abroad: that disconnection is “necessary” to “protect property” or “the public order.” Considering the volume of outcry in response to this event, it seems the decision makers at BART may have unwittingly provided an opportunity to renew and strengthen civil liberties in the United States. The world is watching.

Next: BART cellphone shutdown option introduced to board of directors in closed session; or, 3 Questions For #BART