Guest post by Mark Boyden

Found this recently (from July 2011, read article for full text, images, videos, documents, and deeper links):

Police To Begin Using Iris Scans From Controversial Iphone App, FED Forms “Center For Identity” At U-Texas Austin Campus

~ Alternative News Report – July 21, 2011

Representatives from private industry and the US federal government has already made a discreet presentation to college students in Austin Texas this spring where the concept of a series of “National Identity Management Centers” aka “The Center For Identity” was introduced to students.

I have wondered WHY this presentation was made on a college campus to college students, most of whom are gullible and many are still innocent to the beguiling tactics of surreptitiously introduced socialism and mass population surveillance programs by the federal government. Restated: most college kids do not understand what “social engineering” means, or “mass indoctrination by media gradualism.”

Until just recently if you were to try to explain these mind control methods to college kids they would hop on their skateboards and laugh it off. But that en mass naivete is now changing. “The Center For Identity” on the University of Texas at Austin has already been planned and now has a web presence.

A close friend, college aged, and a student in Austin, who attended this presentation told me later the entire ambiance of the material was creepy, hard to understand and altogether very ambiguous.

Just exactly WHAT is a “national identity management center’? I examined the literature which was handed out at this presentation and it was all cloaked in well familiar magnanimous federal platitudes about ‘personal identity security” and so forth. There was even a letter included from President Obama. The specific term “RFID” was not referenced in the literature, but I had the very distinct feeling that once these federally staffed “national identity management centers” become operative, that RFID, Iris scans, facial recognition, DNA scans and a host of other high technology personal identification methods will be deployed through the centers. There is a partnership forming between high level corporations and the federal government to establish these “national identity management centers” for profit. That was made very clear in the documents that I examined. I have posted some of these documents at the end of this report.

Read the entire article, view the videos, and included documents, at Alternative News Report.

High-tech law enforcement under scrutiny

This post concludes EFF Austin’s investigation of DART’s #OpWardrive; here’s our initial post, announcement of operation cancellation, and update on the open records request.

In our last post, we summarized our inquiry into the City of Austin Police Department’s Digital Analysis Response Team’s (DART) Operation Wardrive, concluding that it was now up to the City to provide the documents responsive to our open records request which the Office of the Attorney General (OAG) declared were not exempt from disclosure. In a letter dated December 16th (notably well within the ten calendar day deadline initiated on December 13th), the City of Austin responded by postal mail with copies of the remaining documents.

Here’s the cover letter and documents:

Operation Wardrive Open Records Request – City of Austin Response – December 16, 2011

Included were two new documents: an “Operational Briefing” and a “Synopsis of Operation.” The operation objective is worth reproducing in full:

Operation Objective
Crack down on unsecured wireless networks in residential neighborhoods.

The Austin Police DART Unit plans to conduct a ‘wardriving’ mission around select Austin neighborhoods in an effort to educate its citizens to secure their wireless networks.

‘Wardriving’ refers to the technique of searching for unsecured wireless networks by driving the streets armed simply with a laptop or smartphone seeking network connections. When unsecured networks are found, the Police detectives will pay a friendly visit to the household or small business, informing them of the risks they are exposing themselves to and attempt to assist in securing their wireless network.

The Synopsis provides a little additional information:

Detectives should log the locations where they have made contact with residents and identify them on provided activity sheet.

There are a few items worth emphasizing here:

1. EFF Austin requested “All documents and communications related to the selection and identification of Austin locations, neighborhoods, and/or individual citizens that will be targeted by ‘Operation Wardrive’”. The Briefing specifies target locations as “Austin Neighborhoods,” while the objective mentions “select Austin neighborhoods.” We are left to presume the neighborhoods selected would be left to the recognizance of DART detectives or decided and communicated off-the-record, perhaps during the 30-minute briefing on September 22nd prior to the operation.
2. EFF Austin requested “All documents and communications related to the devices, software, and other technologies that will be utilized to identify Austin locations with unencrypted broadband networks.” The Briefing indicates wardriving may be practiced “simply with a laptop or smartphone seeking network connections” but does not explicitly declare this as the tools or techniques DART would be deploying.
3. EFF Austin requested “All documents and communications related to the policies governing the protection and security of the information obtained during ‘Operation Wardrive’”. The Synopsis instructs detectives to log the names and addresses of individual citizens they paid “friendly visit[s]” to, thus creating public records of open wireless access points – one of EFF Austin’s original concerns.
4. Perhaps most revealingly, EFF Austin requested “All documents and communications related to The City of Austin’s, Austin Police Department’s, the Digital Analysis Response Team’s, or other Austin governmental agency’s recommendations and/or suggested practices for securing wireless broadband networks.” We did not receive a single document, nor can we find a single sentence responsive to this inquiry, leaving one to ask: how could DART “Crack down on unsecured wireless networks in residential neighborhoods” if the City of Austin was unable to locate a single document explaining how citizens or detectives are supposed to go about securing those networks?

Perhaps DART detectives have received special training towards that end…

Standard Operating Procedures

The last document included in the City’s response was an unredacted version of the APD DART Standard Operating Procedures (SOP), available in the embed above. The City provided EFF Austin with a redacted version of the SOP while appealing to the Office of the Attorney General, insisting that disclosure might interfere with law enforcement and crime prevention efforts. The OAG disagreed, forcing the City to release the complete document. It is an interesting read we encourage you to review, revealing the marching orders of one of the most venerable computer forensics and cybercrime prevention units in the country.

Within the previously censored sections of the document, EFF Austin found an item that might be worth further exploration.

The duties of the Sergeant of DART, the ranking officer of what appears to be a team of five detectives, are described in section .05.C.1 under “Personnel Duties, Authority, and Responsibilities.” Item “aa” on page 5 states:

Act as unit coordinator with the Austin Metro High Tech Foundation (AMHTF) Board of Directors:

1. Prepare annual budget for December meeting which projects anticipated expenditures of the AMHTF monies over the upcoming calendar year.
2. Supervise expenditures of these budgeted monies over the budget year and authorize all expenditures from these monies.
3. Prepare annual reports for the board of directors meetings itemizing budgeted expenditures for the previous year.
4. Prepare reimbursement request(s) for the AMHTF, as needed, to recover monies from authorized expenditures. Provide a receipt for all items in the reimbursement request.
5. Authorize disbursements from and provide accounting on the travel and training fund provided by the AMHTF.

What is the Austin Metro High Tech Foundation? Some historical perspective can be found at what appears to be the Foundation’s most recent website, a lonely Geocities relic worthy of review for its quirky mid-90′s Internet aesthetic alone. Quoting from the site:

The Austin Metro High Tech Foundation (AMHTF) is an organization founded by local companies and law enforcement personnel to battle high-tech crime in the Austin Metro area. The Foundation began in mid-1994, when seven area security managers decided to join with local law enforcement to form a policing unit dedicated to investigating high-tech crimes.

Since 1994, the Foundation membership has grown, along with the expertise of the law enforcement personnel assigned to high-tech crimes.

And what does the Foundation do – or rather what did the Foundation do at this time?

Foundation members provide funds, training and in-kind donations to support the law enforcement community’s high-tech crime efforts. The funds are used for education, equipment and travel required by law enforcement personnel. The benefit to members is the increase in prosecutions and restitution associated with high-tech crimes.

This 1999 LA Times story (“Tech Firms Pay Police Agencies to Fight Cyber Crime”) mentions the Austin foundation, and its byline (“Law enforcement: Intel funds sheriff’s unit that chases computer pirates. Some fear conflict of interest.”) hints at reasons why AMHTF may opt for a low profile.

This is not to say funding from the Foundation is without cause or merit; from the article:

When losses mounted from armed robberies at computer chip plants in Austin in the early ’90s, the city’s high-tech companies decided to finance a private nonprofit group to train officers to deal with the problem. Through the Austin Metro High Tech Foundation, firms including IBM and Dell Computer Corp. annually donate up to $10,000 each for investigators’ training, travel and equipment.

In return, businesses–including Applied Micro Devices, National Instruments and Motorola Corp.–say they expect law enforcement to treat computer crime as seriously as drugs and gang violence.

In 1999, according to the article’s author, public sentiment was decidedly mixed on the appropriateness of private corporations funding specific law enforcement efforts narrowly focused on crime prevention within their business sector. Is that the cause for AMHTF deciding to assume a low public profile? Is that the reason why public servants of the City of Austin attempted to perpetuate the Foundation’s low profile through selective application of the secrecy attendant on the darkness of redaction?

In the cleansing sunlight, perhaps we’ll see.

Official seal of the Office of the Attorney General of Texas

In late September, the Austin Police Department (APD) aimed to identify open residential wireless access points around the city and educate their owners about the risks of providing free Internet access. The initiative, dubbed Operation Wardrive, was announced by an APD Public Information Office press release which was quickly picked up by local ABC-affiliate KVUE. Word circulated throughout the community and back to local officials, who quashed the nascent effort by APD’s Digital Analysis Response Unit (DART) prior to deployment. It remains uncertain whether the project will be restarted.

One facet of the community response to #OpWardrive was an open records request filed by EFF Austin with the City of Austin’s Communications and Public Information Office on September 21st. We made ten distinct requests for information, ranging from details about the inception and planning of the initiative, to the technologies and techniques DART intended to employ to reliably associate an omnidirectional access point signal with a particular residence in a densely populated metropolitan area.

Why did we make these requests? If the Austin Police Department gathers data about open wireless access points operated by local citizens and organizations, we think it’s important to have a full and complete understanding of both intention and process. How will this data be used? Where will it be stored? Will it be retained and mapped? Is there a surveillance aspect to this activity? IF this activity is limited in scope, as suggested by one email we acquired suggesting that the wardrive would be only one time for a few hours, what is the target area, and why was it selected?

As compared to other states, Texas has admirable Open Records laws defined in Chapter 552 of the Texas Government Code. Conforming with § 552.301(b), the City of Austin (CoA) responded to our request on October 5th (within 10 business days) providing a handful of documents responsive to our inquiry while simultaneously requesting a decision from the Office of the Attorney General (OAG) on the disclosure of additional records.

Operation Wardrive Open Records Request – City of Austin Response (Oct 5, 2011) – Letters

The documents withheld are alleged to fall under the protection of the attorney-client privilege (§ 552.107(1)) or potentially interfere with law enforcement and crime prevention efforts (§ 552.108(b)(1)). The documents provided to EFF Austin included emails discussing the Operation Wardrive press release and a heavily redacted document detailing APD DART’s Standard Operating Procedures (SOP).

Operation Wardrive Open Records Request – City of Austin Response (Oct 5, 2011) – Records

The Texas Attorney General had 45 business days to issue a ruling on the CoA’s request, and dutifully responded on December 13th (EFF Austin opted not to exercise its right to comment in support of the release of the requested materials as described in § 552.304). The Office of the Attorney General concurred with the City of Austin concerning records protected by attorney-client privilege, but did not entirely agree with the assertion that the remaining documents could be withheld for fear of disrupting law enforcement efforts. The remaining documents include an “operational briefing” and the redacted sections of the SOP (with the exception of the cellular phone numbers of DART detectives, which are wisely protected pursuant to Open Records Decision 506 at 2 (1988)).

Operation Wardrive Open Records Request – Attorney General Response (Dec 13, 2011)

The City of Austin now has ten calendar days to either provide the requested information or access to it, or contest the OAG’s decision in court. We’ll post updates as the story unfolds.

Anonymous, ZModem, and Whiskey
Image Credit: Jacob Dexe - "Hacktivismen som demokrativerktyg"

“How in Hell Did We Get Here?: Online identity and the fight for cyberfreedom in the age of the Military-Industropolitical Complex”
by Allucquére Rosanne (Sandy) Stone

A fast-forward, semifictional history of online identity, with particular attention to the present collisions of massive political power and individual and collective agency, including how the speaker was transformed into a cat and survived the Great Hurricane of ’39 to become complicit in a Mexican Revolutionary Movement; with Graphical Illustrations, Extremely Bright Lights, and the Sound of Explosions. Maybe.

DATE: Thursday October 6th 7-9pm
NEW LOCATION: B.D. Riley’s Irish Pub and Restaurant [ @BDRileysAustin ], 204 E. 6th Street, Austin, Texas 78701; between Brazos and San Jacinto. We’ll be meeting in a dedicated space towards the back.
RSVP: Plancast
HASHTAG: #EFFatx

Allucquére Rosanne (Sandy) Stone [ website, wikipedia, cyborg anthropology entry ] is an academic theorist, media theorist, author, performance artist, and general troublemaker. She is Professor Emerita in the College of Communication at the University of Texas at Austin and Founding Director of the Advanced Communication Technologies Laboratory (ACTLab) in the department of Radio, Television and Film. Concurrently she is Wolfgang Kohler Professor of Media and Performance at the European Graduate School (EGS) and Founding Director of the radical new Experimental Media program ACTLab@EGS, senior artist at the Banff Centre for the Arts, and Humanities Research Institute Fellow at the University of California, Irvine. Stone has worked in and written about film, music, experimental neurology, writing, engineering, and computer programming. She is transgender and is considered a founder of the academic discipline of transgender studies, is the author of numerous books, novels, and essays, has been profiled in ArtForum, Wired, Mondo 2000, and many other publications, and Jon Lebkowsky has referred to her as “a force of nature.” She loves chocolate, cats and, apparently, getting herself into hair-raisingly scary situations from which escape is nearly impossible. Nevertheless she finds time to be a loving wife, boon companion, caring mother, and exemplary grandmother, while still running the hell all over the world to perform at conferences in too many disciplines to mention.

B.D. Riley’s on 6th Downtown

Map

The Joy of Tech #354 - They always dreamed of having a home in the range

On Wednesday September 21st, EFF Austin [ @EFFaustin ] was notified about the Austin Police Department’s (APD) Digital Analysis Response Team’s [ DART, @APDDART ] “Operation Wardrive” [ #OpWardrive ] via the KVUE [ @KVUE ] news article that originally appeared at the following URI (it’s relatively common for journalism operations to reuse the same URI to track stories as they develop, sometimes redirecting to new articles):
http://www.kvue.com/news/local/APD-conductiong-Operation-Warfare-to-keep-internet-users-safe-130218768.html

For reference, the text of the original KVUE article is cited in EFF Austin’s response.

Beginning with KVUE’s article, which appears to have been the only source of information and perspective on APD’s intent, a largely uncoordinated but similarly informed collective action took place across multiple points of interface and communication with APD and the Austin City Council [ @AustinTexasGov, #ATXCouncil ]. This seems to have ensured that officials and decision makers in a position to intervene were made aware of public sentiment in a timely manner. Sufficient public concern was observed to motivate officials towards action.

There is uncertainty about whether “Operation Wardrive” has been canceled or postponed, as reflected in this sequence of tweets from KVUE’s account on Thursday morning.

@KVUE (Thu Sep 22 10:23am, 10:20am, 9:30am CST)

APD Chief of Police Art Acevedo is more clear in his email response (Thu Sep 22 10:13:55am CST) to Austinite Mark Boyden‘s thoughtful email addressed to all Austin City Council members, several local activists, Acevedo, and APD Public Information Office Manager Anna Sabana.

Thank you for sharing your concerns with me. This WarDrive idea was not approved by APD Executive Staff and in fact has been disapproved. We will be releasing a statement later today. Although the involved unit’s intent was noble (educating the public about the risks to your personal information), a PSA or other educational effort would be much more effective. To place you further at ease, the idea was killed before actual implementation.

The APD Public Information Office did not publish a formal statement on Thursday via APD News Releases nor the City of Austin Communications and Public Information Office.

KVUE’s Shelton Green [ @SheltonG_KVUE, bio, email ] reached out to EFF Austin seeking our perspective for a follow-up story. EFF Austin President Jon Lebkowsky [ @jonl, wikipedia, homepage ] sat for that interview, which was crafted into the following story, which led the news on KVUE last night (Thu Sep 22 10:00pm).

What’s Next?

As Shelton Green mentions at the end of the story, EFF Austin would like to work with the Austin Police Department Digital Analysis Response Team to craft a winning public education campaign on the risks as well as the virtues of operating an open, publicly-accessible wireless access point. We’ve begun to compile information and gather existing recommendations in this space (if you have sources, please add as a comment or mention to @EFFaustin with hashtag #OpWardrive).

EFF Austin has also decided to continue with our Texas Public Information Act Open Records request. We expect to receive an assessment of the viability of each of our 10 specific inquiries along with an estimate of fees we must pay to have the records processed.

Yesterday, some members of the EFF Austin Board of Directors were frankly shocked by the arrival of an unsolicited $10 donation. I had forgotten we even have a Paypal account. But it made us feel good, and reminded us that we are embarking on a path which will have attendant fees and expenses. We would like to help serve the public interest by walking that path, and would therefore like to ask if you can help support our efforts. If you like what we’re doing, please consider donating (we’re a nonprofit) to help us defray approaching expenses. There’s a Paypal donate button at the upper right of this page.

We believe in transparency and sunlight’s powers of disinfection. EFF Austin will provide transparency into our expenses and you can be sure we will sing praises to our supporters for their role in helping us act. Thank you.

If you’d like to get more involved, consider following us on Twitter, liking us on Facebook, joining our interesting email discussion list, or coming to our next meetup.

Open Wireless Access Points - security threat?

Update (Sep 22 @ 1:07pm) – The Austin Police Department has decided to cancel Operation Wardrive and focus on the public education facet of this work. See Mark Boyden’s comment, an email response from APD Chief Art Acevedo. Thanks go to Scott Henson at Grits For Breakfast for his attention to this matter.

Yesterday (September 20th @ 2:46pm CST), KVUE News published an article relaying the Austin Police Department‘s intention to identify open residential wireless access points (WAPs) throughout the city.

Police will soon conduct an operation to find open wireless Internet connections in the city.

The APD Digital Analysis Response Team, or DART, will hold “Operation Wardrive” Thursday, Sept. 22. DART unit members will make contact with residents who have open wireless connections and teach them the importance of securing them.

This raises a number of immediate questions, perhaps the most simplistic and potentially revealing being simply: “why?” The answer to that question appears to be the same answer provided for lots of questions lately: safety.

From the article:

Leaving your wireless network open invites a number of problems:

• You may exceed the number of connections permitted by your Internet service provider.
• Users piggy-backing on your internet connection might use up your bandwidth and slow your connection.
• Users piggy-backing on your internet connection might engage in illegal activity that will be traced to you.
• Malicious users may be able to monitor your Internet activity and steal passwords and other sensitive information.
• Malicious users may be able to access files on your computer, install spyware and other malicious programs, or take control of your computer.

The EFF Austin Board of Directors finds nothing wrong with this analysis of the potential risks Internet users undertake when intentionally or unintentionally leaving their wireless access points open for shared use. In fact, we could cite a few more. However, these are much the same risks that Internet users undertake when using ANY shared wireless access point, such as those provided by cafés, public parks, or the Austin Public Library.

Missing from the cited analysis is any recognition of potential benefits to be gained from publicly sharing one’s wireless access point. Lately, the virtues of contributing to any shared commons tends to be overshadowed by fears of bad actors (both real and imagined). For some facts, it’s worth reviewing cryptographer and computer security specialist Bruce Schneier‘s discussion on the virtues and risks of running an open wireless network.

More importantly, missing from the cited analysis is any recognition of the unintended consequences of APD collecting this information. The Austin Police Department is a public agency and is thus subject to the Texas Public Information Act (TPIA), Chapter 552 of the Texas Government Code, which guarantees the public’s access to information in the custody of government agencies. As a result of undertaking “Operation Wardrive” the records generated by that operation are subject to open records requests. That information is potentially valuable to perpetrators interested in undertaking the kind of malfeasance outlined in the KVUE article.

The EFF Austin Board is not interested in this data beyond knowing what is collected and why. We are more interested in the provenance of this Austin Police Department operation, and doing what we can to help APD increase public education about the virtues and risks of running an open wireless access point. To that end, we have decided to file an Open Records request today seeking information on this operation.

“Operation Wardrive” Open Records Request (Sep 21, 2011)

Jay Unger’s IIW11 slides are a very helpful introduction to the 36 page National Strategy for Trusted Identities in Cyberspace document produced by Deloitte last year. Also, during the session, Jay shared some things he had heard from the Department of Homeland Security such as “expect the ecosystem to be private sector led” and suggested that this initiative was leading towards commerce (“reading between the tea leaves”). It seems Jay was right and it seems to me that the main catalyst here, although not clearly defined as a vision, was stated in the White House blog post on NSTIC this week.

we can…cut costs for businesses and government by reducing inefficient identification procedures.

Think about how much money businesses and government could save for each customer it can convert from doing things by phone and mail versus online. “Money is what jumpstarts this” is among my notes from the IIW session.

So, it seems a good question to ask about trusted identities is “trusted by who?” If the goal is to reduce costs which is desired by business and government, who truly needs to trust them are we, the people. This seems to be a matter of changing our perception about the security of doing our business online. Of course, there will still be security vulnerabilities and privacy compromises. We just need to perceive that NSTIC is fixing those. Therefore, I agree with Kaliya Hamlin’s sentiment that We Shouldn’t Freak Out About NSTIC.

Update 1/11: Here is the video of last Friday’s Stanford Institute for Economic Policy Research event with Commerce Secretary Gary Locke and White House Cybersecurity Coordinator Howard Schmidt and ID Commons post-event conference call notes. To keep updated with these calls, check here.

IIW11 was held November 2-4, 2010. IIW12 is is May 3-5, 2011 in Mountain View, California.

whurley, Don Jarrell, Chris Boyd

EFF-Austin sponsored a successful panel, Cloud Computing: Threat, or Menace, on March 3. Thanks to all who joined us!

Audio

Speakers:
W. Scott McCollough, Telecommunications and ISP Law Specialist, McCollough|Henry, PC
Chris Boyd, Midas Networks
whurley, BMC Software, Inc.
Andrew Donoho, Strategist
Don Jarrell, Digital Thinking, Inc.
Moderator: Michael Hathaway, Pico Innovations