February 2016

From Fines To Jail Time: How Apple Could Be Punished For Defying FBI

The fines and punishments that Apple could face by continuing to defy the FBI's demand that it help unlock the iPhone of San Bernardino (CA) shooter Syed Farook are considerable, even by the standards of one of the richest companies in the world. Many of the possible penalties are discretionary to the court where the dispute is currently being heard. The case, at least for now, resides in the US District Court for California's Central District. If Apple openly defies or ignores the demands in the order signed by Magistrate Judge Sheri Pym, the court would most likely wield a civil contempt-of-court charge as the mechanism to coerce Apple to comply, explains Cooper Levenson attorney Peter Fu. The court could also mete out civil punishments like fines. If such penalties aren't regulated by a statute, they have to be based on precedent, Fu says.

Is Apple putting profits over patriotism?

[Commentary] With Apple holding a potential key to uniquely valuable information with global security implications — and refusing to relinquish it to government — it is time to evaluate where we are in the privacy continuum. In this matter, it is not the state's action that is troubling. When consumers blithely consent to let companies such as Google, Facebook, Apple and others collect their personally identifiable information as a condition of continued use, a social contract is formed and the veneer of privacy fades. There is scant evidence that most Americans know the true cost or character of the private information they relinquish in an ostensibly fair exchange of data for service. If Americans have been suspicious of government's collection of personal information, why should they be any less suspicious of the same by private companies? Put another way, if we can request government files through the Freedom of Information Act (FOIA), should we have the same right for files compiled by Google, Facebook and others with infinitely more and better data?

The answers to these questions are as complex as the technologies we use on a daily basis, but no less critical to our way of life. When one company refuses to acknowledge rules, let alone play by them, there is an imbalance in the ecosystem, and society suffers. While the underlying issues involved in Apple's refusal to cooperate with government are intellectually ripe, it is time for that company to put the nation's interests above its own. It is time for Apple to put patriotism over profit, act responsibly and cooperate with our government.

[Hoffman is chairman of Business in the Public Interest and an adjunct professor in Communication, Culture and Technology at Georgetown University]

Poll: People Know Their Info Is Being Shared but Do Little About It

Morning Consult compiled data by polling 13,915 registered voters over the past four months to dig deeper into Americans’ relationship with privacy and the Internet. The polls show that while voters are wary about providing online services with their personal information, there is a limit to what they will do about it. Even so, the data shows that people don’t expect total online privacy. They will do some easy things to keep themselves out of the cyber-limelight, but not the most effective things.

Only one-fifth of respondents have used encryption apps, for example. Still, two-thirds of respondents say they have at least once decided not to use a website because it asked for too much information. That statistic remains consistent among age groups. A similar majority (78 percent) say they have cleared their “cookies” from their computers or wiped browser history so websites they visit can’t track their preferences and habits. Age doesn’t play much of a difference here either.

The Internet Is Undermining America’s Power

[Commentary] The US has incomparable resources, but it may never be as strong as it is in cyberspace as it is today. Cyber power may be a particularly ephemeral form of power. China is developing new competing technologies. India, Europe, and other friends hold different visions of how to manage the Internet and protect privacy. The gap between the interests of American technology companies such as Google, Apple, Facebook and Amazon and Washington is growing. The global, open Internet, a wellspring of US economic, political, and military power, is fragmenting as Beijing, Moscow, Tehran and many others are assert cyber sovereignty.

In order to address the challenges of cyberspace, the US must at least accomplish three things: enhance cybersecurity defense at home, create a working truce between the government and the private sector, and build a coalition of like-minded countries in the international sphere. Washington will have to funnel new money to research, development and innovation in cybersecurity; forge agreements with the private sector on the sharing of data; and, with its friends in Europe and Asia, clearly define what behaviors are acceptable in cyberspace and how it plans to respond if lines are crossed. The US will have to be more limited in its ambitions but more assertive in their pursuit. While it should continue to promote and espouse the virtues of an open, global, and secure Internet, the US must prepare for a more likely future—a highly contested, nationally divided cyberspace.

[Adam Segal is the Maurice R. Greenberg Senior Fellow for China Studies and Director of the Digital and Cyberspace Policy Program at the Council on Foreign Relations]

The hackers that took down Sony Pictures are still on the attack, researchers say

After Sony Pictures Entertainment was hacked shortly before Thanksgiving of 2014, the attackers – who dubbed themselves the "Guardians of Peace" – went quiet. Or so it seemed. But now researchers say they've linked the attackers – whom the US government has said were directed by North Korea — to a chameleon-like group active since at least 2009 and still on the digital warpath, attacking systems in South Korea and elsewhere in Asia.

A new report from cybersecurity firm Novetta dubs the attackers the "Lazarus Group" – a reference to a biblical figure that comes back from the dead – because it seems to rise up with new identities for different campaigns. Novetta, along with researchers from other companies including AlienVault and Kaspersky Lab, say they've pieced together evidence that suggests the Lazarus Group was behind the Sony attack along with a string of other attacks, including a 2013 campaign against South Korean television stations and financial institutions -- which the South Korean government blamed on North Korea -- and attempts to lure victims via spearphishing with documents purporting to be media coverage of the South Korean parliamentary election in 2015.

Rep Pallone Hopeful Viewer Protection Act Will Pass

House Commerce Committee Ranking Member Frank Pallone (D-NJ) said he was confident Congress would pass a bill backstopping them in the post-incentive auction repack. Speaking to a National Association of Broadcasters State Leadership audience, Ranking Member Pallone talked about his bill, the Viewer Protection Act. Broadcasters have been pressing the Federal Communications Commission to soften its hard 39-month deadline for transitioning to new channels after the auction and are concerned the $1.75 billion transition fund may not cover all the necessary expenses.

Ranking Member Pallone said he was sure the FCC didn't want viewers to lose their TV signals as a result of the repack and said his bill would make sure they had the tools needed to make sure that didn't happen. The Rep has billed his bill, introduced in Jan, as being mostly focused on those consumers, but broadcasters would clearly benefit as well. The Rep said that given that in his state, still recovering from Hurricane Sandy, "we never know when another emergency will strike," the viewers should not lose their TV signals for even a day.

Sen Cruz spars with CEO of Web Domain Organization

Tensions flared between presidential candidate Sen Ted Cruz (R-TX) and the head of the organization that manages Internet domain names. Earlier in Feb, Sen Cruz criticized Fadi Chehadé, the CEO of the Internet Corporation for Assigned Names and Numbers (ICANN), for co-chairing a committee associated with a conference in China. Chehadé defended his decision to take the position in a letter recently and said that not attending the December conference “would not have served the global Internet community.” “I have confirmed that my service in this role is a post-ICANN effort that is in my personal capacity, with my first meeting as co-chair to occur later this year,” he said in his letter. “I have not received any form of gift, reimbursement, compensation, or any other form of personal enrichment, direct or indirect, for this post-ICANN effort, though I understand that travel costs to the World Internet Conference will be covered while I serve on the high level advisory committee. I do not have any plans to seek any form of employment with the Chinese government.” Sen Cruz, who was joined on the initial letter by Sen James Lankford (R-OK) and Sen Mike Lee (R-UT), took issue with Chehadé’s portrayal of involvement with the conference. “Either the World Internet Conference and the People’s Republic of China have misreported the events that took place during their own conference or Fadi Chehade isn’t being completely honest with the United States Senate,” he said Feb 23, citing a December report that he said indicates Chehadé met with the committee during the conference.

Some web sites turning law-abiding Tor users into second-class citizens

About 1.3 million IP addresses—including those used by Google, Yahoo, Craigslist, and Yelp—are turning users of the Tor anonymity network into second-class Web citizens by blocking them outright or degrading the services offered to them, according to a recently published research paper. Titled "Do You See What I See? Differential Treatment of Anonymous Users," the paper said 3.67 percent of websites in the Alexa 1,000 discriminated against computers visiting with known Tor exit-node IP addresses. In some cases, the visitors are completely locked out, while in others users are required to complete burdensome CAPTCHAs or are limited in what they can do.

The authors said the singling out was an attempt by the sites to limit fraud and other online crime, which is carried out by a disproportionately high percentage of Tor users. In the process, law-abiding Tor users are being treated as second-class Web citizens. "While many websites block Tor to reduce abuse, doing so inadvertently impacts users from censored countries who do not have other ways to access censored Internet content," the authors wrote.

As publishers lose control, are newspaper web sites a dead parrot?

A truth is dawning on media owners (or in many cases it has dawned, but they don’t like to talk about it). Publishing is over. Obviously this isn’t true in its purest sense; publishing is actually flourishing, just not for publishers. As Facebook extended the reach of its instant articles to anyone, as Google invests in making news articles load lightning fast, as virtual reality can be produced by a £200 kit, it is fair to say we have more opportunity today to put out remarkable works of fact and fiction to the world than ever before.

As the pipes of distribution have merged with the advertising sales functions, the publishing tools and even the customer relations and data, the best a traditional publisher can hope for is that they will be favoured by the distributors or that they can build value separately. This is most likely to be through relationships with either advertisers or their own customers, hence the most closely watched models are those based on becoming a new type of advertising agency (BuzzFeed and Vice) or subscriptions based on brand loyalty (the New York Times). Given the disorienting speed of change and a dozen announcements a week that potentially upend your business model, maybe publishing is not in fact dead, but like the proverbial Monty Python parrot, lying on the floor of its cage, eyes screwed tightly shut.

Idea to retire: The “best practice” of doing more with less

[Commentary] Was there ever a dumber idea than doing more with less? Perhaps “best practice” qualifies. Both ideas should be relegated to the ash heap of history even faster than they will get there, which they inevitably will. As long as they are around they do enormous damage. This essay explains why these ideas are pernicious, yet have broad appeal. Public sector IT managers are not alone in receiving such suggestions. However, they deal with “systematic” issues and should be in the vanguard of public managers who respond to these well-intentioned but ultimately ridiculous suggestions.

Going forward, public sector IT managers should respond to suggestions of doing more with less by assessing what really needs to be done, and treating the least necessary as candidates for doing less. This should be accompanied by determining which stakeholders will be hurt, and how best to deal with them. The objective is to balance inputs and outputs without stretching inputs beyond their limits. Similarly, discussions of best practice should be followed by talking to those who purportedly follow the practice. Learn from them to help determine whether the practice might be good for the manager’s organization. Avoid the quagmire of “best;” it is neither necessary nor helpful. Find good practice. It might come from outside.

[Dr. John Leslie King is W.W. Bishop Professor in the School of Information at the University of Michigan, and Visiting Professor at the London School of Economics and Political Science]