Appeals Court’s Disturbing Ruling Jeopardizes Protections for Anonymous Speakers

Appeals Court’s Disturbing Ruling Jeopardizes Protections for Anonymous Speakers
By sophia

A federal appeals court has issued an alarming ruling that significantly erodes the Constitution’s protections for anonymous speakers—and simultaneously hands law enforcement a near unlimited power to unmask them.

The Ninth Circuit’s decision in  U.S. v. Glassdoor, Inc. is a significant setback for the First Amendment. The ability to speak anonymously online without fear of being identified is essential because it allows people to express controversial or unpopular views. Strong legal protections for anonymous speakers are needed so that they are not harassed, ridiculed, or silenced merely for expressing their opinions.

In Glassdoor, the court’s ruling ensures that any grand jury subpoena seeking the identities of anonymous speakers will be valid virtually every time. The decision is a recipe for disaster precisely because it provides little to no legal protections for anonymous speakers.

EFF applauds Glassdoor for standing up for its users’ First Amendment rights in this case and for its commitment to do so moving forward. Yet we worry that without stronger legal standards—which EFF and other groups urged the Ninth Circuit to apply (read our brief filed in the case)—the government will easily compel platforms to comply with grand jury subpoenas to unmask anonymous speakers.

The Ninth Circuit Undercut Anonymous Speech by Applying the Wrong Test

The case centers on a federal grand jury in Arizona investigating allegations of fraud by a private contractor working for the Department of Veterans Affairs. The grand jury issued a subpoena to Glassdoor, which operates an online platform that allows current and former employees to comment anonymously about their employers, seeking the identities of eight accounts who posted about the contractor.

Glassdoor challenged the subpoena by asserting its users’ First Amendment rights. When the trial court ordered Glassdoor to comply, the company appealed to the U.S. Court of Appeals for the Ninth Circuit.

The Ninth Circuit ruled that because the subpoena was issued by a grand jury as part of a criminal investigation, Glassdoor had to comply absent evidence that the investigation was being conducted in bad faith.

There are several problems with the court’s ruling, but the biggest is that in adopting a “bad faith” test as the sole limit on when anonymous speakers can be unmasked by a grand jury subpoena, it relied on a U.S. Supreme Court case called Branzburg v. Hayes.

In challenging the subpoena, Glassdoor rightly argued that Branzburg was not relevant because it dealt with whether journalists had a First Amendment right to  protect the identities of their confidential sources in the face of grand jury subpoenas, and more generally, whether journalists have a First Amendment right to gather the news. This case, however, squarely deals with Glassdoor users’ First Amendment right to speak anonymously.

The Ninth Circuit ran roughshod over the issue, calling it “a distinction without a difference.” But here’s the problem: although the law is all over the map as to whether the First Amendment protects journalists’ ability to guard their sources’ identities, there is absolutely no question that the First Amendment grants anonymous speakers the right to protect their identities.

The Supreme Court has repeatedly ruled that the First Amendment protects anonymous speakers, often by emphasizing the historic importance of anonymity in our social and political discourse. For example, many of our founders spoke anonymously while debating the provisions of our Constitution.

Because the Supreme Court in Branzburg did not outright rule that reporters have a First Amendment right to protect their confidential sources, it adopted a rule that requires a reporter to respond to a grand jury subpoena for their source’s identity unless the reporter can show that the investigation is being conducted in bad faith. This is a very weak standard and difficult to prove.

By contrast, because the right to speak anonymously has been firmly established by the Supreme Court and in jurisdictions throughout the country, the tests for when parties can unmask those speakers are more robust and protective of their First Amendment rights. These tests more properly calibrate the competing interests between the government’s need to investigate crime and the First Amendment rights of anonymous speakers.

The Ninth Circuit’s reliance on Branzburg effectively eviscerates any substantive First Amendment protections for anonymous speakers by not imposing any meaningful limitation on grand jury subpoenas. Further, the court’s ruling puts the burden on anonymous speakers—or platforms like Glassdoor standing in their shoes—to show that an investigation is being conducted in bad faith before setting aside the subpoena.

The Ninth Circuit’s reliance on Branzburg is also wrong because the Supreme Court ruling in that case was narrow and limited to the situation involving reporters’ efforts to guard the identities of their confidential sources. As Justice Powell wrote in his concurrence, “I … emphasize what seems to me to be the limited nature of the Court’s ruling.” The standards in that unique case should not be transported to cases involving grand jury subpoenas to unmask anonymous speakers generally. However, that’s what the court has done—expanded Branzburg to now apply in all instances in which a grand jury subpoena targets individuals whose identities are unknown to the grand jury.

Finally, the Ninth Circuit’s use of Branzburg is further improper because there are a number of other cases and legal doctrines that more squarely address how courts should treat demands to pierce anonymity. Indeed, as we discussed in our brief, there is a whole body of law that applies robust standards to unmasking anonymous speakers, including the Ninth Circuit’s previous decision in Bursey v. U.S., which also involved a grand jury.

The Ninth Circuit Failed to Recognize the Associational Rights of Anonymous Online Speakers

The court’s decision is also troubling because it takes an extremely narrow view of the kind of anonymous associations that should be protected by the First Amendment. In dismissing claims by Glassdoor that the subpoena chilled their users’ First Amendment rights to privately associate with others, the court ruled that because Glassdoor was not itself a social or political organization such as the NAACP, the claim was “tenuous.”

There are several layers to the First Amendment right of association, including the ability of individuals to associate with others, the ability of individuals to associate with a particular organization or group, and the ability for a group or organization to maintain the anonymity of members or supporters.

Although it’s true that Glassdoor users are not joining an organization like the NAACP or a union, the court’s analysis ignores that other associational rights are implicated by the subpoena in this case. At minimum, Glassdoor’s online platform offers the potential for individuals to organize and form communities around their shared employment experiences. The First Amendment must protect those interests even if Glassdoor lacks an explicit political goal.

Moreover, even if it’s true that Glassdoor users may not have an explicitly political goal in commenting on their current or past employers, they are still associating online with others with similar experiences to speak honestly about what happens inside companies, what their professional experiences are like, and how they believe those employers can improve.

The risk of being identified as a Glassdoor user is a legitimate one that courts should recognize as analogous to the risks of civil rights groups or unions being compelled to identify their members. Disclosure in both instances chills individuals’ abilities to explore their own experiences, attitudes, and beliefs.

The Ninth Circuit Missed an Opportunity to Vindicate Online Speakers’ First Amendment Rights

Significantly absent from the court’s decision was any real discussion about the value of anonymous speech and its historical role in our country. This is a shame because the case would have been a great opportunity to show the importance of First Amendment protections for online speakers.

EFF has long fought for anonymity online because we know its importance in fostering robust expression and debate. Subpoenas such as the one issued to Glassdoor deter people from speaking anonymously about issues related to their employment. Glassdoor provides a valuable service because its anonymous reviews help inform other people’s career choices while also keeping employers accountable to their workers and potentially the general public.

The Ninth Circuit’s decision appeared unconcerned with this reality, and its “bad faith” standard places no meaningful limit on the use of grand jury subpoenas to unmask anonymous speakers. This will ultimately harm speakers who can now be more easily targeted and unmasked, particularly if they have said something controversial or offensive. 

November 15, 2017 at 02:38AM
via Deeplinks http://ift.tt/2ms7EaN

Suspending the Catalan Parliament, Spain Destroys the EU’s “Rule of Law” Figleaf.

Suspending the Catalan Parliament, Spain Destroys the EU’s “Rule of Law” Figleaf.
By craig

It takes a very special kind of chutzpah systematically to assault voters, and drag them from polling booths by their hair, and then say that a low turnout invalidates the vote. That is the shameless position being taken by the Europe wide political Establishment and its corporate media lackeys. This Guardian article illustrates a refinement to this already extreme act of intellectual dishonesty. It states voter turnout was 43%. That ignores the 770,000 votes which were cast but physically confiscated by the police so they could not be counted. They take voter turnout over 50%.

That is an incredibly high turnout, given that 900 voters were brutalised so badly they needed formal medical treatment. The prospect of being smashed in the face by a club would naturally deter a number of people from voting. The physical closure of polling stations obviously stopped others from voting. It is quite incredible that in these circumstances, over 50% of the electorate did succeed in casting a vote.

To enable this of course required some deviation from norms. People were allowed to vote at any polling station. The right wing German politician from the Bavarian Christian Democrats, Manfred Weber, leads the largest group in the European Parliament, which includes Rajoy’s Popular Party. He was therefore the first speaker in the EU Parliament debate on events in Catalonia, and managed not to mention police violence or human rights at all in his speech. He did however find time to mock the Catalan authorities for making these last minute changes in procedures to voting rules, which he said invalidated the result.

Weber is no stranger to using spurious “legalities” to support the jackbooted oppressor. His party has attempted to close down EU Commission programmes to build schools and clinics for Palestinian children in the occupied West Bank, on the grounds they do not have planning permission from the Israeli authorities.

The obvious answer to the objection of Weber and others on the running of the referendum, is to have another one agreed by all and run in strict accordance with international standards. Yet strangely, despite their complaints about the process, they do not want to have a better process. They rather do not wish people to be allowed to vote at all.

There are however no arguments that the Catalan Parliament was elected in anything but the proper manner. Its suspension by the Spanish Constitutional Court – a body on which 10 out of 12 members are political appointees – is therefore not due to any doubts about the Catalan Parliament’s legitimacy.

No, the Catalan Parliament has been suspended because the Constitutional Court fears it may be about to vote in a way that the Spanish government does not like.

Note that it has not even done this yet. Nobody knows how its members will actually vote, until they vote. The Constitutional Court is suspending a democratically elected body in case it takes a democratic vote of its members.

This makes the EU look pretty silly. It was looking pretty silly anyway. I telephoned the Cabinet today of Frans Timmermans, the EU Commissioner who told the European Parliament that Spain was entitled to use force against the Catalans and it had been proportionate. I spoke to a pleasant young man responsible for the “rule of law and fundamental rights” portfolio in the Cabinet. I got through by using my “Ambassador” title.

Here is the thing. He was genuinely shocked to hear that people thought the Commission’s support for use of force was wrong. He stated that it had not been the intention of Timmermans to say the use of force was proportionate, rather it must be proportionate. He became very agitated and refused to answer when I repeatedly questioned him as to whether he thought the use of force had in fact been proportionate. I suggested to him rather strongly that in refusing to acknowledge the disproportionate use of force, he was in effect lying. I pointed out that Timmermans had supported use of force and said “rule of law” over and over again, but scarcely mentioned human rights.

Here is the thing. It was plain that his shock was genuine, and he had no idea whatsoever of the social media reaction to Timmermans speech. I told him to search Timmermans on twitter and facebook and see for himself, and he agreed to do so. The problem is, these people live in a Brussels bubble where they interact with other Eurocrats and national diplomats, and members of the Establishment media, but have no connection at all to the citizenry of the EU. Nor had he seen the Amnesty International report, which I subsequently emailed him.

The rule of law is not everything. Apartheid was legally enforced in South Africa. Mr Weber’s Nazi antecedents had laws. British colonialism was enforced by laws. Nor is the administration of the law always impartial. Apartheid had its judges. Pinochet had judges to enact his version of the “rule of law”.

Actually all dictators are very big on “the rule of law”.

The most sinister thing Timmermans said to the European Parliament was “There can be no human rights without the rule of law”. Sinister because he did not balance it with “there can be no rule of law without human rights”.

What Spain is attempting now to impose on Catalonia is rule of law without democracy. I am going to be most interested to see how Brussels manages to justify that. We are seeing a whipping up of hatred by a central government against a national and linguistic minority and a suppression of its freedoms and institutions.

The highly politicised Spanish Constitutional Court, in suspending a democratically elected parliament because it does not like its views, has pointed up today that it is not sufficient for the EU to simply parrot “rule of law”. Spain currently has a Francoist Party in power with a Francoist judiciary intent on closing down democracy in Catalonia.

The rule of law within the EU has to stem from democracy, and to respect human rights. Neither is true in Rajoy’s Spain.

————————————————————-

I continue urgently to need contributions to my defence in the libel action against me by Jake Wallis Simons, Associate Editor of Daily Mail online. You can see the court documents outlining the case here. I am threatened with bankruptcy and the end of this blog (not to mention a terrible effect on my young family). Support is greatly appreciated. An astonishing 4,000 people have now contributed a total of over £75,000. But that is still only halfway towards the £140,000 target. I realise it is astonishing that so much money can be needed, but that is the pernicious effect of England’s draconian libel laws, as explained here.


On a practical point, a number of people have said they are not members of Paypal so could not donate. After clicking on “Donate”, just below and left of the “Log In” button is a small “continue” link which enables you to donate by card without logging in.

For those who prefer not to pay online, you can send a cheque made out to me to Craig Murray, 89/14 Holyrood Road, Edinburgh, EH8 8BA. As regular readers know, it is a matter of pride to me that I never hide my address.

The post Suspending the Catalan Parliament, Spain Destroys the EU’s “Rule of Law” Figleaf. appeared first on Craig Murray.

October 5, 2017 at 06:21PM
via Craig Murray http://ift.tt/2z1E9Pr

The killing of history

The killing of history
By

Reporting from New York, John Pilger describes the re-writing of the history of the Vietnam War in the 10-part television series by Ken Burns and Lynn Novick. Millions died "in good faith", they say. And so yet more wars are justified - as President Trump tells the world he is prepared to "totally destroy" North Korea and its 25 million people.

September 21, 2017 at 12:00AM
via JohnPilger.com – the films and journalism of John Pilger http://ift.tt/2xW37m6

I Have Nothing to Hide – Really? Here’s why privacy matters to all of us

I Have Nothing to Hide – Really? Here’s why privacy matters to all of us
By Arne Möhle

The statement “I have nothing to hide” is very popular. But recently reversing this statement has also become very popular: “Give me your bank account login, your email login, your Facebook login.” Most people refuse this instantly, and for a good reason: Everybody has something to hide. To convince everybody – once and for all – let’s take a deep dive into why privacy matters and how everybody can protect their private data easily.

Privacy Is a Basic Human Right

Privacy online and offline is a basic human right not because we have something to hide, but because it protects al  people whether they have something to hide today. You don’t want your neighbor to spy on you, so why should a government or an Internet service be allowed to see and use your data for their own purposes?

Privacy Protects Minorities

Many governments already spy on their citizens to prevent political opposition. Even politicians in Western democracies are increasingly in favor of online surveillance, falsely claiming that this would protect us from terrorist attacks. This is a worrisome development as the right to privacy is crucial when it comes to protecting people with oppositional political views. Autocratic systems around the world show us how dangerous it is to give up our right to privacy – not only for the people affected, but also for a society as a whole: When self-censorship becomes the norm, a true dispute – essential to any democracy – becomes impossible.

Privacy Saves You Money

Companies use your data to show you personalized advertisements. Some people even say they like seeing ads they are interested in, but this form of advertisement is not just invasive, it is also very costly: From online tracking the advertisements company knows exactly what you are looking for, and they more or less know what you are willing to spend. Because of all the data they have accumulated about you and about lots of other Internet users matching your browsing profile, they will not show you the best deal available. Instead they will show you very targeted advertisements that will very likely make you pay more than you should have.

Privacy Is Safety

The Internet is a great place where we can share every idea freely. However, there are a lot of criminals active online, whose only goal is to steal your identity by gaining access to online accounts such as email, Paypal, or Facebook. It is important to keep your online identity secure and protect it from malicious attacks so that no one can use your accounts to steal money.

Companies Must Protect Privacy

The latest Equifax hack is a prime example of how a company should not handle people’s data. Private information must always be securely encrypted so that a potential attacker has no chance of stealing personal information of millions of people. That’s also why a backdoor to encrypted services is never an option. Any backdoor will sooner or later be abused by criminals.  

Data Is the Currency of the 21st Century

The problem today is that data is of high value to most online services. As many offer their services for free, their business model depends on gathering users’ data, profiling them and posting targeted ads, or selling the data on to advertisers. This process is only designed to serve one purpose: Make as much money for the company involved as possible. Protection of people’s privacy is only a hassle that costs money – so nothing these companies would want to look after. For this reason, data leaks like the latest Equifax hack are becoming so numerous lately. Companies simply don’t care enough to adequately protect their users’ data against attackers.

People Must Protect Their Privacy Themselves

It would be desirable that this changes, that companies protect their users’ data with strong encryption. However, this costs money, so unless the users’ force companies to protect their data, they will never do it. Fortunately, users have more power than they think: By choosing privacy-friendly services that fully protect their data with encryption, they are forcing all companies to understand our right to privacy what it is: a key selling feature.

How to Protect Your Data

You can make a change today by switching to privacy-friendly, encrypted services. Here are some suggestions:

* Use VPN encryption to protect your Internet traffic such as PIA.

* Use encrypted mail such as Tutanota.

* Use private search engines such as Qwant.

* Use encrypted chat apps.

By making a switch today, you’ll stop the Internet spies from abusing your data! On top of that you fight along with us for our right to privacy – not only to protect your data, but also to protect our democracy.

The post I Have Nothing to Hide – Really? Here’s why privacy matters to all of us appeared first on Privacy Online News.

September 20, 2017 at 02:00PM
via Privacy Online News http://ift.tt/2wyJ8K4

The Cybercrime Convention’s New Protocol Needs to Uphold Human Rights

The Cybercrime Convention’s New Protocol Needs to Uphold Human Rights
By danny

As part of an ongoing attempt to help law enforcement obtain data across international borders, the Council of Europe’s Cybercrime Convention— finalized in the weeks following 9/11, and ratified by the United States and over 50 countries around the world—is back on the global lawmaking agenda. This time, the Council’s Cybercrime Convention Committee (T-CY) has initiated a process to draft a second additional protocol to the Convention—a new text which could allow direct foreign law enforcement access to data stored in other countries’ territories. EFF has joined EDRi and a number of other organizations in a letter to the Council of Europe, highlighting some anticipated concerns with the upcoming process and seeking to ensure civil society concerns are considered in the new protocol. This new protocol needs to preserve the Council of Europe’s stated aim to uphold human rights, and not undermine privacy, and the integrity of our communication networks.

How the Long Arm of Law Reaches into Foreign Servers

Thanks to the internet, individuals and their data increasingly reside in different jurisdictions: your email might be stored on a Google server in the United States, while your shared Word documents might be stored by Microsoft in Ireland. Law enforcement agencies across the world have sought to gain access to this data, wherever it is held. That means police in one country frequently seek to extract personal, private data from servers in another.

Currently, the primary international mechanism for facilitating governmental cross border data access is the Mutual Legal Assistance Treaty (MLAT) process, a series of treaties between two or more states that create a formal basis for cooperation between designated authorities of signatories. These treaties typically include some safeguards for privacy and due process, most often the safeguards of the country that hosts the data.

The MLAT regime includes steps to protect privacy and due process, but frustrated agencies have increasingly sought to bypass it, by either cross-border hacking, or leaning on large service providers in foreign jurisdictions to hand over data voluntarily.

The legalities of cross-border hacking remain very murky, and its operation is the very opposite of transparent and proportionate. Meanwhile, voluntary cooperation between service providers and law enforcement occurs outside the MLAT process and without any clear accountability framework. The primary window of insight into its scope and operation is the annual Transparency Reports voluntarily issued by some companies such as Google and Twitter.

Hacking often blatantly ignores the laws and rights of a foreign state, but voluntary data handovers can be used to bypass domestic legal protections too.  In Canada, for example, the right to privacy includes rigorous safeguards for online anonymity: private Internet companies are not permitted to identify customers without prior judicial authorization. By identifying often sensitive anonymous online activity directly through the voluntary cooperation of a foreign company not bound by Canadian privacy law, law enforcement agents can effectively bypass this domestic privacy standard.

Faster, but not Better: Bypassing MLAT

The MLAT regime has been criticized as slow and inefficient. Law enforcement officers have claimed that have to wait anywhere between 6-10 months—the reported average time frame for receiving data through an MLAT request—for data necessary to their local investigation. Much of this delay, however, is attributable to a lack of adequate resources, streamlining and prioritization for the huge increase in MLAT requests for data held the United States, plus the absence of adequate training for law enforcement officers seeking to rely on another state’s legal search and seizure powers.

Instead of just working to make the MLAT process more effective, the T-CY committee is seeking to create a parallel mechanism for cross-border cooperation. While the process is still in its earliest stages, many are concerned that the resulting proposals will replicate many of the problems in the existing regime, while adding new ones.

What the New Protocol Might Contain

The Terms of Reference for the drafting of this new second protocol reveal some areas that may be included in the final proposal.

Simplified mechanisms for cross border access

T-CY has flagged a number of new mechanisms it believes will streamline cross-border data access. The terms of reference mention a simplified regime’ for legal assistance with respect to subscriber data. Such a regime could be highly controversial if it compelled companies to identify anonymous online activity without prior judicial authorization. The terms of reference also envision the creation of “international production orders.”. Presumably these would be orders issued by one court under its own standards, but that must be respected by Internet companies in other jurisdictions. Such mechanisms could be problematic where they do not respect the privacy and due process rights of both jurisdictions.

Direct cooperation

The terms of reference also call for “provisions allowing for direct cooperation with service providers in other jurisdictions with regard to requests for [i] subscriber information, [ii] preservation requests, and [iii] emergency requests.” These mechanisms would be permissive, clearing the way for companies in one state to voluntarily cooperate with certain types of requests issued by another, and even in the absence of any form of judicial authorization.

Each of the proposed direct cooperation mechanisms could be problematic. Preservation requests are not controversial per se. Companies often have standard retention periods for different types of data sets. Preservation orders are intended to extend these so that law enforcement have sufficient time to obtain proper legal authorization to access the preserved data. However, preservation should not be undertaken frivolously. It can carry an accompanying stigma, and exposes affected individuals’ data to greater risk if a security breach occurs during the preservation period. This is why some jurisdictions require reasonable suspicion and court orders as requirements for preservation orders.

Direct voluntary cooperation on emergency matters is challenging as well. While in such instances, there is little time to engage the judicial apparatus and most states recognize direct access to private customer data in emergency situations, such access can still be subject to controversial overreach. This potential for overreach–and even abuse–becomes far higher where there is a disconnect between standards in requesting and responding jurisdictions.

Direct cooperation in identifying customers can be equally controversial. Anonymity is critical to privacy in digital contexts. Some data protection laws (such as Canada’s federal privacy law) prevent Internet companies from voluntarily providing subscriber data to law enforcement voluntarily.

Safeguards

The terms of reference also envisions the adoption of “safeguards”. The scope and nature of these will be critical. Indeed, one of the strongest criticisms against the original Cybercrime Convention has been its lack of specific protections and safeguards for privacy and other human rights. The EDRi Letter calls for adherence to the Council of Europe’s data protection regime, Convention 108, as a minimum prerequisite to participation in the envisioned regime for cross-border access, which would provide some basis for shared privacy protection. The letter also calls for detailed statistical reporting and other safeguards.

What’s next?

On 18 September, the T-CY Bureau will meet with European Digital Rights Group (EDRI) to discuss the protocol. The first meeting of the Drafting Group will be held on 19 and 20 September. The draft Protocol will be prepared and finalized by the T-CY, in closed session.

Law enforcement agencies are granted extraordinary powers to invade privacy in order to investigate crime. This proposed second protocol to the Cybercrime Convention must ensure that the highest privacy standards and due process protections adopted by signatory states remain intact.

We believe that the Council of Europe T-CY Committee — Netherlands, Romania, Canada, Dominica Republic, Estonia, Mauritius, Norway, Portugal, Sri Lanka, Switzerland, and Ukraine — should concentrate first on fixes to the existing MLAT process, and they should ensure that this new initiative does not become an exercise in harmonization to the lowest denominator of international privacy protection. We’ll be keeping track of what happens next.

September 19, 2017 at 12:10AM
via Deeplinks http://ift.tt/2xMlOIR

Attack on CCleaner Highlights the Importance of Securing Downloads and Maintaining User Trust

Attack on CCleaner Highlights the Importance of Securing Downloads and Maintaining User Trust
By gennie

Some of the most worrying kinds of attacks are ones that exploit users’ trust in the systems and softwares they use every day. Yesterday, Cisco’s Talos security team uncovered just that kind of attack in the computer cleanup software CCleaner. Download servers at Avast, the company that owns CCleaner, had been compromised to distribute malware inside CCleaner 5.33 updates for at least a month. Avast estimates that over 2 million users downloaded the affected update. Even worse, CCleaner’s popularity with journalists and human rights activists means that particularly vulnerable users are almost certainly among that number. Avast has advised CCleaner Windows users to update their software immediately.

This is often called a “supply chain” attack, referring to all the steps software takes to get from its developers to its users. As more and more users get better at bread-and-butter personal security like enabling two-factor authentication and detecting phishing, malicious hackers are forced to stop targeting users and move “up” the supply chain to the companies and developers that make software. This means that developers need to get in the practice of “distrusting” their own  infrastructure to ensure safer software releases with reproducible builds, allowing third parties to double-check whether released binary and source packages correspond. The goal should be to secure internal development and release infrastructure to that point that no hijacking, even from a malicious actor inside the company, can slip through unnoticed.

The harms of this hack extend far beyond the 2 million users who were directly affected. Supply chain attacks undermine users’ trust in official sources, and take advantage of the security safeguards that users and developers rely on. Software updates like the one Avast released for CCleaner are typically signed with the developer’s un-spoof-able cryptographic key. But the hackers appear to have penetrated Avast’s download servers before the software update was signed, essentially hijacking Avast’s update distribution process and punishing users for the security best practice of updating their software.

Despite observations that these kind of attack are on the rise, the reality is that they remain extremely rare when compared to other kinds of attacks users might encounter. This and other supply chain attacks should not deter users from updating their software. Like any security decision, this is a trade-off: for every attack that might take advantage of the supply chain, there are one hundred attacks that will take advantage of users not updating their software.

For users, sticking with trusted, official software sources and updating your software whenever prompted remains the best way to protect yourself from software attacks. For developers and software companies, the attack on CCleaner is a reminder of the importance of securing every link of the download supply chain.

September 19, 2017 at 08:16PM
via Deeplinks http://ift.tt/2wEoIu6

A Sense of Proportion

A Sense of Proportion
By craig

The Establishment is fast losing its grip on the loyalty of the populace. That decline in the respect of the population for their masters has coincided with the rise of the importance of the internet and social media, and the corresponding decline in consumption of traditional print and broadcast news and current affairs media. It is a little more complicated than simple cause and effect – at precisely the same period the income gap in western society has opened out massively, and the palliative protections of the masses, particularly trade unions, have been rendered impotent. But the overall impact is that respect of the people for their “betters” is vanishing. Indeed, very few people would accept anybody in the political class as their “better” today.

There have been a number of Establishment reactions to this development. One is the cry of “Fake News” and desire to find excuses for censoring the internet and re-establishing control of the narrative. The “Fake News” alarm is perhaps too transparent a device to work in this respect, but they will keep mining away at the national security/paedophilia/terrorism excuses for ending this period of unprecedented freedom in mass communication.

Another device continuously deployed is for wealthy and/or powerful members of the Establishment to use identity politics to claim that they are themselves under attack. Hillary Clinton’s defeat is continually explained by her acolytes as due to “misogyny”. We had the entirelyfaked up story that the anger at Laura Kuenssberg for being blatantly anti-Corbyn was also misogyny. There is not a single Blairite female Labour MP who has not repeatedly claimed that political opposition from the left is not conditioned by her gender.

Now we have a new meme, where MPs are complaining that their children are being verbally attacked at school. Now it is very wrong that any child is ever bullied or made unhappy. If Bob Stewart was telling the truth of his child facing adverse comment from a teacher, that is bad. But life is not without its troubles, even for children. I suffered some veiled taunts from one particular teacher about the fact my father was absent from the home. When I was going through my very high profile dispute with the Foreign Office, people said things to my children. Stuff happens – I don’t want any child to be unhappy, but MPs’ children have pretty charmed lives and manage to do often “surprisingly” well at getting their first job.

Today we have Hanna Flint in the Guardian apparently traumatised by a teacher asking her when she was 13 if her mum, Caroline Flint, would vote for the war in Iraq. Again I am sorry if that upset Hanna. No child should be upset. But there are hundreds of thousands of Iraqi children a very great deal more traumatised by having close family members blown to pieces in the Iraq conflict, thanks to the hardened and nasty right wing piece of work that is Caroline Flint. I imagine their trauma is rather worse. There are plenty of Iraqi children who got maimed themselves. There are plenty of Iraqi children who, unlike Hanna, never got the chance to grow up at all, thanks to Hanna’s warmongering mum. I am sorry for your childhood pain, Hanna, I really am. I hate to see any child unhappy. But forgive me if you are not first in line for my sympathy.

Remember, if your mum was not a Blairite MP, a young journalist as bland as you would be most unlikely to get an article published in the Guardian. See, its not all that bad. being in the Establishment.

————————————————–

I continue urgently to need contributions to my defence in the libel action against me by Jake Wallis Simons, Associate Editor of Daily Mail online. You can see the court documents outlining the case here. I am threatened with bankruptcy and the end of this blog (not to mention a terrible effect on my young family). Support is greatly appreciated. An astonishing 4,000 people have now contributed a total of over £75,000. But that is still only halfway towards the £140,000 target. I realise it is astonishing that so much money can be needed, but that is the pernicious effect of England’s draconian libel laws, as explained here.

On a practical point, a number of people have said they are not members of Paypal so could not donate. After clicking on “Donate”, just below and left of the “Log In” button is a small “continue” link which enables you to donate by card without logging in.

For those who prefer not to pay online, you can send a cheque made out to me to Craig Murray, 89/14 Holyrood Road, Edinburgh, EH8 8BA. As regular readers know, it is a matter of pride to me that I never hide my address.

The post A Sense of Proportion appeared first on Craig Murray.

September 18, 2017 at 02:42PM
via Craig Murray http://ift.tt/2x8gCy8