Ask Me Anything - The Electronic Frontier Foundation (EFF)

[AndrewFreedman]

Hey everyone!

We're going to give our guests from the EFF a break to finish their day, get some food, sleep, and all that good stuff. They'll be back in the morning to finish answering your questions before the AMA closes at 12 p.m. EST. In the meantime, feel free to add questions overnight for them to get to in the morning.

Thank you all for your awesome questions, and thanks to the EFF for their time and answers so far!

 

[keepit100]

As I'm sure you know, the EFF is asking the Supreme Court to hear arguments about whether police should be allowed to collect certain kinds of DNA without a warrant.

"As human beings, we shed hundreds of thousands of skin and hair cells daily, with each cell containing information about who we are, where we come from, and who we will be," EFF Senior Staff Attorney Jennifer Lynch said. (source: https/www.eff.org/press/releases/eff-supreme-court-fourth-amendment-covers-dna-collection)

I'm all for not being in a database of DNA at my local police department, but I also don't worry about them collecting my toenail clippings. Should I? At what point is preventing DNA checks keeping police from doing their job?

This Raynor case seems quite specific, and I agree that lack of consent is lack of consent. But how do we expect the police to do their job, say, looking at crime scenes for hair and fingerprints if this goes through?

 

[natecardozo]

As I'm sure you know, the EFF is asking the Supreme Court to hear arguments about whether police should be allowed to collect certain kinds of DNA without a warrant.

"As human beings, we shed hundreds of thousands of skin and hair cells daily, with each cell containing information about who we are, where we come from, and who we will be," EFF Senior Staff Attorney Jennifer Lynch said. (source: https/www.eff.org/press/releases/eff-supreme-court-fourth-amendment-covers-dna-collection)

I'm all for not being in a database of DNA at my local police department, but I also don't worry about them collecting my toenail clippings. Should I? At what point is preventing DNA checks keeping police from doing their job?

This Raynor case seems quite specific, and I agree that lack of consent is lack of consent. But how do we expect the police to do their job, say, looking at crime scenes for hair and fingerprints if this goes through?

Hi Larry (can I call you Larry?),

Unfortunately, the Supreme Court just decided not to take the Raynor case, so we're not going to get their opinion.

But this isn't about keeping the police from doing their job. It's about making sure that the police follows the law while they do their jobs. I'll give you an example: in a case decided in 2001, the Supreme Court decided that law enforcement can't use forward looking infrared to peer through walls, unless law enforcement gets a warrant first. More recently, a federal appeals court noted that the warrantless use of handheld radar to look into a house was likely in violation of the Fourth Amendment. No one is saying that law enforcement can't use these technologies--only that they follow the Constitution (which here means getting a warrant) when they do.

As I said, our position in Raynor wasn't about keeping the police from doing their jobs. It's about exactly the opposite--making sure the police do their jobs, and get a warrant, before searching us unreasonably or seizing our property.

 

[RaNdOmReDnEcK]

no way look thru walls?? handheld radar to look into houses??? i guess DRONES are not out of the question then. I guess the other half of the question would be how do you protect yourself from such technology??? Aluminum foil???

 

[crooked windows]

We all know that every bit of electronic communication is being recorded by someone, somewhere, so what would be wrong with feeding them garbage say once a day?. just throw in the occasional trigger word during every ph call and txt and let the misinformation pile up.

 

[AndrewFreedman]

[
P.S. Thanks for ban hammering me from the site. For an AMA, there sure are a lot of rules.

-Long time EFF supporter

Just for the record, the EFF didn't delete or ban anything. You broke community policies on the Tom's Community. The EFF requested we restore your question.

 

[keepit100]

As I'm sure you know, the EFF is asking the Supreme Court to hear arguments about whether police should be allowed to collect certain kinds of DNA without a warrant.

"As human beings, we shed hundreds of thousands of skin and hair cells daily, with each cell containing information about who we are, where we come from, and who we will be," EFF Senior Staff Attorney Jennifer Lynch said. (source: https/www.eff.org/press/releases/eff-supreme-court-fourth-amendment-covers-dna-collection)

I'm all for not being in a database of DNA at my local police department, but I also don't worry about them collecting my toenail clippings. Should I? At what point is preventing DNA checks keeping police from doing their job?

This Raynor case seems quite specific, and I agree that lack of consent is lack of consent. But how do we expect the police to do their job, say, looking at crime scenes for hair and fingerprints if this goes through?

Hi Larry (can I call you Larry?),

Unfortunately, the Supreme Court just decided not to take the Raynor case, so we're not going to get their opinion.

But this isn't about keeping the police from doing their job. It's about making sure that the police follows the law while they do their jobs. I'll give you an example: in a case decided in 2001, the Supreme Court decided that law enforcement can't use forward looking infrared to peer through walls, unless law enforcement gets a warrant first. More recently, a federal appeals court noted that the warrantless use of handheld radar to look into a house was likely in violation of the Fourth Amendment. No one is saying that law enforcement can't use these technologies--only that they follow the Constitution (which here means getting a warrant) when they do.

As I said, our position in Raynor wasn't about keeping the police from doing their jobs. It's about exactly the opposite--making sure the police do their jobs, and get a warrant, before searching us unreasonably or seizing our property.

Not my name, but sure, call me Larry! (Glad you got the reference!)

That radar and infrared thing sounds spooky, so you have me convinced. My question was aimed more at a crime scene, though I suppose I don't want the police rubbing my doorknob for prints without asking!

Thanks!

 

[skipper_2]

I'll be frank... you guys come off as really, really liberal (perhaps the EFF considers itself libertarian?). I doubt you guys have an official affiliation, but that's how you come across.

Does that make it difficult to work with young Republicans, who are often some of the most knowledgeable about new technologies? How do you work with everyone on an advocate, activist, and legal level when you appear to be so established on one side of the aisle?

 

[JGillula]

We all know that every bit of electronic communication is being recorded by someone, somewhere, so what would be wrong with feeding them garbage say once a day?. just throw in the occasional trigger word during every ph call and txt and let the misinformation pile up.

Strategies like this have been attempted, and while they might work for automated tracking (e.g. targeted advertising profiles), they certainly wouldn't work against surveillance by a human (e.g. if law enforcement wanted to learn something about you specifically from your online communications). It's also tough to make this work even against automated tracking, because you're trying to mask something potentially unique (your actual communications) with something that's supposed to be generic (the garbage). It's tricky (when it's even possible) to find the balance.

 

[trilldriselba]

If I want to use tools like Tor or HTTPS Everywhere, I have to go download them from my current browser. Will going to those sites and downloading/installing those tools increase my risk for being spied on? How about those on my network (especially if they don't use the tools)?

 

[AndrewFreedman]

Hey all - The EFF is on the West Coast, so we're going to extend their time to 1:30 p.m. EST in order to give them time to answer all of your questions.

 

[turkey3_scratch]

What are your thoughts on the lack of technological education in many countries, particularly America? Do you think that if America was more technologically and cyber-security educated like Britain and had computer science as a required curriculum course, people would be more knowledgeable in seeing their own vulnerabilities and less susceptible to attacks, viruses, and phishing on their local devices, as well as troubleshooting how to fix these problems?

 

[jcbeff]

What are your thoughts on the lack of technological education in many countries, particularly America? Do you think that if America was more technologically and cyber-security educated like Britain and had computer science as a required curriculum course, people would be more knowledgeable in seeing their own vulnerabilities and less susceptible to attacks, viruses, and phishing on their local devices, as well as troubleshooting how to fix these problems?

I was educated in the both the UK and US systems (Bachelors and Masters degrees in the US and PhD in the UK). I don't think the UK has achieved a dramatically higher rate of education of computer science or tech. There's lots of room for improvement in both countries and around the world! Unfortunately school curriculums change very slowly, particularly at the lower levels of education, but we're starting to see some schools integrate computer science teaching at an earlier age.

In any case though as a technologist, I think it's important to focus on fixing tech and not fixing people. Cars have gotten much safer to drive without teaching everybody how antilock brakes work. Most of the problems you mentioned (viruses, phishing) can be improved technologically. Indeed there really has been dramatic progress on phishing in the past 5 years with automatic phishing blacklists, it hasn't been widely heralded but the problem has slowly declined in significance. And both Android and iOS have been, on the whole, less susceptible to viruses than Windows (newer versions of Windows have improved as well).

So I think universal computer science education is critically important-computers are too important in the world and it's valuable that everybody understands them on a basic level. But specifically for security problems, I think it's not particularly helpful to blame ignorant users when we have a long ways to go improving the technology.

 

[trilldriselba]

Is cyberwar an upcoming issue? Russia? China? Iran? North Korea? Is our data going to be the casualties in the next war games?

 

[natecardozo]

As I'm sure you know, the EFF is asking the Supreme Court to hear arguments about whether police should be allowed to collect certain kinds of DNA without a warrant.

"As human beings, we shed hundreds of thousands of skin and hair cells daily, with each cell containing information about who we are, where we come from, and who we will be," EFF Senior Staff Attorney Jennifer Lynch said. (source: https/www.eff.org/press/releases/eff-supreme-court-fourth-amendment-covers-dna-collection)

I'm all for not being in a database of DNA at my local police department, but I also don't worry about them collecting my toenail clippings. Should I? At what point is preventing DNA checks keeping police from doing their job?

This Raynor case seems quite specific, and I agree that lack of consent is lack of consent. But how do we expect the police to do their job, say, looking at crime scenes for hair and fingerprints if this goes through?

Hi Larry (can I call you Larry?),

Unfortunately, the Supreme Court just decided not to take the Raynor case, so we're not going to get their opinion.

But this isn't about keeping the police from doing their job. It's about making sure that the police follows the law while they do their jobs. I'll give you an example: in a case decided in 2001, the Supreme Court decided that law enforcement can't use forward looking infrared to peer through walls, unless law enforcement gets a warrant first. More recently, a federal appeals court noted that the warrantless use of handheld radar to look into a house was likely in violation of the Fourth Amendment. No one is saying that law enforcement can't use these technologies--only that they follow the Constitution (which here means getting a warrant) when they do.

As I said, our position in Raynor wasn't about keeping the police from doing their jobs. It's about exactly the opposite--making sure the police do their jobs, and get a warrant, before searching us unreasonably or seizing our property.

Not my name, but sure, call me Larry! (Glad you got the reference!)

That radar and infrared thing sounds spooky, so you have me convinced. My question was aimed more at a crime scene, though I suppose I don't want the police rubbing my doorknob for prints without asking!

Thanks!

In a crime scene context, assuming the police are legally there in the first place, I don't think anyone would argue that they couldn't collect shed DNA. In any case, back to your original question: should you worry about your DNA getting into a police database? I'd argue that unless you've been convicted of a crime (or according to some courts, simply arrested for certain types of crimes), it would likely be illegal for the police to collect and store your DNA data.

 

[bloodelf]

A lot of this has been individual oriented? How can IT professionals go above and beyond in protecting their networks and those of their organizations?

 

[AndrewEFF]

I'll be frank... you guys come off as really, really liberal (perhaps the EFF considers itself libertarian?). I doubt you guys have an official affiliation, but that's how you come across.

Does that make it difficult to work with young Republicans, who are often some of the most knowledgeable about new technologies? How do you work with everyone on an advocate, activist, and legal level when you appear to be so established on one side of the aisle?

You're right we are non-partisan. We support your rights in the digital world, which includes civil liberties, standing up for fair use, and so on. These issues appeal to different people of different political affiliations, and we've worked with Democrats, Republicans, Tea Party members and many others on cases, legislation, and advocacy, not to mention less formal projects. No single political group agrees with us on everything, but that's the way it should be. For example, last year we put up a post about why surveillance is a Tea Party issue, and that was somewhat controversial with liberal folks. I just don't think perceptions about our political leanings stand in the way of our work -- we build coalitions and advocate for controversial causes every day.

 

[idontwantthisaccountbutmyotheronesarebanned]

A few questions:

• ■What's your thoughts on allowing [strike]electronic[/strike] online voting? Do you think the benefits in terms of increasing voter turnout (particularly amongst young people) outweigh the dangers of poor and insecure implementation?
  
  ■Some countries, notably Brazil, have chosen not to buy equipment from the US specifically as a result of the NSA's spying. Do you expect this to have any significant impact?
  

EFF,

By my count EFF took on 1 case (EFF v. NSA) and spent a total of 10 minutes in court (Smith v. Obama) for the entire year of 2014. EFF spent the year of 2014, primarily blogging commentary on national news stories, which is not legal advise. The legal documents EFF does spend most of it time filing, are public opinion Amicus Briefs. At that, a measly 7 Amicus Briefs were filed for new cases in 2014.

Can you help me understand why EFF spent such little time inside of a court room for the year of 2014? Do I have a misunderstanding of the EFF's mission? I thought the EFF was supposed to be an organization that protected our digital rights in the courtroom. All I have seen from the EFF in the past year has been drumming for donations, blogging, cheerleading, and foot stomping.

Can we expect to see EFF take on more legal cases, and spend more time in a courtroom, actively fighting for digital rights, in 2015? There certainly seems to be no shortages of legal challenges to take on.

-Long time EFF supporter

I'm sorry that you're disappointed in us, but I hope I can clear things up a bit.

First, I would say that assessing our legal work by the number of minutes we spend in court or even the number of new cases we take on is really a poor metric. Despite the television portrayals, litigation is a slow-moving beast, and most of it involves exchange of papers between the parties and the court, not arguing in front of a judge. Parties often have little control over when they actually appear in court; this is mostly a function of the judge's calendar and other administrative factors. Moreover, EFF practices impact litigation, which means we only take on cases if we think they can make a positive change in the law or prevent it from getting worse. So unlike your average law firm, we don't measure our effectiveness by billable hours.

Litigation is important, but it's not all the EFF legal team does--we file comments with administrative agencies, testify before state and federal legislatures, offer legal counseling and advice, and yes, do outreach work. Finally, that's just the work of the legal team; describing the work of EFF's other teams would take volumes.

We file a lot of amicus briefs, it's true, but those can impact the law. We are often contacted proactively by courts who want us to file amicus briefs in order to have input with a sophisticated understanding of technology. In one such case, United States v. Vargas, EFF filed an amicus brief that was relied on by a judge in ruling that the government's installation of a pole camera overlooking a defendant's front yard and secretly recording his activities for more than a month was unconstitutional. The government appealed, and EFF now represents Mr. Vargas directly.

To clear up any misunderstanding, however, EFF lawyers spent way more than 10 minutes in court in 2015, and we took on a ton of new cases, in addition to all of our other work. Off the top of my head, we had major hearings in our NSA cases (Smith, Jewel, and as amicus in Klayman v. Obama), our National Security Letter cases, defending student developers, arguing for government transparency, stopping patent trolls, on and on. We had a single hearing in Jewel v. NSA in December 2014 that lasted 3+ hours.

As for new cases, again I can't give you a complete list, but we filed a number of FOIA suits, defended clients against bogus copyright and trademark demands, initiated agency proceedings, and so on. Again, this is in addition to some of our bigger cases, like Jewel, which has been going strong since 2008. In other words, we play a long game and a short game. 2015 won't be any different.

To piggyback on Andrew, one of the cases I'm proudest of launched in 2014. We're suing the government of Ethiopia: https/www.eff.org/cases/kidane-v-ethiopia

I understand the difference between TV and the flesh reality world that we live in.

So the EFF spent about 3+ hours in a court room for the entire year of 2014. This is appalling.

So if this is a bad metric, please provide an example of a good metric. EFF has not had a single victory, in the entire year of 2014, that it can conclusively point to as an example of its progress. Yes, I would certainly say the fact that EFF spent a total of 3+ hours in a courtroom, for an entire year, attributed to such a poor performance by the organization.

Less legal blogging, more legal action.

I hope 2015 you spend 6+ hours in a court room fighting for digital rights!

Thank you,
-Long time EFF supporter

I don't know that I'm going to be able to convince you, but I will point out that I was saying we had a single hearing that lasted 3 hours. To repeat: we spent many, many hours in court in 2014.

I would still say you're taking a narrow view of our work. For example, in 2013 we won a major victory by having the National Security Letter statute (part of the Patriot Act) declared unconstitutional. We spent a sizable amount of time in 2014--including, yes, in a hearing--defending this victory on appeal. We still don't have a decision in that appeal yet, though, because litigation is slow. We can't control the courts--not their pace and not the decisions they issue. We make the most persuasive arguments we can, but we can't force victories in court.That's part of why we don't spend all of our time litigating. We have had numerous victories in getting legislative reforms, positive changes in technology, etc etc. I stand by our effectiveness and our success, but that's for you and our other supporters to judge.

-------------------------------------

Will someone from the EFF please respond my followup question to this response from Andrew before the AMA closes in 20 minutes? Thanks for extending the AMA for an extra 30 minutes.

-Long time EFF supporter

---Updated 5 minutes before AMA closes-----

EFF,

Shame on you.

-Long time EFF supporter

 

[AndrewFreedman]

Hi everyone!

This AMA is now closed.

Thanks to everyone who asked questions, and a huge thanks to Nate, Parker, Nadia, Andrew, Jeremy and Joseph for taking time out of their busy schedules at the EFF to answer questions for the Tom's Community!