Slashdot Mirror

An anonymous reader quotes a report from ZDNet: Members of Amnesty International say that Egyptian authorities are behind a recent wave of spear-phishing attacks that have targeted prominent local human rights defenders, media, and civil society organizations' staff. The attacks used a relatively new spear-phishing technique called "OAuth phishing," Amnesty experts said. OAuth phishing is when attackers aim to steal a user account's OAuth token instead of the account password. When a user grants a third-party app the right to access their account, the app receives an OAuth token instead of the user's password. These tokens work as authorization until the user revokes their access. Amnesty investigators said that in the recent spear-phishing campaign that targeted Egyptian activists, authorities created Gmail third-party apps through which they gained access to victim's accounts. Victims would receive an email that looked like a legitimate Gmail security alert. But when they clicked the link, they'd be redirected to a page where a third-party app would request access to their account. Once the victim granted the app access to their Gmail account, the user would be redirected to the account's legitimate security settings page where they'd be left to change their password. Even if the victim changes their password, at this point, the phishers would still have access to the account via the newly acquired OAuth token. The Amnesty International report says the spear-phishing campaign also targeted Yahoo, Outlook and Hotmail users.

That shocking statistic comes from a study conducted by Amnesty International and AI software startup Element AI. From a report: In the study, called Troll Patrol, Amnesty International and Element AI looked at data from 288,000 tweets sent to 778 female politicians and journalists in the U.S. and U.K. in 2017. Using machine learning on the data, the group then extrapolated just how wide-ranging abuse toward women is on Twitter. The result: 1.1 million abusive or problematic tweets were sent to the women in the study during the year -- that's one abusive or problematic tweet every 30 seconds. And it's even worse for women of color -- and especially black women -- who were targeted more frequently than white women.

GCHQ's methods in carrying out bulk interception of online communications violated privacy and failed to provide sufficient surveillance safeguards, the European court of human rights (ECHR) has ruled in a test case judgment. From a report: But the Strasbourg court found that GCHQ's regime for sharing sensitive digital intelligence with foreign governments was not illegal. It is the first major challenge to the legality of UK intelligence agencies intercepting private communications in bulk, following Edward Snowden's whistleblowing revelations. The long-awaited ruling is one of the most comprehensive assessments by the ECHR of the legality of the interception operations operated by UK intelligence agencies. The case was brought by a coalition of 14 human rights groups, privacy organisations and journalists, including Amnesty International, Liberty, Privacy International and Big Brother Watch. In a statement, published on Amnesty's website, Lucy Claridge, Amnesty International's Strategic Litigation Director, said, today's ruling "represents a significant step forward in the protection of privacy and freedom of expression worldwide. It sends a strong message to the UK Government that its use of extensive surveillance powers is abusive and runs against the very principles that it claims to be defending." He added: This is particularly important because of the threat that Government surveillance poses to those who work in human rights and investigative journalism, people who often risk their own lives to speak out. Three years ago, this same case forced the UK Government to admit GCHQ had been spying on Amnesty -- a clear sign that our work and the people we work alongside had been put at risk. The judges considered three aspects of digital surveillance: bulk interception of communications, intelligence sharing and obtaining of communications data from communications service providers. By a majority of five to two votes, the Strasbourg judges found that GCHQ's bulk interception regime violated article 8 of the European convention on human rights, which guarantees privacy, because there were said to be insufficient safeguards, and rules governing the selection of "related communications data" were deemed to be inadequate, The Guardian newspaper reported.

Commenting on the ruling, Snowden, wrote, "For five long years, governments have denied that global mass surveillance violates of your rights. And for five long years, we have chased them through the doors of every court. Today, we won. Don't thank me: thank all of those who never stopped fighting."

An anonymous reader writes: In May we discussed news that three bloggers in Bangladesh had been targeted for brutal killings in recent months over what they wrote online. Now, the local branch of Al-Qaeda is claiming responsibility for a new victim, blogger Niloy Chakrabarti. "The journalist had contributed to the humanist blogging platform Mukto-Mona. His posts often were critical of Islam. Mukto-Mona was established by another blogger—Avijit Roy, who was murdered in Bangladesh in February." His murder was as ghastly as the previous three — six men broke into his apartment with machetes. Rights groups are condemning the killings and demanding that the government put a stop to them. "There is little doubt that these especially brutal killings are designed to sow fear and to have a chilling effect on free speech. This is unacceptable."

Lasrick writes "Motherboard's Africa correspondent, Amanda Sperber, has a great piece on how protesters in Sudan are getting around the government's shutdown of the internet. Quoting: 'Since Wednesday afternoon, Sudan's internet has been sporadically shut off amid a fifth day of protests against President Omar al Bashir's regime. Despite the attempt to cut off communications and limit organization and reporting on the ground, a group of tech-savvy people based in Khartoum have developed a map for recording key data about the protests that's powered by cell networks. '"

Regular contributor Bennett Haselton writes "As Google releases more data about their compliance with requests from foreign governments, they should clarify their stance on exactly when they will comply with requests to turn over user data to foreign law enforcement." Bennett expands on that thought below; read on for some details of just why that kind of disclosure matters, in making sense of Google's own efforts to provide transparency. Google, as part of its ongoing Transparency Project, announced last week the release of its latest data on takedown requests and user account information requests from governments around the world. I'm glad that notorious human rights violators like Turkey are still scoring 0 for 88 in their requests to get Google to turn over information on users allegedly breaking Turkish law. But Google should still clear up some ambiguities in its stated policies about when it will remove content in response to a government request, and (especially) when it will turn over user information to foreign law enforcement. Google's FAQ on user data requests says that "whenever we receive a request we make sure it meets both the letter and spirit of the law before complying." This, however, raises a few questions:

1. Does "the letter and spirit of the law" refer to U.S. law, or the law in the country from which law enforcement sends the request? Presumably if a user in China or Saudi Arabia were using their Google account to send messages that criticized their own government, in violation of local "laws," Google would not turn over that user's information to that country's law enforcement on demand. That should be an easy call, since China and Saudi Arabia are dictatorships. But what about democratic countries like Canada and Germany, which nonetheless have anti-hate-speech laws that are inconsistent with American free speech guarantees? If German law enforcement demanded the identity of a German account holder who was publishing Nazi propaganda (which would be legal in the U.S., but is illegal in Germany), what would Google do?

2. What if foreign law enforcement claims that a Google account holder is doing something which would be illegal even in the U.S. — but the request comes from a country where law enforcement is known to be corrupt? And what if the claim is such that Google can't verify the veracity of the claim by simply looking at the account contents? (For example, if law enforcement claims that a criminal gave the police a gmail.com address as a Dropbox for them to respond to a ransom demand, Google can't verify that claim just by looking at the contents of the inbox.) In such cases, does Google respond to the request anyway, even if the police might be lying in order to unmask a Google account holder who hasn't done anything illegal?

3. Does the answer to either #1 or #2 above depend on whether Google has offices in the country making the request, and can be more easily pressured to comply with their demands?

With regard to governmental requests to remove content, Google has also not explicitly stated whether they use local laws or U.S. laws as a guideline. However, based on the incidents in the Notes section, the rule seems to be: Google will remove content only if it violates Google's own terms of service, but if content violates local laws in a given country, Google may block access to that content from that country, even if the content doesn't violate Google's policies. For example, Google restricted users in Thailand from viewing YouTube videos that offended the Thai monarch, and restricted Turkish users from viewing two videos that criticized Atatürk. As insulting as this is to the free speech rights of the people of those nations, Google could argue that if they hadn't restricted those videos, the entire YouTube site would have been blocked in those countries (which it has been in the past, in both Thailand and Turkey). And at least having your YouTube videos blocked in your home country won't put you in physical danger.

On the other hand, having your identity unmasked and turned over to your government could put you at risk of arrest and a long prison sentence, as happened to Shi Tao after Yahoo disgracefully turned his information over to Chinese officials. So it's a good thing that Google's compliance rate with user data requests is much lower. But given the higher stakes, it's all the more important for Google to clarify when they will comply with such requests.

I sent a message to Google's press office asking about their policy of following the "letter and spirit of the law" in complying with data requests, and whether that referred to U.S. law or the law in the country whose government made the demand. I got back a response copied and pasted from the user data requests FAQ:

Like all law-abiding companies, we comply with valid legal process. We take user privacy very seriously, and whenever we receive a request we make sure it meets both the letter and spirit of the law before complying. When possible and legal to do so, we notify affected users about requests for user data that may affect them. And if we believe a request is overly broad, we will seek to narrow it.

I immediately wrote back:

But when you say you make sure a request "meets both the letter and spirit of the law", whose law are you talking about — U.S. law, or the law of the country where the request originated?

If Saudi Arabia has laws on the books against criticizing the King, and the Saudi police use that as the pretext to demand that you turn over a subscriber's identity because that user criticized the government, I presume you don't comply with requests like that. But does that mean that you only turn over subscriber identities if the foreign law enforcement can show that the subscriber did something that would be illegal under U.S. law?

(It's always a bit awkward trying to turn a cut-and-paste job into a real conversation.) Google's PR said they had nothing more to add, but I've asked some mid-to-highly-placed friends at the company to see if they could get someone to comment in more detail, and I'll follow up if they get back to me.

The question came up when I was at a conference talking with some activists from Latin America, who were asking about the safest way to email a sensitive message or document out of the country over an encrypted connection, to a contact person in the U.S. I said that even though they had already heard about solutions like Tor and PGP, the simplest solution in their case would just be to use Gmail to send the message or the file, since their connection to Google's Gmail servers in the U.S. would be encrypted over https://. (Once the message is sent out from Gmail's servers to its recipient, it would be transmitted unencrypted, but by that point the law enforcement in the sender's home country would no longer be able to intercept it.) Another techie pointed out that Google had long been complying with many foreign governments' requests for user data, as documented on their Transparency Project page, and said that should be taken into account before recommending for anyone to use Google products in a hostile country.

But if you look at the Transparency Project chart for user data requests, it looks like Google does not regularly hand out user data to regimes that are major human rights violators (the only two such countries appearing on the list are Russia and Turkey, and Google has apparently complied with exactly 0% of their requests). I'm not a fan of everything that every other country on that list has done, but they're mostly democratic nations that are probably not abusing the data request process as much as, say, Venezuela would.

So even without specific assurances from Google, I still think that Gmail is safer than PGP for the purpose of sending an encrypted message out of a hostile country without attracting attention to yourself. Remember, if you send a message to someone encrypted with PGP, and a third party intercepts the message, the interceptor can still see that the encrypted portion is bookended with the words "BEGIN PGP ENCRYPTED MESSAGE" and "END PGP ENCRYPTED MESSAGE" — so even if they can't tell what you said, they still know that you went out of your way to send an encrypted email. (Similarly, if you're using Tor, an eavesdropper can't tell what you did over your encrypted Tor connection, but they could still detect that you're using Tor, either by studying the traffic patterns or by keeping a list of known Tor servers and watching to see if you connect to one of them.) By contrast, everyone who connects to Gmail, connects automatically over an encrypted https:// connection, so an eavesdropper would not detect anything unusual about your usage of Gmail that might tip them off that you were trying to hide something. Gmail is the safest of the major mail providers in this regard; Hotmail serves your messages over an encrypted connection only if you opt in to that feature, and Yahoo Mail doesn't provide that option at all. So it's precisely because Gmail is an almost-perfect secure communications solution, that I'd really like to be able to trust it even more, by getting a clearer statement from Google about when exactly it would turn over a subscriber's identity to a government.

Google seems like they're trying to do the right thing in response to demands from foreign countries with less-than-stellar human rights records. With regard to user data requests, Google must be following some internal rule, and the right thing to do would be to tell us what the rule is.

Frequent Slashdot contributor Bennett Haselton writes "Tunisia's high court will decide on Wednesday whether to allow censoring of websites containing pornography or 'calls to violence.' It's disappointing that censorship continues in post-revolutionary Tunisia, but it's enough of an improvement over the old regime, that anti-censorship cyber-activism efforts would probably best be spent on helping other countries." Read on for Bennett's analysis.

In Tunisia, where dictator Zine El Abidine Ben Ali was ousted one year ago amid hopes for a new era of freedom, the high court will decide on Wednesday whether to censor foreign pornographic websites in accordance with local law. Facebook pages that "call for violence" may also be blocked. Conveniently, all the machinery for censoring the Internet in Tunisia is already in place, having been installed under Ben Ali's dictatorship for the purposes of censoring and spying on Tunisian citizens (and, for a while, phishing their Facebook passwords). The irony recalls the situation in Iraq in 2009, when the government announced plans to start censoring foreign websites -- to which Iraqi citizens complained that they thought censorship would end with the fall of Saddam's regime. Actually, apart from the three outlier countries of Turkey, Israel and Lebanon, pornography remains illegal in every Middle Eastern country (and some conservative African nations), including the recently "liberated" ones including Egypt, Iraq and Tunisia. (Although, Iraq's street market in pornography thrives as long as the police have better things to do.)

I'm against such censorship in principle -- I think that even the right to publish and access pornography counts as a fundamental human right. But I think we have to take what progress we can get, and censoring just pornography and calls to violence, is a big improvement over censoring pornography and dissident political speech, which is the norm in most non-"liberated" Middle Eastern countries like Syria, Iran, and Saudi Arabia. Syria blocks foreign opposition sites like All4Syria.info, Iran blocks Facebook and YouTube to keep dissidents from posting or viewing anti-government material, and Saudi Arabia blocks Reporters Without Borders and filters the Amnesty International report on human rights in Saudi Arabia (but not the rest of the Amnesty International site!).

Saudi Arabia blocking the Amnesty International report on human rights in their country (while leaving the rest of the site unblocked), in particular, seems like the kind of thing that a government would do more as a "fuck you" to human rights activists, than a means to achieve a practical goal. For one thing, most of the facts in the human rights report about Saudi Arabia -- about sex discrimination and lack of political and religious freedom -- are already well known to the people who live there. And secondly, what percent of the citizens of a country would ever read the Amnesty International report on human rights in that country, even if it were not blocked? How many Americans even know that Amnesty puts out an annual report about human rights violations in the United States? So it seems more like a symbolic move to remind everyone who's in charge. For all the disappointment in the lack of progress for free speech in post-"liberation" countries, the non-"liberated" ones are indeed worse.

As for the Tunisian proposal to censor "calls to violence", I wouldn't always be against that, even in principle. In most countries, direct incitements to violence can be considered illegal (it depends on what you say and, of course, on what judge you get). In a developing country rife with ethnic tensions, even greater restrictions on calls to violence could be justified. When you finally watched Hotel Rwanda , weren't you hoping someone would bust in on that radio DJ telling everyone to kill Tutsis in the middle of a civil war, and blow him to hell? The biggest problem with a rule against "calls to violence" is that the government could stretch the definition to silence political speech. But it's possible to keep that kind of abuse in check, as has mostly been achieved in the U.S. For that, what you need is an independent judiciary, not an abolishment of all rules against calls to violence.

So the free-speech situation in "liberated" Tunisia may be nothing to write home about, but it sounds much better than it used to be, when writing home to complain about it could get you arrested. A Wall Street Journal article from July 2011 describes how, under Ben Ali's dictatorship, Tunisian cyber-activist Slim Amamou had been imprisoned and abused by the police for calling for peaceful demonstrations. Post-revolution, he was freed and asked to join the interim government, where the strictest restriction placed on him was to "stop sending Twitter messages during internal government meetings to his 25,000 followers". They may not have their porn, but that's still progress.

Of course, if someone in Tunisia wants to circumvent the government filters (using tools like proxy sites, VPNs, Tor, UltraSurf, Psiphon, etc.) and get to a porn site, more power to them. I just wouldn't make it a priority to set aside resources to help them get it. Not while there are Iranians who need help getting around the latest restrictions blocking them from Facebook and Gmail.

Two caveats. First, if someone wants to sell circumvention services to Tunisians who just want to get around the porn blocker, that doesn't count as "setting aside resources", so that's a perfectly noble endeavor. In fact, given the economies of scale in the circumvention business, selling to Tunisians could help to bring the price down for other users, including users in countries like Saudi Arabia where the government does engage in political filtering, and where circumvention services could be a tool for social change. Second, providing circumvention services (free or paid) to Tunisians, does probably make it less likely that the new government would revert to political censorship, knowing that many of its citizens have the tools to beat it, even if those tools are only currently used to access porn sites. So to that extent, setting aside resources to provide circumvention services in Tunisia might be a worthwhile cause.

Still, I think it's a lot less important than using circumvention tools to fight political censorship in truly autocratic countries like Iran. For the next generation of proxy servers that I'm rolling out, I'm working on setting aside some of them just for Iranian IP addresses. Even if Iranians just use them to get on Facebook, that's still contributes more to advancing the cause of social democracy, than Tunisians using them to get on Playboy.

Frequent Slashdot contributor Bennett Haselton writes "Tunisia's high court will decide on Wednesday whether to allow censoring of websites containing pornography or 'calls to violence.' It's disappointing that censorship continues in post-revolutionary Tunisia, but it's enough of an improvement over the old regime, that anti-censorship cyber-activism efforts would probably best be spent on helping other countries." Read on for Bennett's analysis.

In Tunisia, where dictator Zine El Abidine Ben Ali was ousted one year ago amid hopes for a new era of freedom, the high court will decide on Wednesday whether to censor foreign pornographic websites in accordance with local law. Facebook pages that "call for violence" may also be blocked. Conveniently, all the machinery for censoring the Internet in Tunisia is already in place, having been installed under Ben Ali's dictatorship for the purposes of censoring and spying on Tunisian citizens (and, for a while, phishing their Facebook passwords). The irony recalls the situation in Iraq in 2009, when the government announced plans to start censoring foreign websites -- to which Iraqi citizens complained that they thought censorship would end with the fall of Saddam's regime. Actually, apart from the three outlier countries of Turkey, Israel and Lebanon, pornography remains illegal in every Middle Eastern country (and some conservative African nations), including the recently "liberated" ones including Egypt, Iraq and Tunisia. (Although, Iraq's street market in pornography thrives as long as the police have better things to do.)

I'm against such censorship in principle -- I think that even the right to publish and access pornography counts as a fundamental human right. But I think we have to take what progress we can get, and censoring just pornography and calls to violence, is a big improvement over censoring pornography and dissident political speech, which is the norm in most non-"liberated" Middle Eastern countries like Syria, Iran, and Saudi Arabia. Syria blocks foreign opposition sites like All4Syria.info, Iran blocks Facebook and YouTube to keep dissidents from posting or viewing anti-government material, and Saudi Arabia blocks Reporters Without Borders and filters the Amnesty International report on human rights in Saudi Arabia (but not the rest of the Amnesty International site!).

Saudi Arabia blocking the Amnesty International report on human rights in their country (while leaving the rest of the site unblocked), in particular, seems like the kind of thing that a government would do more as a "fuck you" to human rights activists, than a means to achieve a practical goal. For one thing, most of the facts in the human rights report about Saudi Arabia -- about sex discrimination and lack of political and religious freedom -- are already well known to the people who live there. And secondly, what percent of the citizens of a country would ever read the Amnesty International report on human rights in that country, even if it were not blocked? How many Americans even know that Amnesty puts out an annual report about human rights violations in the United States? So it seems more like a symbolic move to remind everyone who's in charge. For all the disappointment in the lack of progress for free speech in post-"liberation" countries, the non-"liberated" ones are indeed worse.

As for the Tunisian proposal to censor "calls to violence", I wouldn't always be against that, even in principle. In most countries, direct incitements to violence can be considered illegal (it depends on what you say and, of course, on what judge you get). In a developing country rife with ethnic tensions, even greater restrictions on calls to violence could be justified. When you finally watched Hotel Rwanda , weren't you hoping someone would bust in on that radio DJ telling everyone to kill Tutsis in the middle of a civil war, and blow him to hell? The biggest problem with a rule against "calls to violence" is that the government could stretch the definition to silence political speech. But it's possible to keep that kind of abuse in check, as has mostly been achieved in the U.S. For that, what you need is an independent judiciary, not an abolishment of all rules against calls to violence.

So the free-speech situation in "liberated" Tunisia may be nothing to write home about, but it sounds much better than it used to be, when writing home to complain about it could get you arrested. A Wall Street Journal article from July 2011 describes how, under Ben Ali's dictatorship, Tunisian cyber-activist Slim Amamou had been imprisoned and abused by the police for calling for peaceful demonstrations. Post-revolution, he was freed and asked to join the interim government, where the strictest restriction placed on him was to "stop sending Twitter messages during internal government meetings to his 25,000 followers". They may not have their porn, but that's still progress.

Of course, if someone in Tunisia wants to circumvent the government filters (using tools like proxy sites, VPNs, Tor, UltraSurf, Psiphon, etc.) and get to a porn site, more power to them. I just wouldn't make it a priority to set aside resources to help them get it. Not while there are Iranians who need help getting around the latest restrictions blocking them from Facebook and Gmail.

Two caveats. First, if someone wants to sell circumvention services to Tunisians who just want to get around the porn blocker, that doesn't count as "setting aside resources", so that's a perfectly noble endeavor. In fact, given the economies of scale in the circumvention business, selling to Tunisians could help to bring the price down for other users, including users in countries like Saudi Arabia where the government does engage in political filtering, and where circumvention services could be a tool for social change. Second, providing circumvention services (free or paid) to Tunisians, does probably make it less likely that the new government would revert to political censorship, knowing that many of its citizens have the tools to beat it, even if those tools are only currently used to access porn sites. So to that extent, setting aside resources to provide circumvention services in Tunisia might be a worthwhile cause.

Still, I think it's a lot less important than using circumvention tools to fight political censorship in truly autocratic countries like Iran. For the next generation of proxy servers that I'm rolling out, I'm working on setting aside some of them just for Iranian IP addresses. Even if Iranians just use them to get on Facebook, that's still contributes more to advancing the cause of social democracy, than Tunisians using them to get on Playboy.

eldavojohn writes "Amnesty International is reporting an unusual case of censorship in which Chinese police questioned HIV/AIDS workers in China and instructed them to cancel an airing of a documentary made by Aizhixing Institute of Health Education on the disease. The director of that NGO recently left China after constant police harassment. The canceled documentary was about Tian Xi, a patient who contracted HIV by blood transfusion at age 9."

Regular contributor Bennett Haselton has written in to say that "The Global Online Freedom Act, introduced last year during a firestorm of controversy over American companies cooperating with totalitarian governments in China and elsewhere, was introduced this month as the Global Online Freedom Act of 2007. When Chris Smith (R-NJ) first introduced the law in 2006, Yahoo was under fire for recently turning over information to Chinese authorities that led to the arrest of a political dissident, Microsoft was attacked for removing pages from MSN Spaces China at the behest of the government, Google was being criticized for removing political sites from search results displayed to China, and Cisco was accused of helping to enable Chinese filtering of the Web. All four corporations testified at a February 2006 House hearing during which Representative Tom Lantos summed up the mood of many of his colleagues by telling the companies, "I do not understand how your corporate leadership sleeps at night." The companies protested that they had no choice but to comply with local Chinese laws, but that they were troubled by their own actions, and -- in a rarity for individual tech companies, much less for a chorus -- they all invited the U.S. government to play a bigger role, while being vague about what the role should be."

GOFA would create a U.S.-government-designated list of "Internet restricting countries" and would in most cases prohibit U.S.-based companies from censoring content or turning over users' information to the governments of those countries. Do these companies want GOFA to pass? And is GOFA a good law? I think, yes and yes, but the answers are more complicated than they seem.

With American "collaboration" less in the news, GOFA made less of a splash when it was re-introduced this year, but it is still the subject of spirited debate. Reporters Without Borders, Amnesty International, and other human rights groups have already signed a statement supporting the July 2006 version of the bill (nearly identical the 2007 version). But blogger-journalist Rebecca MacKinnon argues that by creating a government-maintained list of "Internet censoring countries", the law falls short of calling for support of free speech in all countries (the initial list, for example, includes Iran and China, but leaves out notorious human rights violator and net-censor Saudi Arabia). Danny O'Brien of the EFF backs this position as well, and also argues the organization's long-standing position that "code is speech" and that filtering software should not be subject to export regulations that are proposed in the law.

I agree with MacKinnon that instead of using a list of "Internet restricting countries", we should require the same standards of U.S. companies wherever they do business, or at least, stop playing silly games like leaving Saudi Arabia off of a list of human rights violators because Bush is friends with the ruling family. I agree with the EFF that filtering software should be considered First-Amendment-protected speech like encryption software, and not be included on an export-prohibited "munitions" list. And for reasons listed below, I think that the law won't stop censoring countries from blocking any speech they want. But even with all of these qualifications, I think the law would be a step in the right direction, if only for the rules prohibiting companies from turning over users' personal information to the governments of countries like China and Iran. It's painful to give a pass to countries like Germany that also censor political speech, but I think that the situation is so much worse in places like China that we should do what we can in the short term. And for reasons I'll get into, I think that Microsoft, Yahoo, Google and Cisco are secretly hoping that a law like GOFA does get passed -- even if they can't come out and say so.

First, what the law does not do: There is still nothing to stop a U.S. company from blocking or removing legal, political content at the request of a foreign government. Section 204 says only that American content-hosting companies and content-filtering companies have to provide the U.S. government with a list of sites that have been removed or blocked at the behest of a censoring country.

Section 205 does say that U.S. companies may not block or remove sites that are operated by the U.S. government, or by any entity that receives grants from the International Broadcasting Bureau to help defeat foreign censorship. Presumably that would include Peacefire, at least during the periods when we're under contract to the IBB to develop the Circumventor software (but before you start calling me Hallibennett, I'm not working for the IBB right now, and it was my own idea to write this). So the American government, while requiring schools to block us in the U.S., would actually be helping to get us un-blocked in China and Iran! But Section 205 only says that a U.S. business may not block or shut down such sites. As far as I can tell, that means if the Cisco engineer on site in China sets up their routers for them, the Cisco engineer can't put VOANews.com on the block list. But then the Chinese official can walk across the room and add it to the list himself, can't he? Which is almost certainly what they'll do, since the routers are in their country.

So, I think the regulations against Internet blocking will be easy for foreign governments to ignore. But where the law could make a difference is in the prohibition against turning over users' personal data to law enforcement in censoring countries. Section 201 says that servers located in a censoring country cannot contain personally identifiable user information (so that the local police cannot simply storm in and seize the data). Section 202 says that American companies can only turn information over to law enforcement of a censoring country if the information is needed "for legitimate foreign law enforcement purposes as determined by the Department of Justice". MacKinnon has criticized this aspect of the law as well -- "If Americans don't want the DOJ to have access to their user information, why should anybody else?" Very true. But, even at the lowest point of public confidence in the Department of Justice, I think most people living outside of fortified compounds stocked with beef jerky and gold bullion, can agree that the U.S. DoJ has more integrity and legitimacy than the government of China, and that such a rule would mean fewer Chinese dissidents going to jail.

What do the affected U.S. companies think of the law? Microsoft, Yahoo, and Cisco did not respond to requests for comment. A Google PR person replied to say, "We welcome intiatives that expand access to information and protect the rights of users across the globe. At the same time, we remain concerned that legislation in this area can have unintended consequences, so we intend to study any such proposals closely, and work with proponents and others to reach the right outcome." When I replied that the Global Online Freedom Act had been proposed more than a year ago and had been online in its current form since June 2006, presumably enough time to "study such a proposal closely" and take a position on it, he said they would stick with that statement for now. (In his e-mail, he actually put quote marks around the company's statement, which I thought was a nice dry touch.)

But past statements from the respective companies have indicated they would be amenable to such a law. Bill Gates, never one to be shy about criticizing government regulation that he disagreed with, was asked in a February 2006 interview with the London Times, "Should the US government establish guidelines to regulate how internet companies deal with censorship in countries like China?" and answered, "I think something like the Foreign Corrupt Practices Act has been a resounding success in terms of very clearly outlining what companies can't do and other rich countries largely went along with that." At the February 2006 house hearings to discuss American companies' cooperation with overseas censors, representatives from all companies indicated that they actually wanted the government to play a bigger role -- they were vague about what such a role would be, but this was only a month after the first draft of the Global Online Freedom Act had been proposed, the only such law on the table at the time.

At first this might seem paradoxical -- why would companies seem amenable to, even supportive of, laws that would restrict what they can do? But it actually makes sense if you consider their negotiating position with the Chinese government. Currently, the Chinese censors can tell Microsoft, Yahoo, and Google that they either have to either play by the Chinese rules or get out, and the censors know that the companies will comply (without even necessarily feeling guilty about it -- the companies can always say that the Chinese people are better off with a censored version of their services than no access at all).

But if the companies' hands are tied by U.S. law, then they can basically present the Chinese government with a take-it-or-leave-it deal: You can use our e-mail and messenger and blog services, just know that our government won't let us turn over users' personal information if you ever want it. The Chinese censors are presumably coming from the point of view that they'd rather have a controlled Internet, but that it's more important to reap the economic benefits of having the Internet in their country, even if some control is lost (after all, if they didn't believe that, they wouldn't have connected to the Internet in the first place). Hence it's not likely that they'd throw out Yahoo Mail and Google search and MSN Messenger when so many users depend on these and use them for business as well as personal use. (Even if there are Chinese-made alternatives, there would be the huge cost of switching everyone over, and no longer being able to use the old tools to communicate with American companies.) So a law controlling the actions of U.S. companies would very probably allow them to keep doing business in censored countries, while giving them an excuse not to turn over users' data.

But, that might not work if it looks like the companies pushed too hard for the law themselves. If the Chinese see Yahoo fighting tooth and nail to pass a law that restricts what information Yahoo can hand over to China, the Chinese censors could take that as a slap in the face, and punish Yahoo for defying them even after the law is passed that prohibits Yahoo from cooperating. "Oh, you can't give us that information because of the law? This law right here that you lobbied for?"

So, when the general counsel of Yahoo says, "Ultimately, the greatest leverage lies with the U.S. government"; when the Vice President of Google tells Congress, "And certainly also, finally, there is a role for government. We do need your help, and you can help us"; when the associate general counsel of Microsoft testifies, "It is, therefore, the responsibility of governments, with the active leadership of the United States, to seek to reduce or reconcile these differences", I think what we're hearing are subtly encoded messages saying, "Pass this law, or something like it; we just can't look like we wanted it to pass." So, Congress should give them what they want, even if they can't ask for it directly. And at the same time they would be helping users in censored countries all around the world, before the next one gets sent to jail because an American company turned over their information.

Regular contributor Bennett Haselton has written in to say that "The Global Online Freedom Act, introduced last year during a firestorm of controversy over American companies cooperating with totalitarian governments in China and elsewhere, was introduced this month as the Global Online Freedom Act of 2007. When Chris Smith (R-NJ) first introduced the law in 2006, Yahoo was under fire for recently turning over information to Chinese authorities that led to the arrest of a political dissident, Microsoft was attacked for removing pages from MSN Spaces China at the behest of the government, Google was being criticized for removing political sites from search results displayed to China, and Cisco was accused of helping to enable Chinese filtering of the Web. All four corporations testified at a February 2006 House hearing during which Representative Tom Lantos summed up the mood of many of his colleagues by telling the companies, "I do not understand how your corporate leadership sleeps at night." The companies protested that they had no choice but to comply with local Chinese laws, but that they were troubled by their own actions, and -- in a rarity for individual tech companies, much less for a chorus -- they all invited the U.S. government to play a bigger role, while being vague about what the role should be."

GOFA would create a U.S.-government-designated list of "Internet restricting countries" and would in most cases prohibit U.S.-based companies from censoring content or turning over users' information to the governments of those countries. Do these companies want GOFA to pass? And is GOFA a good law? I think, yes and yes, but the answers are more complicated than they seem.

With American "collaboration" less in the news, GOFA made less of a splash when it was re-introduced this year, but it is still the subject of spirited debate. Reporters Without Borders, Amnesty International, and other human rights groups have already signed a statement supporting the July 2006 version of the bill (nearly identical the 2007 version). But blogger-journalist Rebecca MacKinnon argues that by creating a government-maintained list of "Internet censoring countries", the law falls short of calling for support of free speech in all countries (the initial list, for example, includes Iran and China, but leaves out notorious human rights violator and net-censor Saudi Arabia). Danny O'Brien of the EFF backs this position as well, and also argues the organization's long-standing position that "code is speech" and that filtering software should not be subject to export regulations that are proposed in the law.

I agree with MacKinnon that instead of using a list of "Internet restricting countries", we should require the same standards of U.S. companies wherever they do business, or at least, stop playing silly games like leaving Saudi Arabia off of a list of human rights violators because Bush is friends with the ruling family. I agree with the EFF that filtering software should be considered First-Amendment-protected speech like encryption software, and not be included on an export-prohibited "munitions" list. And for reasons listed below, I think that the law won't stop censoring countries from blocking any speech they want. But even with all of these qualifications, I think the law would be a step in the right direction, if only for the rules prohibiting companies from turning over users' personal information to the governments of countries like China and Iran. It's painful to give a pass to countries like Germany that also censor political speech, but I think that the situation is so much worse in places like China that we should do what we can in the short term. And for reasons I'll get into, I think that Microsoft, Yahoo, Google and Cisco are secretly hoping that a law like GOFA does get passed -- even if they can't come out and say so.

First, what the law does not do: There is still nothing to stop a U.S. company from blocking or removing legal, political content at the request of a foreign government. Section 204 says only that American content-hosting companies and content-filtering companies have to provide the U.S. government with a list of sites that have been removed or blocked at the behest of a censoring country.

Section 205 does say that U.S. companies may not block or remove sites that are operated by the U.S. government, or by any entity that receives grants from the International Broadcasting Bureau to help defeat foreign censorship. Presumably that would include Peacefire, at least during the periods when we're under contract to the IBB to develop the Circumventor software (but before you start calling me Hallibennett, I'm not working for the IBB right now, and it was my own idea to write this). So the American government, while requiring schools to block us in the U.S., would actually be helping to get us un-blocked in China and Iran! But Section 205 only says that a U.S. business may not block or shut down such sites. As far as I can tell, that means if the Cisco engineer on site in China sets up their routers for them, the Cisco engineer can't put VOANews.com on the block list. But then the Chinese official can walk across the room and add it to the list himself, can't he? Which is almost certainly what they'll do, since the routers are in their country.

So, I think the regulations against Internet blocking will be easy for foreign governments to ignore. But where the law could make a difference is in the prohibition against turning over users' personal data to law enforcement in censoring countries. Section 201 says that servers located in a censoring country cannot contain personally identifiable user information (so that the local police cannot simply storm in and seize the data). Section 202 says that American companies can only turn information over to law enforcement of a censoring country if the information is needed "for legitimate foreign law enforcement purposes as determined by the Department of Justice". MacKinnon has criticized this aspect of the law as well -- "If Americans don't want the DOJ to have access to their user information, why should anybody else?" Very true. But, even at the lowest point of public confidence in the Department of Justice, I think most people living outside of fortified compounds stocked with beef jerky and gold bullion, can agree that the U.S. DoJ has more integrity and legitimacy than the government of China, and that such a rule would mean fewer Chinese dissidents going to jail.

What do the affected U.S. companies think of the law? Microsoft, Yahoo, and Cisco did not respond to requests for comment. A Google PR person replied to say, "We welcome intiatives that expand access to information and protect the rights of users across the globe. At the same time, we remain concerned that legislation in this area can have unintended consequences, so we intend to study any such proposals closely, and work with proponents and others to reach the right outcome." When I replied that the Global Online Freedom Act had been proposed more than a year ago and had been online in its current form since June 2006, presumably enough time to "study such a proposal closely" and take a position on it, he said they would stick with that statement for now. (In his e-mail, he actually put quote marks around the company's statement, which I thought was a nice dry touch.)

But past statements from the respective companies have indicated they would be amenable to such a law. Bill Gates, never one to be shy about criticizing government regulation that he disagreed with, was asked in a February 2006 interview with the London Times, "Should the US government establish guidelines to regulate how internet companies deal with censorship in countries like China?" and answered, "I think something like the Foreign Corrupt Practices Act has been a resounding success in terms of very clearly outlining what companies can't do and other rich countries largely went along with that." At the February 2006 house hearings to discuss American companies' cooperation with overseas censors, representatives from all companies indicated that they actually wanted the government to play a bigger role -- they were vague about what such a role would be, but this was only a month after the first draft of the Global Online Freedom Act had been proposed, the only such law on the table at the time.

At first this might seem paradoxical -- why would companies seem amenable to, even supportive of, laws that would restrict what they can do? But it actually makes sense if you consider their negotiating position with the Chinese government. Currently, the Chinese censors can tell Microsoft, Yahoo, and Google that they either have to either play by the Chinese rules or get out, and the censors know that the companies will comply (without even necessarily feeling guilty about it -- the companies can always say that the Chinese people are better off with a censored version of their services than no access at all).

But if the companies' hands are tied by U.S. law, then they can basically present the Chinese government with a take-it-or-leave-it deal: You can use our e-mail and messenger and blog services, just know that our government won't let us turn over users' personal information if you ever want it. The Chinese censors are presumably coming from the point of view that they'd rather have a controlled Internet, but that it's more important to reap the economic benefits of having the Internet in their country, even if some control is lost (after all, if they didn't believe that, they wouldn't have connected to the Internet in the first place). Hence it's not likely that they'd throw out Yahoo Mail and Google search and MSN Messenger when so many users depend on these and use them for business as well as personal use. (Even if there are Chinese-made alternatives, there would be the huge cost of switching everyone over, and no longer being able to use the old tools to communicate with American companies.) So a law controlling the actions of U.S. companies would very probably allow them to keep doing business in censored countries, while giving them an excuse not to turn over users' data.

But, that might not work if it looks like the companies pushed too hard for the law themselves. If the Chinese see Yahoo fighting tooth and nail to pass a law that restricts what information Yahoo can hand over to China, the Chinese censors could take that as a slap in the face, and punish Yahoo for defying them even after the law is passed that prohibits Yahoo from cooperating. "Oh, you can't give us that information because of the law? This law right here that you lobbied for?"

So, when the general counsel of Yahoo says, "Ultimately, the greatest leverage lies with the U.S. government"; when the Vice President of Google tells Congress, "And certainly also, finally, there is a role for government. We do need your help, and you can help us"; when the associate general counsel of Microsoft testifies, "It is, therefore, the responsibility of governments, with the active leadership of the United States, to seek to reduce or reconcile these differences", I think what we're hearing are subtly encoded messages saying, "Pass this law, or something like it; we just can't look like we wanted it to pass." So, Congress should give them what they want, even if they can't ask for it directly. And at the same time they would be helping users in censored countries all around the world, before the next one gets sent to jail because an American company turned over their information.

An anonymous reader writes, "In the U.S. Congressional Inquiry into the HP spy scandal, it was revealed that HP used Web bugs to track the source of leaks. HP's Fred Adler considers them a useful investigative tool which HP will keep using. Since dubbed PattyMail after HP Chairwoman Patricia Dunn, Web bugs have been around for a while. But it turns out the vulnerability they represent is far worse than first thought. Microsoft Outlook won't have a patch until 2007. The company at the center of the scandal claims they've done nothing wrong. But could repressive governments use them to track down critics? Can anything be done to stop Web bugs?"

Cally writes "There's a Kevin Poulson article on SecurityFocus reporting that the US Sentencing Commission is seeking opinions about the appropriate punishment for convicted system crackers and other black-hat types. On one hand, it seems absurd to ruin the entire life of a foolish 15 year-old for committing the equivalent of graffiti. Then again, perhaps these people are cyber-terrorists who should be illegally imprisoned, indefinitely, without a trial, charges, or legal representation? You choose."

ZurichPrague writes "Amnesty International is claiming Microsoft, Sun, Nortel and Cisco, among others, have broken the law by selling filtering technology to China, helping that country implement its censorship. Is Amnesty right? Making the technology is fine, but if we know that it could be used for ill, aren't we bound to not sell to some countries and companies? C/Net has the story here."

KyleNicholson writes "It makes you wonder what is really being taught in Business Ethics classes today. American companies such as Sun, Microsoft, Nortel are helping to limit the freedoms of people around the world, even leading to executions. Here is a report by Amnesty International."

??? writes "It would appear that the Mercury is retracting its earlier story posted here. In a recently posted story, both the Chinese government and Microsoft deny the veracity of the story. The interviewed Chinese government spokesperson did however indicate that they are encouraging the use of domestically produced software. " Some of the Reuters stories seem to indicate that China has banned Win2k in critical government/infrastructure situations - but I can't find confirmation.