The Roach Motel

The first thing I learned is that Amazon is in no hurry to give you your data, nor does it really encourage you to ask for it in the first place. I couldn’t even figure out how to navigate to the request page without turning to a search engine. In fact, Amazon seems keen to discourage data requests, as making one is a labyrinthine endurance test of being bounced from one webpage to the next, waiting for weeks, and then downloading, extracting, and combing through dozens of files. Requesting your data from Amazon is an exhausting procession that feels a little bit like a text adventure game designed by Franz Kafka.

Once you’ve actually made it to the preliminary “Request Your Personal Information” page, Amazon suggests that you can also access “a lot of your personal information in Your Account.” This is the first iteration of a refrain that you will run into multiple times throughout the protracted data request process, repeated every step of the way.

After you click on “Request My Data,” you’re taken to a page with a drop-down menu where you can “select the data that you want,” with the option “Request All Your Data” in the 16th position, at the very bottom of the menu. And in case you’ve forgotten that you can also see some of your data in your account settings, Amazon offers a helpful reminder: “Don’t forget you can access a lot of your data instantly, as well as update your personal information, from Your Account.”

Once you submit your request, you’re taken to the “Data Request Creation” page, which thanks you and informs you that “You’re almost done…” but now need to click a verification link in your email. Amazon at this point makes some intonations about how this email verification step is necessary because your privacy and security are the company’s top priority, though considering that when your data is available you’ll need to check your email anyway, it’s not clear how checking your email twice adds any security. And by the way, in case you’ve forgotten already, Amazon also reminds you on this page that “You can access a lot of your data instantly, as well as update your personal information, from Your Account.”

At this point, you’ll need to pop over to your email and click the “Confirm Data Request” link. Doing so will take you to the “Data Request Confirmation” page, which informs you that Amazon has “received and [is] processing your request to access your personal data.” This feels a little strange, as you don’t recall ever making Amazon jump through this many hoops when it wanted to access your data. (This page again reminds you that you can get “a lot of your data … from Your Account.”)

The “Data Request Confirmation” page also informs you that you may be in for a bit of a wait. Though Amazon says that it will “provide your information to you as soon as we can,” “soon” is apparently meant to be interpreted on a monthly time scale, as the page further states that “usually, this should not take more than a month.” Though of course, “in exceptional cases, for example if a request is more complex or if we are processing a high volume of requests, it might take longer.” This protracted time frame forms an intriguing juxtaposition to the otherwise universal emphasis on speed that facilitates shopping on Amazon. “If you have to click multiple buttons, if you have to wait for too long, if you have to answer a lot of information — all of those things create friction, and friction exponentially kills the joy of shopping,” Nadia Shouraboura, a former member Amazon’s management board, said in the 2014 CNBC documentary “Amazon Rising.”

Given Amazon’s obsession with speed and eliminating friction to foster faster consumerism, the dawdling data solicitation process seems like it just might be intentional, designed to dissuade requests. A far simpler explanation comes through an invocation of Hanlon’s razor, the old adage to “never attribute to malice that which is adequately explained by stupidity.” Amazon whistleblowers cited by Politico have said that the company “has a poor grasp of what data it has, where it is stored and who has access to it.” If that’s the case, then it stands to reason that it can take a month or more for Amazon to process a data request. As former Amazon chief information security officer Gary Gagnon succinctly put it in an interview with Reveal, “we have no fucking idea where our data is.”

Asked whether the company takes a long time to fulfill data requests because it doesn’t have a good grasp on where customer data is kept, Amazon spokesperson Jen Bemisderfer said the company “strongly reject[s] the assertion that we don’t keep track of customer data. Producing [customer data] reports requires that we know where data is stored. Amazon maintains multiple and complementary tools and processes to systematically identify where personal data is stored and how it flows.”

Bemisderfer did not directly address a question about whether Amazon intentionally makes the data request process difficult, instead writing, “We are committed to providing customers with access to their information and are always looking for ways to improve the customer experience.”

It ultimately took about 19 days for Amazon to fulfill my data request, in stark contrast to its reported median time of 1.5 days to process a data request, as per the company’s California Consumer Privacy Act disclosure for 2020. There was no option for expedited Amazon Prime data delivery and no button equivalent to an instantaneous Buy Now (née 1-Click) option when selecting my data. When the data was finally ready, Amazon sent me an email expressing outright jubilation at the fact that it had managed to find my information, stating: “We are happy to confirm that we have completed your data request.” And since it’d been a few weeks, Amazon also understandably thought that I could use another reminder that I could “find all the available information” related to my Amazon profile (“including reviews”) on my profile page.

Clicking the link to download the data in the arrival email in turn took me to the “Download your Amazon Data” page, which once again (for the sixth and, mercifully, final time) helpfully reminded me that “You can access a lot of your data instantly, as well as update your personal information, from Your Account.”

On the data download page, under the veneer of endless consumer choice, I was presented with a total of 74 separate zip files that had to be downloaded individually (though enterprising users have built scripts to help automate the process). This turn toward extreme granularity is doubtlessly not unappreciated by the ever-discerning consumer who, despite explicitly requesting all of their data from the drop-down menu earlier in the request process, may nonetheless now only wish to download the cryptic Advertising.1.zip and Advertising.3.zip but may studiously want to avoid Advertising.2.zip, and is therefore thankful to be spared the burden of being saddled with two additional kilobytes of extraneous data.

Amazon is here employing a kind of reverse dark pattern: Instead of irksome layout gimmicks designed to trick users into inadvertently doing things (like subscribing to mailing lists), Amazon is using an irksome layout pattern to discourage you from downloading all of your data. Specifically, this is kind of a “roach motel” model reminiscent of when Yahoo presented users with more than 300 buttons to individually press to opt out of third-party data collection from its partners. Except in Amazon’s case, you have to go through this process to merely view your data, not opt out of it.

“You Can Access a Lot of Your Data”

Once you’ve gone through and painstakingly downloaded all of the zip files, you need to extract the contents of each one either using a program included with your operating system or (if you can’t find one already on your computer) a free tool like 7-Zip. The extracted data is predominantly in the form of CSV files, which can be opened in a spreadsheet editor like Calc, included with the free office productivity suite LibreOffice. (Microsoft Excel will work too.)

While Amazon’s reminders that you can access “a lot” of your data by looking around your account and profile settings is doubtlessly true (given that “a lot” is a nebulous quantifier), what becomes apparent when looking over your requested Amazon data is that the company collects a lot of information that you cannot view in those settings.

In skimming over this trove, one thing became very clear right away: Amazon sure seems to love to retain information. Though the company states that it is legally required to keep certain data like order history, other information like search keywords seems to be retained at Amazon’s discretion. The company intricately logs chat and email interactions you’ve had with buyers, sellers, and Amazon; your cart history; your orders, returns, and reviews; and your searches (for the past three-and-a-half years), or at least those made while logged into your account. The spreadsheet that lists your search history (Retail.Search-Data.Retail.Customer.Engagement.csv in Retail.Search-Data.zip) contains 65 fields with information like search terms, your IP address, how many search results you clicked on, how many search results you added to your basket, and how many search results you ended up buying. The file also includes fields with unclear titles. For instance, one column marked “Shopping Refinement” sporadically lists cryptic strings of numbers like “26,444,740,832,600,000” for various search queries.

Aside from keeping a meticulous ledger of all your site activity, Amazon also takes the liberty of holding on to data you may have had the mistaken impression you deleted. If you click “Remove” on any address you have stored in the “Your Addresses” portion of your Amazon account, this in fact only removes the address from that page, not from Amazon’s records. Addresses that you have removed from your account are merely labeled as “Is Address Active: No” in Retail.Addresses.pdf (within Retail.Addresses.zip). On its “Add and Manage Addresses” customer service page, Amazon makes no mention of the fact that deleted addresses are only deleted from being visible to you on your account page and are not actually deleted from Amazon’s servers. Given that account recovery security questions for various services can be along the lines of “What’s the name of the first street you lived on?” or the fact that people sometimes use their old house or apartment numbers as their PINs, gaining access to a user’s comprehensive list of old addresses can be particularly advantageous for someone who has access to your Amazon account and wants to expand their reach.

Amazon’s advertising data on you is inexplicably divided across three zip files. Advertising.3PAudiences.csv (in Advertising.1.zip) lists “Audiences in which you are included via 3rd Parties.” It’s not explained how Amazon acquires this third-party audience data, but according to this dataset I apparently am a homeowner, in possession of a luxury sedan and SUV, and in the 45 to 54 age range. This was all news to me, as I am none of those things. It genuinely feels good to know that Amazon is wasting resources on harvesting inaccurate audience demographic information from third parties.

The two Advertising.AdvertiserAudiences.csv files (in Advertising.1.zip and Advetising.2.zip), meanwhile, list “Advertisers who brought audiences in which you are included.” It’s not clear what this field actually means — for instance, if “brought” is a typo for “bought” — but at any rate, my data is apparently somehow linked to a total of 167 advertisers, including Carrington College, Clever Cutter, Fitbit, HCA Healthcare, the Leukemia & Lymphoma Society, and something called Animal Friends. Three Canadian banks — Bank of Montreal, Royal Bank of Canada, and Scotiabank — are disproportionately represented in this list of advertisers that have hoovered up my data; I don’t know why, though I did several times order gifts to Canada.

There are also zip files dedicated to other Amazon services like Alexa, Amazon Games, Amazon Music, Kindle, and Prime Video. I don’t make use of those, so mine were empty, though it does at this point come as no surprise that Amazon keeps track of, for example, how long you watch individual Prime Video offerings and which country you are in when viewing them, or which books you read on your Kindle, down to which pages you look at.

Overall, from my Amazon data request I learned that I never did find a good “DIY plasma ball kit” or a decent “summer watermelon recipes” book, but I am decidedly happy that Amazon thinks I’m a 45 to 54-year-old luxury sedan-driving homeowner and that multiple Canadian banks have a competing interest in me.

Minimizing Data Exposure

There are numerous steps one could take to minimize the amount of information Amazon is able to collect. You could be sure that you’re using ad-blocking software like uBlock Origin to reduce the chance of advertisers tracking your browsing habits and buying or selling that information. You can also peruse Amazon through the private mode in your browser, or at least while being logged out of your Amazon account. And if you don’t want Amazon to have your IP address, home address, phone number, and credit card information, you could always use a virtual private network for browsing, a Post Office box for shipping, a temporary burner phone number for account verification, and a temporary or virtual credit card number. It may also not be an entirely bad idea to periodically start fresh, via Amazon’s ever-helpful “Request the Closure of Your Account and the Deletion of Your Personal Information” page.

The post I Want You Back: Getting My Personal Data From Amazon Was Weeks of Confusion and Tedium appeared first on The Intercept.

After the World Trade Center bombing in 1993, the U.S. Justice Department brought the co-conspirators before the federal court in the Southern District of New York for a criminal trial.

After the 1998 bombings of U.S. embassies in Kenya and Tanzania killed 12 Americans and more than 200 others, the U.S. Justice Department similarly brought the perpetrators to public criminal trials in downtown Manhattan.

Notably, both the World Trade Center bombing and the embassy bombings involved many of the same operatives, training camps, financial banking networks, communications facilities and hubs, methods of communications, sources, and methods of travel, travel networks, and travel “identifiers” as the 9/11 attacks. In fact, Al Qaeda was closely linked to the World Trade Center bombing and orchestrated the embassy attacks as well as the bombing of the USS Cole in Yemen in October 2000.

Of course, the number killed in the 9/11 attacks far eclipses the count of those injured and killed in the World Trade Center 1993 bombing, the embassy bombings, and the USS Cole bombing combined. Historically speaking, the 9/11 families are the largest group of terrorism victims for terrorist attacks carried out inside the country. And yet the U.S. Justice Department has never indicted and fully prosecuted one co-conspirator for the crime.

Quite inexplicably, the 3,000 homicides by hijacking and bombing on September 11 will go unanswered for in these United States. Even the case of Zacarias Moussaoui, who pleaded guilty to conspiracy for failing to prevent the attacks, was a debacle that for the 9/11 families only raised more uncomfortable questions surrounding the U.S. government’s abject and systemic failures. As the Associated Press reported, “The FBI agent who arrested Zacarias Moussaoui in August 2001 testified … [that] he spent almost four weeks trying to warn U.S. officials about the radical Islamic student pilot but ‘criminal negligence’ by superiors in Washington thwarted a chance to stop the 9/11 attacks.”

Without justice and accountability, the very dangerous message sent to terrorist murderers is that they may operate with free license to kill innocent civilians — not just in places far from Americans, like Afghanistan, but also closer to their home, in the streets of lower Manhattan on sunny, blue-skied mornings. With the consent of Presidents George W. Bush, Barack Obama, Donald Trump and Joe Biden; Attorneys General John Ashcroft, Alberto Gonzales, Michael Mukasey, Loretta Lynch, Eric Holder, Jeff Sessions, William Barr, and Merrick Garland; Manhattan District Attorneys Robert Morgenthau and Cy Vance Jr. — all of whom, as the saying goes, could easily indict even a “ham sandwich” — and two decades’ worth of prestigious members of Congress vowing to “never forget,” a demand has never been made for full truth, transparency, accountability, and justice for the 3,000 dead.

Why?

Screaming Facts and Official Silence

I have studied this issue extensively, testifying twice before Congress and, with other 9/11 widows, forcing the creation of the National Commission on Terrorist Attacks Upon the United States, known as the 9/11 Commission, and helping push through some of the national security reforms it recommended. I’ve had scores of communications over 20 years with presidents and members of their national security councils, members of Congress, the director of the FBI, heads of counterterrorism divisions and joint terror task forces, CIA officials, ex-CIA agents, FBI agents and ex-FBI agents, former NSA analysts, whistleblowers, and even terrorist defense attorneys. I believe it’s clear that the U.S. government has plenty of evidence and information in its files to refer enough incriminating facts and irrefutable evidence to a myriad of grand juries, secure indictments, and thereafter prosecute all of the living 9/11 conspirators who contributed to the homicide of 3,000 innocent people on the morning of September 11, 2001. And yet justice is simply not sought.

Rather pointedly, the 9/11 hijackers did not act alone.

They had a substantial support network that was deeply embedded inside the United States and abroad for nearly a decade prior to, on, and after the 9/11 attacks. It is my understanding that this support network spanned several states including California; Arizona; Nevada; Washington; Minnesota; Oklahoma; Illinois; Florida; North Carolina; Virginia; Massachusetts; Maine; New York; New Jersey; and Texas. The support network also included several countries like Germany; Spain; France; the U.K.; Egypt; Kenya; Tanzania; Sudan; Yemen; Saudi Arabia; the United Arab Emirates; Qatar; Pakistan; Malaysia; Thailand; Iran; and Afghanistan.

Known and lethal terrorists openly and freely operated inside the U.S. for years before the 9/11 attacks, and yet authorities failed to prevent the cold-blooded murders of our 3,000 loved ones. More than 14 U.S. local and federal jurisdictions had law enforcement agencies that brushed up against the 9/11 hijackers and their supporters. Moreover, more than 18 foreign law enforcement counterparts also investigated some of those involved in the 9/11 attacks. They unearthed evidence, wrote reports, monitored activities, watched money wires, and investigated stock sales, arms and weapons shipments across borders, eyebrow-raising passports and visa documents, and lethal operatives roaming the world, planning murder, with impunity. These people remain fully aware of the truth and how their one part of the damning puzzle fits together. Yet none speak out.

Indeed, when a person looks at the facts and circumstances of the 9/11 attacks, taken as a whole, it would seem implausible that not one individual, entity, bank, or business has been fully prosecuted and found criminally responsible as a co-conspirator for the crime that took place. I say a crime, because my husband’s death certificate, like every other 9/11 victim’s, lists the manner of his death as “homicide,” not “war.” And yet our nation, a democracy based upon the rule of law, that supposedly protects and entitles all of its citizens with a Constitution and clear Bill of Rights (and certainly the most basic universal human right to live and not be blown up in a building) has not found, and will not ever find, it necessary to hold any co-conspirator of the 9/11 hijackers accountable in a court of criminal law. The typically exceedingly easy-to-meet thresholds for who and what qualifies as a criminal “co-conspirator” and “conspiracy” have never quite been met by the screaming facts and circumstances of 9/11 — and I’d argue that’s by systemic prosecutorial choice to look the other way for matters of political expediency, cover-up, or in the best case scenario, sheer embarrassment.

Hijacking the Bill of Rights

While not using the September 11 murders to prosecute the obvious crime and deliver justice to the 9/11 families, this country’s leaders have alternatively used the 3,000 homicides to do many other things — none of which have anything to do with serving and protecting the best interests of civilians and 9/11 victims, but everything to do with government overreach and the trampling of Americans’ constitutional rights. It wasn’t Osama bin Laden and Al Qaeda that cracked the bedrock of our hallowed democracy; it was our very own leaders who carried out their own hijacking of our Bill of Rights in the wake of 9/11.

On the backs of the 9/11 dead, our leaders have chosen to start wars, some of which were illegal and based upon the shady unilateral decisions of presidents (both Democrat and Republican). These wars, which have lasted two full decades, cost trillions of dollars, the lives and physical and mental well-being of hundreds of thousands of U.S. troops, and the lives of hundreds of thousands of innocent civilians who were unlucky enough to be caught up in “American-made” war zones. All of these wars, interventions, and occupations have only further fomented terrorism and clearly inflamed global hostilities toward American foreign policy “objectives” that have little to do with what is truly in the best interests of citizens here or abroad.

On the backs of the 9/11 dead, our leaders have chosen to start wars, some of which were illegal and based upon the shady unilateral decisions of presidents.

I can say this with unimpeachable authority since I speak, firsthand, as one small piece of the collateral damage of four decades’ worth of this nation’s bad foreign policy decisions, starting in the 1980s with the Iran-Contra affair and the arming of the mujahideen to fight the Soviets in Afghanistan; both President George H.W. Bush and the younger President Bush overlooking their oil-rich Saudi friends before and after 9/11; Obama’s inexplicable veto of the Justice Against Sponsors of Terrorism Act that was meant to hold terrorists and their co-sponsors accountable; Trump rubbing magical orbs with Saudi leaders prior to Jamal Khashoggi getting sliced into bits; and ultimately bookended by Biden’s horrifying, grossly mismanaged withdrawal from Afghanistan.

Our government passed legislation in the name of 9/11 that has eviscerated our constitutional rights based upon the premise that such legislative action (the Patriot Act, Titles I-X, and subsequent reauthorizations by all presidents, Democrat or Republican) was needed to keep us safe from terrorists, when the truth is that all the information, evidence, and legal authorities the U.S. government needed to prevent the 9/11 attacks was readily available and at its fingertips beforehand. If only it had chosen to use that information to stop bin Laden and his operatives before they very successfully blew up my husband Ron’s building.

As the former chair and vice chair of the 9/11 Commission — Tom Kean and Lee Hamilton, respectively — have alarmingly confirmed, the 9/11 attacks were preventable because everything needed to prevent them was there before the attacks occurred. It wasn’t an intelligence wall that stopped information from flowing before 9/11; it was purposeful (and I’d argue criminal) withholding of evidence and information by foreign and domestic intelligence agencies that enabled Al Qaeda operatives to carry out their attacks unhampered. Chillingly, such purposeful withholding of information continues to this very day, since with no further executive or congressional demand for responsibility or accountability for 9/11, there is simply no incentive for our intelligence officials and policymakers to alter their toxic patterns, including repeated cost-benefit analyses in which the cost is only ever paid by the innocent — known as “collateral damage” — both here and abroad. Truly, is it any real surprise that former CIA Director George Tenet provided bad intelligence on weapons of mass destruction that led us into a war with Iraq, when just a few years before he had carried out poor intelligence decision-making (and cherry-picking of information) that left us vulnerable to the 9/11 attacks? Incidentally, Tenet was given the Medal of Freedom. He should be in jail.

During the past 20 years, extrajudicial drone strikes, illegal renditions, unlawful and inhuman torture, and indefinite detentions have become the norm — all done, as well, in the name of our loved ones and to prevent another 9/11. Sadly, these inhumane and unlawful methods do not make any of us safer; they just allow presidents to unilaterally act outside the law, without oversight. Moreover, in addition to being a stain on the legacy of America, these unlawful methods have also further robbed the 9/11 families of our right to justice and our ability to hold terrorists accountable. None of the people detained at Guantánamo Bay with direct links to the 9/11 attacks (including the mastermind Khalid Sheikh Mohammed and alleged co-conspirators like Ramzi bin al-Shibh and Walid bin Attash, known as Khallad) are likely to ever be tried and brought to justice. Congress blocked their transfer to civilian courts in the U.S., and even within the military commission system at Guantánamo, trials are going nowhere because they were tortured by the CIA.

Lonely Fight for Truth

So without being able to hold the known 9/11 terrorists in custody accountable, and without any standing indictments or prosecutions meted out by the Department of Justice against the other identifiable co-conspirators, the job of seeking out accountability and justice has fallen on the shoulders of the 9/11 families, who were left to take matters of justice into our own hands through the second-rate route of civil litigation. Unlike the embassy bombing and the 1993 World Trade Center attack victims, who were able to use evidence brought forth during the government’s public trials and prosecutions of the perpetrators of the killers of their loved ones, the 9/11 families have never been given such help, assistance, access to evidence, or prosecutorial favor. This leaves us alone and with a stark disadvantage as we try to hold terrorists and their co-conspirators accountable for the murder of our loved ones in federal civil court. For a country that invokes 9/11 so freely to start wars and attack terrorists and innocent civilians around them with drones, and expands executive branch powers beyond anything our Founding Fathers would have ever felt comfortable with, such use of the 9/11 tagline abruptly halts at the courthouse steps.

For a country that invokes 9/11 so freely to start wars and attack terrorists and innocent civilians around them with drones, such use of the 9/11 tagline abruptly halts at the courthouse steps.

For 20 years, the 9/11 families have only faced a Department of Justice that spends more of its time covering up for terrorists and terrorist co-conspirators, errant intelligence community agents, and officials’ bad (arguably criminal) decisions that either directly killed or in many ways strongly contributed to the mass murder of our innocent loved ones. Year after year, Department of Justice lawyers, attorneys general, and prosecutors willfully choose to not help the 9/11 families as we fight the terrorists in court; they nastily refuse to share or declassify the information and evidence they have in their files so that we can nail terrorists and terrorist supporters. Instead, horrifically, some U.S. prosecutors literally sit on the side of the defendants (in this case, Saudi Arabia) and help the key evidence we need stay secret.

Two decades down, it is now enough. We believe it is time for our families to have closure and truth.

We believe that all information surrounding 9/11 should be made public. Using the Khashoggi case as precedent, we want all members of Congress to be fully briefed on the 9/11 case files. Moreover, we want members of Congress to pass meaningful legislation that will achieve the same transparency, accountability, and justice that they called for immediately after Khashoggi was killed.

We want Biden to release the 9/11 files to the American public just as he released intelligence from the Khashoggi files. And just as sanctions were assessed against Saudi Crown Prince Mohammed bin Salman’s “Tiger Squad” for Khashoggi’s murder, we want sanctions to be brought against those Saudis implicated in 9/11. If the powers of the Magnitsky Act applied to the gross human rights violation that occurred when Khashoggi was murdered and dismembered with a bone saw, then it should also apply to the gross human rights violations that occurred when thousands of people were crushed to death on the morning of September 11.

Most pointedly, the Khashoggi reports and evidence were used to publicly incriminate a sitting Saudi crown prince. We, too, believe that the 9/11 evidence should be used to incriminate any Saudi, be they a member of the royal family, part of an intelligence service, a diplomat — anyone, regardless of privilege. Please note that in the Khashoggi matter, information from wiretaps of a Saudi royal’s private communications, which implicated him in Khashoggi’s murder, were leaked, and an intelligence summary was officially released, openly stating that Salman approved the killing. Such highly sensitive information clearly collected through secret sources and methods was somehow breezily declassified and made available to the public. And yet the 9/11 families cannot get basic wiretap information surrounding an Al Qaeda communications hub in Yemen from 1998-2001 or NSA intercepts for the 9/11 hijackers’ phone calls from inside the U.S. — cases that don’t involve the surveillance of a sitting Saudi crown prince, just the private communications of Osama bin Laden and his Al Qaeda operatives planning attacks like the embassy bombings, the USS Cole Bombing, and 9/11. So why can’t Americans read the transcripts of those conversations and know what the NSA, CIA, FBI, Saudi intelligence, and other intelligence agencies heard about those attacks before they happened? Why can’t such information be used by the 9/11 families so that we can hold terrorists and their co-conspirators accountable?

Jamal Khashoggi was not an American citizen. In fact, he was a close friend of Osama bin Laden’s and said he wept when he was killed, adding that he wished bin Laden had not “succumbed to anger.” Our loved ones were Americans. And their cold-blooded, brutal murders in broad daylight should be given the same transparency, accountability, and justice. On the 20th anniversary of the 9/11 attacks, there should be nothing left to hide. As Biden has directed in a more recent context, all terrorists and their co-conspirators should be “hunt[ed] down and made to pay” for their crimes.

The post My Husband Died on 9/11. I Am Still Waiting for a Trial of His Killers. appeared first on The Intercept.

There is an official way to do this, and an unofficial one. This article focuses on the latter.

But first, let’s go over the official route to wiping your device, which is ideal if it is an option for you. This technique erases a specific iPhone or iPad encryption key — one, under normal use, that starts the processing of decrypting your content; erasing this key renders all of your data cryptographically inaccessible.

You’ll need an iPhone or iPad that turns on just fine and that you can either navigate using the touchscreen or connect to your computer. Apple provides instructions for iPhones and iPads, directing you to the Settings app, where you can perform a reset of the device (by going to Settings > General > Reset > Erase all Content and Settings). The same instructions also let you know what to do if you can’t get into the Settings app on your device: You can try to hook it up to your laptop or desktop device and perform a reset that way. If the computer reset method doesn’t work, Apple also provides instructions on how to wipe the device by booting it into recovery mode. If your device won’t even turn on, Apple also provides a few additional troubleshooting steps to take, like performing a force restart and making sure the device is charged.

When the Official Ways Don’t Work

But what do you do if you’ve tried all of Apple’s troubleshooting steps, and your device still won’t turn on or connect to your computer — and contains sensitive information that you want to be sure is not recoverable?

If you have set a strong passcode on your device, the good news is that the passcode also acts as part of your device’s encryption key, meaning that the data on your device is encrypted. If your passcode is hard to guess, someone who takes your device won’t be able to get into it under normal circumstances.

That said, every once in a while, vulnerabilities are discovered that bypass lock screen passcodes — and these are just the ones that are made public. Exploit vendors can pay millions to privately acquire vulnerabilities, while some forensics companies claim to have the capability to access all iPhones and iPads and to be able to “tackle your locked and encrypted devices.”

If you can’t access your device, the most careful approach to wiping it is to destroy the flash memory chip that houses your data. This way you don’t have to lose sleep if you didn’t use a strong passcode, or worry about a forensics vendor being able to recover any of your personal information.

Taking Apart Your Device

In this example, we’re destroying the flash memory chip from an iPad 6. You can find detailed teardowns for different versions of iPads and iPhones, or other devices, on iFixIt. Regardless of the specific model, the general process of physically destroying data is the same: Take the screen off the iPhone or iPad, find the logic board, and then destroy the flash memory chip.

To get to the flash memory chip, you’re first going to take your iPad apart. The first thing to do is to take off the iPad’s touchscreen digitizer panel to be able to access the rest of the iPad’s internal components. There are commercial tools to help take the panel off, but you can also take a heat gun to the perimeter of the iPad panel to loosen the adhesive holding it in place, and then take the panel off with the help of a pry tool. Once you’ve removed the digitizer panel, the next step is to unscrew the screen to detach it from the iPad enclosure and access the rest of the iPad’s internal components.

Once you’ve removed the screen, you’ll see the iPad’s battery taking up the bulk of the enclosure, and a metal cover on the side. The cover houses the iPad’s logic board, which in turn contains the flash memory chip where the iPad stores all of your data.

Remove all of the screws and connecting cables which may be holding the logic board in place, and take off the board’s cover.

The flash memory chip is silver in color and sits in its own metallic enclosure to the side of the logic board, next to the black processor chip.

Now just take a regular power drill and drill through the memory chip, and you can see your data turn into powder. At this point, you can continue drilling holes in the chip until it eventually falls apart. As always when working with power tools, you should be sure to wear personal protective equipment, such as goggles and gloves, and maintain a safe work area.

You can now safely dispose of the disassembled iPad in accordance with your local electronics disposal regulations.

The post Securely Erasing Your iPhone or iPad — With a Power Drill appeared first on The Intercept.

The woman found the offer on the smartphone messaging app WeChat, in a group known simply as “Travelers.” Authorities homed in on the group because of ethnic and family ties; its members included Muslim minorities like Uyghurs, Kazakhs, and Kyrgyz, who speak languages beside China’s predominant one, Mandarin. “This group has over 200 ethnic-language people,” the order stated. “Many of them are relatives of incarcerated people. Recently, many intelligence reports revealed that there is a tendency for relatives of [extremist] people to gather. This situation needs major attention. After receiving this information, please investigate immediately. Find out the background of the people who organize ‘free travel,’ their motivation, and the inner details of their activities.”

Police in Ürümqi’s Xiheba Precinct, near the historic city center, received the order and summarized their work in a 2018 report. The one person rounded up as a result of the order, a Uyghur, had no previous criminal record, had never heard of the WeChat group, and never even traveled within China as a tourist. He “has good behavior and we do not have any suspicion,” police wrote. Still, his phone was confiscated and sent to a police “internet safety unit,” and the community was to “control and monitor” him, meaning the government would assign a trusted cadre member to regularly visit and watch over his household. A record about him was entered into the police automation system.

Based on their notes, police appear to have investigated the man and assigned the cadre members to “control and monitor” him entirely because of religious activities, which took place five months earlier, of his eldest sister. She and her husband invited another Uyghur couple in Ürümqi to join a religious discussion group on the messaging app Tencent QQ, according to police records. The other couple bought a laptop and logged onto the group every day from 7 a.m. to 11:30 p.m.; the husband stopped smoking and drinking, and the wife began wearing longer clothes. They began listening to “religious extremism information” on their laptop, the report said. Between the two couples, police recovered 168 religious audio files deemed illegal, likely because they were connected to an Islamic movement, Tablighi Jamaat, that advocates practicing Islam as it was practiced when the Prophet Muhammad was alive.

The fate of the eldest sister and her husband is unknown; the report simply states they were transferred to a different police bureau. The other couple was sent to a re-education camp.

Details of the investigations are contained in a massive police database obtained by The Intercept: the product of a reporting tool developed by private defense company Landasoft and used by the Chinese government to facilitate police surveillance of citizens in Xinjiang.

The database, centered on Ürümqi, includes policing reports that confirm and provide additional detail about many elements of the persecution and large-scale internment of Muslims in the area. It sheds further light on a campaign of repression that has reportedly seen cameras installed in the homes of private citizens, the creation of mass detention camps, children forcibly separated from their families and placed in preschools with electric fences, the systematic destruction of Uyghur cemeteries, and a systematic campaign to suppress Uyghur births through forced abortion, sterilization, and birth control.

It offers an inside view into police intelligence files and auxiliary community police meetings, as well as the operation of checkpoints that are pervasive in Ürümqi. It also details phone, online, and financial surveillance of marginalized groups, showing how granular surveillance purportedly on the watch for extremism is often simply looking at religious activity. Additionally, the database spells out how Chinese authorities are analyzing and refining the information they collect, including trying to weed out “filler” intelligence tips submitted by police and citizens to inflate their numbers and using automated policing software to help prompt investigations like the one into the WeChat travel group.

Among the revelations from the database is information on the extensive use of a tool that plugs into phones to download their contents, the “anti-terrorism sword,” deployed so frequently that Chinese authorities worried it was alienating the populace. It shows authorities tracking how their policies succeeded in driving down mosque attendance. It also offers evidence that the “Physicals for All” biometric collection program, which authorities insisted was solely a health initiative, is intended as part of the policing system. And it quantifies and provides details on the extensive electronic monitoring that goes on in Xinjiang, containing millions of text messages, phone call records, and contact lists alongside banking records, phone hardware and subscriber data, and references to WeChat monitoring as well as e-commerce and banking records.

The database also sheds light on the extent of policing and detention in Xinjiang. It details how former residents who went abroad and applied for political asylum were flagged as terrorists. In some cases, it appears as though fixed-term sentences were assigned to people in re-education detention — undercutting the idea, promulgated by the government, that the lengths of such detentions are contingent on rehabilitation or vocational training.

Taken together, the materials provide a broad overview of how the extensive surveillance systems deployed in Xinjiang fit together to repress minority populations and how extensively they impact day-to-day life in the region.

“Overall, this testifies to an incredible police state, one that is quite likely to place suspicions on people who have not really done anything wrong,” said Adrian Zenz, an anthropologist and researcher who focuses on Xinjiang and Tibet.

The investigations stemming from the WeChat travelers group offer a concrete example of this intense policing, said Maya Wang, China senior researcher at Human Rights Watch. “You can see the muddled thinking in here, where people are being jailed for nothing, but also the process is so arbitrary.”

The revelations underscore how Xinjiang is an early look at the ways recent technology, like smartphones, cheap digital camera systems, and mass online storage of data, can be combined to monitor and repress large groups of people when civil liberties concerns are pushed aside.

“The mass surveillance in Xinjiang is a cautionary tale for all of us,” said Wang. “Xinjiang really shows how privacy is a gateway right, where if you have no privacy, that’s where you see that you have no freedoms as a human being at all. You don’t have the right to practice your religion, you don’t have the right to be who you are, you don’t even have the right to think your own thoughts because your thoughts are being parsed out by these incessant visits and incessantly monitored by surveillance systems, whether they’re human or artificial, and evaluated constantly for your level of loyalty to the government.”

Landasoft and China’s Ministry of Foreign Affairs did not respond to requests for comment.

Central Storage for the Public Security Bureau in Ürümqi

The database obtained by The Intercept appears to be maintained and used by the Ürümqi City Public Security Bureau and the broader Xinjiang Public Security Bureau. It also contains documents from units of the national Internet Safety and Protection Bureau.

Landasoft has branded the software that appears to be behind the database as “iTap,” a big data system it markets publicly.

The database spans 52 gigabytes and contains close to 250 million rows of data. It is fed by and provides data back to various apps, roughly a dozen of which appear linked to the database. These include:

• Jingwang Weishi, an app for monitoring files on a mobile phone, which police in China have reportedly forced Uyghurs to download.
• Baixing Anquan, which roughly translates to “people’s safety app” or “public safety app” and appears to be used by both citizens and police, including to enable citizens to snitch on one another to the authorities.
• Quzheng Shuju Guanli, or “Evidence Collection Management,” which collects “evidence” from apps like WeChat and Outlook.
• ZhiPu, a graphic interface of people’s relationships and the extent to which authorities are interested in them (the database contains only sparse information on ZhiPu).

One of the database’s major components is an extensive collection of minutes from “community stability” meetings, in which de facto police auxiliaries, or citizen-staffed neighborhood police, discuss what took place the week prior across their area. The database also contains various associated documents outlining policing and intelligence priorities and summaries of intelligence collected, local facilities checked, families of detainees visited, and updates on people of interest in the community. There are also weekly intelligence and detention reports, which include information on investigations of tips and on suspicious people.

The database provides information on numerous other tools used to analyze the digital surveillance it contains. For example, documents in the database reference a Chinese government system called the Integrated Joint Operations Platform. IJOP, which has been the subject of extensive interest and discussion by human rights groups, gathers together surveillance about the residents of Xinjiang, stores it centrally, and uses it to make automated policing decisions referred to in the database as “pushes,” or push notifications. IJOP was the platform police said issued the order to investigate the WeChat free travel group.

Other documents give information on the use of the label “three-category people,” who are deemed terrorists or extremists, with three varying degrees of severity.

The database itself repeatedly uses a marker to query for Uyghur people, “iXvWZREN,” which groups them with terrorists and ex-convicts. There is no marker for Han Chinese, the majority ethnic group in China.

From Checkpoints to Chat Monitoring: Surveillance in Ürümqi

The surveillance in Xinjiang was known to be extensive, creating one of the most watched regions in the world. What the database reveals is how this spying machine is used: what surveillance looks like on the ground (unrelenting) and what specific ends it is intended to serve (often to curb any unsanctioned influence, from the practice of Islam to ideas from foreign countries). People are watched up close and at a distance, with some information directly sucked out of their digital devices, other data collected from taps and sensors, and still more from relatives and informants in the community. The campaign against Uyghurs and their practice of Islam is laid out in stark and aggressive terms in police documents, and paranoia about outside or otherwise malign influence of many sorts manifest repeatedly.

Some of the most invasive data in the database comes from “anti-terrorism sword” phone inspection tools. Police at checkpoints, which pervade the city, make people plug their phones into these devices, which come from various manufacturers. They gather personal data from phones, including contacts and text messages, and also check pictures, videos, audio files, and documents against a list of prohibited items. They can display WeChat and SMS text messages. The data extracted is then integrated into IJOP.

A 2018 report from a neighborhood just northeast of the center of Ürümqi mentions authorities conducting searches on 1,860 people with an anti-terrorism sword in just one week in March. In the same report, detailing a single week in April, 2,057 people in the area had their phones checked. Around 30,000 people live in the area, the Qidaowan neighorhood, according to government statistics.

People are watched up close and at a distance, with some information directly sucked out of their digital devices, other data collected from taps and sensors, and still more from relatives and informants in the community.

This pattern of frequent police stops is seen in other parts of Ürümqi. Documents discuss police checking people’s phones upwards of three or four times in one night, and how this makes it difficult to stay on the good side of the populace, which is clearly becoming annoyed.

For example, an August 2017 police report said that “due to overly frequent phone inspections conducted by certain checkpoints, which caused some people to be inspected over 3 times, people complain about this work.” An October 2017 “social opinion intelligence report” stated that “some people reflected that the current checkpoint is too overpowered. Often they would be checked 3 times during one night. It wastes their time when they are in an emergency.”

The documents discuss people who switched to older phones to prevent the inconvenience of these phone checks.

Rune Steenberg, an anthropologist in Denmark focusing on Xinjiang and Uyghurs, who spent time in Kashgar as a researcher as late as 2016, said he switched to using a simple phone rather than a smartphone in 2014 and that many Uyghurs did the same. “It’s not just about them discovering stuff on your phone,” he said. “They can place stuff on your phone in order to incriminate you. And there’s no way you can afterwards prove that that was placed on your phone and it wasn’t from you. So it became really dangerous, actually, to have a smartphone.”

And, Steenberg said, police would often scam people into giving up their smartphones, falsely stating the phone had religious content and asking people if it was theirs, knowing they would disown the device. “They would be like, ‘No, that’s not my phone, no, I didn’t bring my phone here,’” said Steenberg. Then, he said, the police would hold onto the phones and sell them afterward.

The database also helps quantify how broadly phone surveillance was deployed around Ürümqi. For example, in the space of one year and 11 months, Chinese authorities collected close to 11 million SMS messages. In one year and 10 months, they gathered 11.8 million records on phone call duration and parties involved in the call. And in a one-year, 11-month period, they gathered seven million contacts and around 255,000 records on phone hardware, including the IMSI number that identifies phones on cellular networks; phone model and manufacturer; a computer network identifier known as a MAC address; and another cellular network identifier, the IMEI number.

Phone call information that is tracked in the database includes people on the calls, name of the recipient, and the start and stop times of each conversation. Fields in the database indicate that online dating information, e-commerce purchases, and email contacts may also be extracted from phones.

“You cannot feel safe anywhere because of your cellphone,” said Abduweli Ayup, a linguist and poet who lived in Kashgar, Xinjiang. “You have to turn your cellphone on 24 hours, and you have to answer the phone at any time if police call you.” He said that with chat apps also monitored, Uyghurs can never experience privacy, even at home.

Beyond passively watching phones, the government worked to coerce people to participate in a biometrics program purported to be a health initiative. Under the “Physicals for All” program, citizens were required to go have their faces scanned and voice signatures analyzed, as well as give DNA. Documents describing the program indicate it is part of the policing system.

Darren Byler, an anthropologist and postdoctoral researcher at the Center for Asian Studies at the University of Colorado, Boulder, said that while the “Physicals for All” program has long been known about and suspected to be a form of surveillance, authorities have always denied it and said it was simply a public health initiative. “How clearly this is part of the policing system is made clear in the documents,” Byler said. “It’s very clear, it’s obvious that that’s a part of how they want to control the population.”

Reports in the database show “Physicals for All” work is routinely conducted through the police “convenience stations,” leading to complaints from citizens about sanitary conditions. (The convenience stations purportedly bring the community and police closer together, featuring amenities like public Wi-Fi and phone-charging, but are hubs for surveillance.) They also discuss how citizens who fail to submit biometric and biographical information are reported to police, face fines, and are sometimes made to formally renounce their behavior. Some documents about the program focus on migrants or the “ethnic-language people.” One indicates that physical exams conducted on students are used for policing:

(2) Houbo Institute, which is part of the second hospital of Xinjiang Medical University, is going to start a new semester soon. The list of names of returning students is not known to us.

 

Method: After the semester begins, we will immediately conduct “physical checkup” work on the returning students using the IJOP platform. We will report to the national security team immediately if we find any suspicious labels.

Documents in the database also show heightened surveillance of people as they move about in public through the growing use of facial recognition, directed by the IJOP system. The police report on use of the anti-terrorism sword also details the use of facial recognition, showing that over 900 people were checked using facial recognition across 40 police convenience stations in Qidaowan Precinct.

(FOUR) Convenience Police Station Operational Notes:

 

There are 40 convenience stations in Qidaowan Precinct in total. … This week we searched 2,057 people with the anti-terrorism sword and did facial recognition on 935 people. No suspects. We sent 237 intelligence reports using the Intelligence Reporting System.

It’s clear, Byler said after reviewing the numbers, that “face recognition has become an increasingly important aspect of the surveillance system.”

Some of the most intriguing evidence of personal data surveillance comes from computer programming code stored in the database and seemingly designed to generate reports. This reporting code references a good deal of material not included in the database obtained by The Intercept, making it impossible to confirm how much of it is actually collected by authorities or how it would be used.

Still, these so-called tactic or evidence collection reports give clues as to what information the database, on its own or as part of a broader collection, is intended to include. The report code contains references to data on online services like Facebook, QQ, Momo, Weibo, Taobao’s Aliwangwang, as well as actual phone call recordings, photos, GPS locations, and a list of “high-risk words.”

Documents in the database also confirm police access to information on people’s use of WeChat. Discussion of WeChat surveillance appears in records of auxiliary community police meetings and accounts of police investigations.

In an example of how police document their WeChat capabilities, one document — from the national Internet Safety Bureau — demonstrates a police search drill in which a police officer was marked as a suspect for the purpose of the exercise. He drove throughout the city while other police traced his vehicle using his WeChat history and location data. Authorities appeared to read the mock suspect’s WeChat texts, with one “WeChat Analysis” reading, “He said he’s having lunch at the petrol area.”

The aim of much of the surveillance is to curb any influence that could conceivably lead to a desire for greater freedom or autonomy among Uyghur and other minority groups in Xinjiang.

For example, the material corroborates reports that Uyghurs are monitored outside of China and that it’s not just people who travel abroad and then return who are surveilled, but also their relatives and friends.

Police in the Shuimogou district of Ürümqi investigated a young woman because her high school friend went to study at Stanford University and because the woman sometimes talked to her on WeChat. “According to the investigation, we did not find any violation of rules or laws while she resided and worked in our area,” read a 2018 report from the neighborhood of Weihuliang. “While she resided in the area she actively participated in community works and actively participated in other activities in the community, and actively participated in the raising of the flag ceremony in the community. We do not see any abnormality and she is cleared from suspicion.” Byler called the incident “important confirmation on the way people outside the country are being monitored by those in the country, and the way these connections produce ‘micro-clues’ of suspicion.”

In another example of how outside influence is grounds for suspicion, a document from the community of Anping, also in Shuimogou, mentions that all phones and computers of workers who have visited family outside of the city should be inspected for unauthorized content.

Clearing violent and terrorist audio and video has always been a very important part of stability work. Our community pays a lot of attention to this work. Because the Chinese New Year break is coming to an end, people will increasingly come back to work, therefore our community decided to conduct a large-scale computer and cellphone inspection for workers who are coming back. We inspect stored information on every household and every person’s cellphone and computer. To date, we did not discover violent and terrorist audio and video among the residents in the area. We will continue this work later and will record the results.

Chinese authorities’ fear of outside influence on citizens of Xinjiang is connected to an initiative called “backflow prevention,” or fanghuiliu. The idea is to prevent the “backflow” of extremism or other malign ideas from abroad.

A possible example of this initiative is the 2018 imprisonment of Feng Siyu, a Chinese academic who came to Xinjiang University’s Folklore Research Center as a translator the previous February. Feng is part of China’s Han ethnic majority and is originally from Hangzhou in eastern China, far from Xinjiang. But she studied abroad — including at Amherst College, SOAS University of London, and Indiana University — and came under police attention in Ürümqi, according to an October 2017 police intelligence note in the database. The note recorded that Feng had “foreign obscure software” on her OnePlus smartphone. The note further stated that the software came with the smartphone and that Feng did not use it.

Feng is believed to have been sentenced to two years in prison in February 2018. Her imprisonment is tracked on shahit.biz, the Xinjiang Victim’s Database, a website that documents instances of incarceration in the region.

Steenberg, the anthropologist, said he believes Feng was under scrutiny because she traveled between the U.S. and Ürümqi and spoke good Uyghur, and because of her work at the folk research center and with its founder Rahile Dawut. A celebrated academic, Dawut collected ethnographic data, including folktales and oral literature in southern Xinjiang and information on Sufi Islamic practices. Dawut disappeared in December 2017 and is believed to be in detention.

The drive for “backflow prevention” is also reflected in the identification of those who leave China as security threats. One report from Saimachang, a Uyghur stronghold in the historic center of Ürümqi, discusses former residents who have gone abroad and applied for political asylum as terrorists, corroborating reports that Uyghurs are monitored outside of China.

“It’s really clear evidence that charges of terrorism or extremism don’t meet international standards of terrorism or extremism,” said Byler. “Applying for political asylum is not a sign of terrorism by most definitions, but in this context it is.” This also demonstrates the amount of detailed information Chinese authorities keep about Uyghurs abroad.

Ayup has experience with this sort of monitoring. While in Kashgar, Ayup operated a Uyghur-language kindergarten and promoted Uyghur-language education. He fled China after 15 months of detention, during which he said he was interrogated and tortured. After leaving, Ayup said at one point he joined a WeChat group for the Chinese embassy. “When I went to the Chinese embassy, they asked me to join their WeChat group, and when I joined, a Chinese spy in Ürümqi found me; he talked to me and he threatened me,” he said.

Even holding a passport is considered suspicious. Documents in the database indicate Uyghur passport holders are checked on by authorities more frequently than those without passports.

Indeed, any knowledge of life outside of Xinjiang can be flagged as suspicious. For example, police in Weihuliang took note in one weekly report, among “people who need special attention,” of four people who had traveled to Beijing “to reflect local issues.” “The rest have never left the region, so they’re seen as safer,” Byler said.

Even phone calls or text chats involving outside countries invite scrutiny from authorities in Xinjiang. In Tianshan, the historic and majority-Uyghur center of Ürümqi, authorities reported sending a professional driver to re-education following an unusual phone call to a “key country.” Zenz believes the “key country” is one in a group of 26 largely Muslim “focus” countries watched by authorities. Xinjiang authorities have targeted people with connections to these countries for interrogation, detention and even imprisonment, according to a report by Human Rights Watch. The countries include Afghanistan, Algeria, Azerbaijan, Egypt, Indonesia, Iran, Iraq, Kazakhstan, Kenya, Kyrgyzstan, Libya, Malaysia, Nigeria, Pakistan, Russia, Saudi Arabia, Somalia, South Sudan, Syria, Tajikistan, Thailand, Turkey, Turkmenistan, United Arab Emirates, Uzbekistan, and Yemen.

2. While doing home visits, a community worker learned that [name redacted], who lives in [address], national ID number [redacted], female, Uyghur, has no job and stays home to care for her young children. … Community police searched on the police net and found out that the person was arrested in [hometown] on September 21, 2017. The reason for arrest: Cellphone contains obscure chat program. …

 

3. Social workers learned while doing home visits that [name redacted], who lives in [address redacted], Uyghur, national ID number [redacted] … his mother, [name redacted], female, Uyghur, national ID number [redacted], has been detained in Tianshan District on September 20, 2017. Reason for arrest: face covering. …

 

4. Community workers learned during home visits that [name redacted], who lives in [address], male, Uyghur … driver … has strange phone call behaviors during the night, and communicates with key countries. He has been detained in his hometown and is currently educated and converted (Shule County). … Mother: [name redacted], female, Uyghur. … Currently the community is monitoring her husband and children according to the detainee relative conditions.

The database also shows increased use of artificial intelligence, coupled with human intelligence, in directing surveillance in recent years. Documents from authorities in the Ürümqi districts of Tianshan and Shuimogou show IJOP sending push notifications directing investigations by local police. In 2018, one police precinct alone received 40 such notifications, according to one document.

While news reports in recent years have depicted Chinese police automation systems like IJOP as rudimentary, relying heavily on human intelligence, evidence in the database indicates use of machine-learning technology is growing, said Byler, who received his Ph.D. in Uyghur technopolitics in Chinese cities of Central Asia.

“What your data shows is that it’s beginning to automate in some ways, especially around face surveillance,” Byler said. “If they’re using 900 checkpoint [scans] around face surveillance, they are using AI to a significant extent now,” he added, referring to the 935 facial scans in one week in Qidaowan Precinct.

Documents show police are also adding into IJOP a significant amount of checkpoint data, including phone downloads from anti-terrorism swords. Documents from 2018 and 2019 show mounting push notifications from IJOP. “It’s clear that that system is beginning to alert them and direct their policing in new ways, and so it is starting to come online,” said Byler.

The documents also make clear the extent to which authorities try to assess the psychology of people under suspicion, with a keen eye in particular toward loyalty and even fervor. This is exhibited at so-called flag-raising ceremonies: community events in which participants proclaim their loyalty to China and the ruling regime. Documents show that these events are extensively monitored by police and their proxies. Authorities watch not just former detainees but their relatives as well, to confirm they are participating and to determine how passionate they are about doing so.

Authorities used participation in these weekly ceremonies as a way to monitor three people, likely Uyghurs, on a community watchlist, according to one of the documents. Participants are asked to perform a vow of loyalty involving the phrase “Voice your opinion, raise your sword” (or “Show your voice, show your sword”). If their participation is not wholehearted and patriotic, employers and others inform on them to police, Byler said. Also scrutinized at the ceremonies are “surplus laborers,” people on a coercive labor track that blends work on community projects with re-education. The surplus labor program has ramped up sharply over the last four years.

The documents make clear the extent to which authorities try to assess the psychology of people under suspicion, with a keen eye in particular toward loyalty and even fervor. 

Documents show that the police officers and neighbors doing this monitoring at flag-raising ceremonies are also making recommendations about who should be sent to re-education camps.

Although China has insisted its policing in Xinjiang is directed at stopping terrorism and extremism rather than persecuting the practice of any religion, the database confirms and details how surveillance homes in on many common expressions of Islamic faith, and even on curiosity about the religion, leading in many cases to investigations. The government considers it a potential sign of religious extremism to grow a beard, have a prayer rug, own Uyghur books, or even quit smoking or drinking.

Surveillance directed at Islamic practice in the region also involves watching mosques. Authorities surveil mosque attendance, tally which worshippers are migrants and which are residents, and monitor whether prayers are conducted in an orderly way, according to police reports in the database.

Ayup said mosques have cameras inside too, and people are surveilled for the way in which they pray.

“If people use a different style of praying … the camera takes a picture,” he said, adding that a friend was arrested for this. Ayup said that some Uyghurs pray in very old styles, and some use new styles. “In the Chinese government’s eyes, the new style is threatening, is extremism,” he said.

Even the use of natural gas in a neighborhood mosque was monitored, according to a document from Quingcui, a community in the Liudaowan neighborhood in the district of Shuimogou.

Citizens Integrated Into System of “Hyperpolicing”

The relentless surveillance in Xinjiang has been the best understood component of the repressive environment in the region. More difficult to study and understand, particularly for human rights groups abroad, has been how and to what extent it drives enforcement. As it turns out, the intensity of policing in Xinjiang matches the hyperaggression of the surveillance: closely integrated and every bit as pervasive. The database obtained by The Intercept reveals evidence of a deeply invasive police state, concerned with people’s thoughts and enthusiasms, entering their homes, interfering with their daily movements, and even seeking out crimes in activities perfectly legal at the time they were undertaken. Authorities in the region direct investigations and other police work using an approach one expert, after examining portions of the database, described as “hyperpolicing,” cracking down on any aberrant behavior. The tactics used are all-encompassing, involving civilian brigades, home visits, and frequent checkpoints. As extensive as this work is, it is also conducted in a way that targets people according to perceived danger. Minorities of all sorts — be they linguistic, religious, or ethnic — are disproportionately patrolled.

Discrimination against so-called ethnic-language people, or Muslim minorities with their own languages, is a key component of policing in Xinjiang.

Many detainees and former detainees are referred to as “three-category people.” The label, applied very liberally, refers to purported extremists and terrorists of three levels of severity, ranked according to the government’s perception of their mindset and potential to cause harm. Relatives of detainees and former detainees are also labeled, ranked, and tracked by police. Another system categorizes people as trustworthy, normal, or untrustworthy.

Police categories and rankings implicitly draw attention to minority groups, but in some contexts, this focus is made explicit. For example, minutes from the community stability meetings show that these meetings specifically put a focus on “ethnic-language people,” who are under stronger surveillance than Chinese-speaking Hui Muslims. The meetings also focus on relatives of primarily Uyghur detainees.

Uyghurs are also policed in their practice of Islam. Documents show that police at times conduct security checks on everyone attending a given mosque.

Indeed, the government tightly controls who is allowed into mosques. One police document detailed an incident in which three students tried to go to a funeral for a friend’s father at a mosque. As Byler described it, the three students “were just hanging around the entrance trying to find a way to walk in because they had to scan their ID cards to go inside, but they were worried that [the front gate checkpoint] would contact the police and they didn’t know what to do.” The police questioned the students, held them for hours, and put them on a watchlist at school, “even though they explained everything they were trying to do,” Byler said.

More recent reports indicate that authorities set a goal of lowering mosque attendance and met it. Many police documents mention that mosque attendance is lower, and some explicitly describe this as indicating success. One report indicated that at one mosque, total visits in a four-month period declined by 80,000, compared to the same period in the prior year: more than a 96 percent decrease. This appears to be partly due to the departure of an imam and temporary closure of the mosque, but the report states that “there has been a drastic lowering of religious practitioners” over two years. It adds that this is partly because visitors left the city, were sent to camps, or were afraid to practice Islam.

There are 167 religious practitioners in the jurisdiction. … In the past two years, there has been a drastic lowering of religious practitioners. … The remaining practitioners are by and large long-term residents of advanced age.

 

Reasons for changes in believer numbers and composition: …

 

The jurisdiction strictly followed the anti-extremism work ordered by the regional officer. …

 

The mosque has a strict real-name policy and conducts religious activities following the law. People who work in the public sector and some young people no longer enter the premises. …

 

Since the beginning of the 2017 Strike Down and Detain operation, the problematic people in the jurisdiction have either been detained or re-educated. The total population has decreased.

Mosque activity that the Chinese government views as signs of extremism, said Ayup, can include praying without a Uyghur doppa, wearing perfume in the mosque, or even being relaxed while praying. Anybody who doesn’t praise the Chinese Communist Party after their prayer is also considered suspicious, he said.

One system categorizes people as trustworthy, normal, or untrustworthy.

In police notes, Byler said, “it’s interesting that they’re describing citizens as enemies, and it makes it clear that they see this as a sort of counterinsurgency, when really they’re just trying to detect who practices Islam or not.”

Notes from a police station in Weihuliang describe a “large-scale investigation … focused on areas where migrant populations congregate,” concentrating on people from predominately Uyghur southern Xinjiang. The notes said that in one week, police had registered 605 people from southern Xinjiang, investigating 383 of them and people they lived with. In the same sweeps, authorities inspected 367 phones and nine computers.

Xinjiang authorities’ policing of Islam is particularly zealous in its hunt for “wild imams” or “illegal preaching.” The terms refer to Islamic preachers whose work is not sanctioned by the Chinese government; rights groups have said Chinese authorities draw this legal line arbitrarily, to serve political needs. These imams can be prosecuted for sermons delivered either online and in mosques.

The Weihuliang police station notes list 60 people involved in so-called illegal preaching, 50 of whom are in custody. The same document said that “illegal preaching” in the WeChat group “Group 1 teach (Qur’an ABCs)” led to the capture of a 41-year-old Hui woman and the administrative detention of a 62-year-old Hui man.

More recent documents, from 2017 through 2019, reflect mounting difficulty by the police in continuing to find violations to enforce and people to place in detention or re-education camps. That’s because in 2017, the first wave of detentions swept Xinjiang, leading to the expulsion of a large portion of the population from Ürümqi. Xinjiang party leader Chen Quanguo told officials to “round up everyone who should be rounded up,” extending a hard-line approach Chinese President Xi Jinping began organizing after a mass stabbing at a train station and an attack on an outdoor market with cars and explosives, both in 2014.

Police documents from this period, after the first wave of repression, reflect an intent to hunt down suspicious behavior of any kind.

“You’re being policed on a micro level, both by human policing and by the application of the technology to you and your life.”

“The system is set up in a way that’s producing hyperpolicing,” Byler said, “where any strange or any kind of aberrant behavior is reported, and if you’re a minority, you’re ‘ethnic,’ which is how they refer to Uyghurs and Kazakhs, then you’re very susceptible to this kind of stuff and you’re being policed on a micro level, both by human policing and by the application of the technology to you and your life.”

In some instances, people are being persecuted for violating laws before the laws were even instituted.

One police document describes how Hui women were detained because of evidence they had studied the Quran in an online group — which was legal at the time they did it but became illegal prior to their detention. They had been inactive in the group for at least a year before they were detained.

Such uncertainty about laws in Xinjiang, and when one might run afoul of police, echoes Ayup’s experience. “After people get arrested, then they will find out that ‘Oh, that [activity] is dangerous,’” he explained.

Wang said the hyperpolicing has become more pervasive over time.

“It’s basically a crackdown of everything,” Wang said, spreading from repression of Islamic practices to drug abuse and mental illness. “They just want to make sure they have such control over that region, general overall control.”

One illustration of how policing became increasingly aggressive and ubiquitous in Xinjiang is a police report discussing how one knife at a dumpling shop was not chained to a secure post, as per regulation. The report said the violation needed to be rectified within a day. Laws in Xinjiang require not only the chaining of knives, the document indicated, but that knives also have QR codes identifying their owners. “It’s just a way of showing how tightly everything is controlled, that even knives that are used in cooking have to be thought of as potential weapons,” said Byler.

To maintain the maximal vigilance entailed in “hyperpolicing,” authorities in Xinjiang enlisted ordinary citizens to inform on one another — not unheard of in China but practiced in the region more extensively, particularly against Uyghurs and other ethnic minorities.

Helping to enable this, citizens are rewarded for reporting on one another. The documents in the database include some details on this previously reported fact. Informants are rewarded for passing along information, but people are also rewarded for more specific actions. Linking their WeChat account, passing a verification, and posting an image can all result in a cash reward. All of this is tracked and reflected in the database.

This type of policing, bubbling up from the grassroots of the populace, “is about recruiting and considering ordinary people as part of these surveillance teams.”

One document, a public announcement from police, indicates that police and auxiliaries faced pressure to submit large quantities of intelligence to authorities. It chastised citizens in the high-tech zone within Ürümqi’s Xinshi district for sending in tips that are “filler created just to make report numbers seem large, and cannot be used, and occupy a large amount of manpower and time to process.” For example, “residents reported that there are often kids urinating in the elevator” of one building. Also: “A few citizens reported that they are scammed while buying crabs or mooncakes online. Quantities lost are generally not big.”

The announcement then went on to extensively detail 10 “categories of intelligence that are forbidden to report,” including tips having nothing to do with “policy about anti-terrorism, minority policy,” or with something called the “Xinjiang Management Agenda,” or with “policies that benefits citizens.”

Essentially, as Byler put it, authorities “were like, ‘That’s not the intelligence we want, we want intelligence about the Muslims.’”

This type of policing, bubbling up from the grassroots of the populace, “is about recruiting and considering ordinary people as part of these surveillance teams,” Wang said. “And in that way, it spells out quite an interesting philosophy of surveillance and society and engineering that I don’t think a lot of people understand outside of China.”

When Ayup lived in Xinjiang, he said, groups of 10 families were required to report somebody once a week in a feedback box, which existed before the app. “The problem is, if you cannot find something to write, you have to make it up to avoid being sent to the camps and to the center, so it’s obligatory. That’s the problem, but you cannot blame someone who reports because it’s his or her obligation,” he said.

In addition to drafting ordinary citizens individually to report on neighbors, authorities in Xinjiang also organized them through more formal community groups known as “safety units” or “brigades.” These units are segmented into groups of 10, according to documents in the database. For example, 10 households or 10 businesses might be organized as a brigade, with one volunteer from each group responding to calls like an emergency medical technician and doing drills in opposition to “terrorism.”

The safety brigades hark back to a historical Chinese tradition known as the Baojia system, in which 10 households formed a bao (or later a jia, 10 of which in turn formed a bao). This fractal structure formed a social safety system and is heavily associated with policing and the militarization of the population.

In modern times, similar systems have been branded as “grid management.” Several years ago, the Chinese government rolled out grid management nationwide; the density of citizen watch units in Xinjiang, however, has remained much higher than in other parts of the country, and safety units there are used for different purposes.

The Xinjiang safety units have not been seen in previous government documents, Byler said, but are pretty obvious if you’re in the region, where you’ll see drills, people marching in formation, and business owners wearing red armbands to show their affiliation.

“It’s the militarization of the population as a whole,” Byler said. “To this point we haven’t had a full description of what it’s supposed to do.”

Hyperpolicing also reaches into people’s homes through regular visits by authorities; those deemed at risk for extremist, terrorist, or separatist influence receive frequent visits. This typically means Uyghurs, dissidents, and those who have gone through re-education camps, as well as anyone related to any of those people.

Minutes from community stability meetings give a granular look at the type of information recorded in these home visits. They include professions, place of employment, former jobs, relatives (and relatives’ national ID numbers), travel, location of children, schools the children are attending, and what the community is still monitoring.

Some residents are discussed as being monitored or controlled by the community; that means a neighborhood watch unit is assigned to monitor them. This can include visits as often as every day, or once or twice a week, from one or more cadre members living in close proximity.

Some relatives of detainees are visited daily by local police. Even those considered trustworthy are visited, “to show them warmth and pull them into the Chinese patriotic fold,” as Byler put it. “It’s like winning hearts and minds.”

In one account from a police document, an older woman whose son was held by authorities befriended a police officer who visited her. Police claimed that the woman had become like a mother to the officer. She treated him like her son and opened up about all of her actual son’s activities. She was the ideal type of person who has been re-educated through the system, the document indicated.

Some home visits are for inspection purposes, to find religious items. Documents show police searching for religious books and removing prayer mats and even, as mentioned in a July 2018 police document, a picture of the hajj, the Muslim pilgrimage to Mecca, Saudi Arabia. The documents indicate this effort originates from 2018 and is connected to a government initiative known as the “three cleanups” to encourage people to purge material considered extremist from their homes. “This is one of the first times I’ve seen that mentioned explicitly, that they’re going through people’s homes,” Byler said.

A document from October 2018 described how these home inspections unfold:

First, the personnel from the police station should gather all the people in the house into the living room in order to verify their identities one by one. Second, the cadres responsible for the household and members of the patrol team will conduct a careful inspection of all rooms of the house, especially under the carpet, in the bathroom, in the kitchen, and under the bed. Suspicious areas such as corners of the sofas, etc., are to be inspected one by one using a “turning over the boxes, emptying out the cabinets” approach, and the house number where the suspicious objects were found and photo of the owner of the objects are to be taken as evidence.

The authorities also monitor phone calls between detainees and their family members back home. One document detailed such a call that lasted four minutes and 20 seconds, describing the contents of the conversation and how grateful the relatives were that the government allowed it. “It’s an inflection point documenting how people are receiving the re-education,” Byler explained. “If they cry or act angry that their relative can’t be released, that’s a sign that the re-education hasn’t been received.”

In many cases, relatives were asked to record their call and share it with the police, or they were interviewed immediately after to see how they were doing after the call.

Citizens in Xinjiang are also routinely stopped outside their homes by authorities. The database contains records from more than two million checkpoint stops in Ürümqi (population 3.5 million) and the surrounding area in a two-year period. It includes a list of nearly three dozen categories of people to stop, such as “intelligence national security important person.” When a person is stopped at a checkpoint, they go through an ID check, typically including processing via facial recognition. Facial recognition is sometimes performed through automatic scanning by a fixed surveillance camera. It can also be performed through a manual scan using a smartphone camera; these are often used on people deemed to need the extra scrutiny of an up-close facial scan, for example, because they lack ID. If a person’s face is displayed with a yellow, orange, or red indicator on a computer, showing the system has deemed them suspicious or criminal, they are questioned and may be arrested.

Categories of people often stopped at checkpoints include relatives of offenders and relatives of detainees.

Data retained from these stops include photos of those stopped, the latitude and longitude of the stop, the name of the collection point, vehicle and license plate if applicable, the search time, the search level, whether the person was released, and the result of the search. Those who were stopped are categorized in the database as people who were immediately arrested, those who were returned to their original residence, psychiatric patients, relatives of detainees, relatives of offenders, and individuals who were listed as participants of the July 2009 Ürümqi riots, in which Uyghur–Han violence at a toy factory in southeast China led to a broader outbreak of civil unrest involving attacks against largely ethnically Han residents.

A Detention System Built on Uncertainty and Inconsistencies

Beyond surveillance and policing, the database provides a close-up look at how various forms of incarceration are used to control the population, particularly minority groups and perceived dissidents in Xinjiang. It reveals a system moving to adapt its rhetoric and policies to a reality in which the length of incarceration, even under the guise of “training” or “re-education,” is often so uncertain that relatives of the imprisoned are grateful when detainees are granted fixed-term sentences.

Documents illustrate Xinjiang’s complex system of prison-like facilities, which roughly speaking break down into four categories: those for temporary detention; “re-education”; a more lenient form of re-education referred to as “vocational training”; and long-term prison.

Detention centers, which are said to have the harshest conditions and worst crowding, are essentially interrogation and holding facilities. People are kept there while waiting for an investigation to be completed. Re-education facilities are officially known as “transformation through education” camps. They practice “highly coercive brainwashing” in the words of Zenz, who has investigated the camps using government documents. The training centers are purportedly intended to transmit vocational and other skills but are clearly prison-like, with barbed wire, high walls, watchtowers, and internal camera systems.

It is common for a given citizen to travel through multiple types of incarceration in a sort of pipeline fashion. One police document from the Tianshan district of Ürümqi describes a mother involved in a “national security incident” who was put into re-education, then a vocational training school.

The re-education was conducted through the public security bureau’s internal security division, a domestic security force that investigates transnational crime. It is “a very tough unit,” often used against dissidents, said Zenz. “I totally expect that to be a place where torture is practiced, without knowing it for sure,” he added.

Authorities then sent the mother to a vocational training center, which would have been “still plenty unpleasant and coercive,” said Zenz, but “the most lenient” and eventually leading to release into forced labor. “In the police state, it’s the most desirable place to be because you’ll eventually get out,” he said. (These types of so-called vocational training centers are distinct from real vocational training centers existing in China that do not involve forced stays where people are removed from their families and subject to indoctrination.)

Nejmiddin Qarluq, a Uyghur who obtained asylum in Belgium in 2017, said the reason for detention isn’t always clear, since people are often arrested casually and have their property confiscated. When Qarluq was 6 years old, his father was released from prison. He himself was sentenced to three years in prison, then served another five-and-a-half-year term. One of his brothers was sentenced to life imprisonment in 1996, he said, and another brother was sentenced to six and a half years and is still in prison. His brother, ex-wife, and sister were locked up in an education camp in 2018.

Because Qarluq was sentenced when he was 14, he said his entire life after he was released was under Chinese Communist Party police supervision, and he wasn’t ever able to feel safe at all. And, he said, there is no freedom or privacy — even privacy of thought — beyond the country’s control. “I am the lucky one who got the chance to flee the country,” he said.

The database contains evidence that rates of detention, compared to re-education, may be significantly higher than outside observers believed. That would mean Uyghurs and others in the system were enduring significantly harsher conditions while incarcerated.

A police report from Weihuliang Precinct provides information on the number of people held throughout Shuimogou, one of seven districts in Ürümqi, in detention and re-education. At the time, in February 2018, the district had 803 people in re-education and almost as many, around 787, in detention. In Weihuliang specifically, the ratio of people in detention was even higher: 348 detained versus 184 in re-education.

Byler called this “a really shocking proportion, if we take this to be normative across the region.”

“That’s showing us that almost half of the people detained are not even in the re-education camp system yet, they’re just being processed,” Byler added. “Conditions in these spaces are really bad. If what these reports are telling us are true, that these larger numbers are being held in these spaces, it is really concerning.”

Byler described detention as often “very crowded, from what we’ve heard from people, and the conditions in them are really bad, because of the overcrowding. … People sometimes, because of the crowding, aren’t able to sleep at the same time because they can’t all fit on the bed (actually a platform with a wooden top called a ‘kang’) at the same time.” Cameras in the cell watch constantly, and lights remain on all night.

Re-education, in comparison, offers somewhat better conditions, including larger inner courtyards for marching or teaching, and more importantly, the hope of potentially quick release — whenever “transformative” education is complete. But documents from the database indicate this may be, at least in some cases, a false idea. In over 100 cases, they discuss fixed-length sentences for re-education, such as two-year or three-year terms.

On November 5, 2018, police officers and household-assigned cadres accompanied [name redacted] (female, Uyghur …), wife of re-educated individual [name redacted] (male, Uyghur …), to Daban City re-education node to have a face-to-face with [her husband]. At the same time, they received the announcement from the re-education center and the procuratorate [prosecutor’s office] that her husband was sentenced to three years in re-education. The vocational training center told [the wife] that her husband could potentially be released early if he has good behavior inside the center. [The wife] told the cadre that she can accept the fact that her husband was to be re-educated for three years, although her mood is very down, but at least she and her husband have some hope. She also hoped that her husband could have good behavior inside the re-education center and hopefully reunite with the family early. Police and cadre comforted [the wife] that she shouldn’t worry too much, take care of herself and take care of the two children, and that the community would help her to solve any problems she would face.

The sentences appear to be assigned to people in the vocational form of re-education, often after they have been in incarcerated for an extended period of time. They come, documents show, through a program called “Two Inform, One Advocate,” with “inform” apparently referring to information about extremism (as provided in re-education) and “advocate” referring to advocacy of a policy to provide sentences.

Under this system, relatives and cadre members typically meet the person in re-education and a judge issues a “pre-judgment” and “pre-sentence,” usually of two to four years in documents from the database. Sometimes, certain requirements come along with the sentence, such as acquiring Chinese language skills. An October 2018 report stated that “some relatives of three-category people are very happy after they learned about ‘Two Inform, One Advocate’ work; because of this, at least they know how long it would take for their relatives to come out, and they can arrange many business-related things beforehand.”

In one of many examples of this policy in the database, from a November 2018 report, a Uyghur woman traveled to Daban City Vocational Center to receive a verdict with her brother:

Her younger brother [name redacted] Uyghur, male … on September 27, 2017, due to living and traveling with a convicted person, was taken by Badaowan Precinct for re-education. Yesterday at the “Two Inform, One Advocate” activity at the center, the verdict was sheltering criminals, and the sentence was to study for three years at the vocational school. The relatives did not dissent from the verdict and thanked the care and love of the party and the government for her and their help to her [brother].

“We’ve never heard of people getting sentences for re-education,” said Byler. “They tell you that you have to earn points to be released, and so you’re supposed to try really hard to get re-educated, but now they’re saying actually that these people have been given a sentence, their course of re-education will take three years or what have you. So it’s actually like a prison term. That’s one of the tyrannies of the system, is that once you’re in the camps, you’ll never know when you’ll be released.”

Re-education also seems to be closed off as an option for some of the most heavily persecuted activities. The Weihuliang police station notes that homed in on “illegal preachers,” listing 50 in detention, said only two were in re-education.

Much of Zenz’s work has focused specifically on internment camps officially portrayed as “vocational skills education training centers” (zhiye jineng jiaoyu peixun zhongxin). The government positions them as a more benign alternative to prosecution for those who have committed minor offenses, but they are often cover for detention on minor grounds. Despite the emphasis on the word “training,” the facilities can practice coercive indoctrination just as re-education centers do.

Government documents previously obtained by Zenz had described the re-education as using, in Zenz’s recounting, “assault-style transformation through education” (jiaoyu zhuanhua gongjian) to “ensure that results are achieved” on those who have “a vague understanding, negative attitudes, or even show resistance.”

The impact of widespread detention is not limited to those who are in prison. One document indicates 326 children in one of the seven districts in Ürümqi have one or both parents in detention. The population of the district was around 43,730, according to 2010 government figures, but only around 12 percent of the population in Ürümqi are Uyghur. “If you take the adult population of that [ethnic group] and note that 326 students have one or two parents in detention, that appears to be quite substantial,” said Zenz.

Documents: The documents published with the story are available here.

The post Millions of Leaked Police Files Detail Suffocating Surveillance of China’s Uyghur Minority appeared first on The Intercept.

CellHawk’s maker says it can process a year’s worth of cellphone records in 20 minutes, automating a process that used to require painstaking work by investigators, including hand-drawn paper plots. The web-based product can ingest call detail records, or CDRs, which track cellular contact between devices on behalf of mobile service providers, showing who is talking to whom. It can also handle cellular location records, created when phones connect to various towers as their owners move around.

Such data can include “tower dumps,” which list all the phones that connected to a given tower — a form of dragnet surveillance. The FBI obtained over 150,000 phone numbers from a single tower dump undertaken in 2010 to try and collect evidence against a bank robbery suspect, according to a report from the Brennan Center for Justice at NYU.

Police use CellHawk to process datasets they routinely receive from cell carriers like AT&T and Verizon, typically in vast spreadsheets and often without a warrant. This is in sharp contrast to a better known phone surveillance technology, the stingray: a mobile device that spies on cellular devices by impersonating carriers’ towers, tricking phones into connecting, and then intercepting their communications. Unlike the stingray, CellHawk does not require such subterfuge or for police to position a device near people of interest. Instead, it helps them exploit information already collected by private telecommunications providers and other third parties.

CellHawk’s surveillance capabilities go beyond analyzing metadata from cellphone towers. Hawk Analytics claims it can churn out incredibly revealing intelligence from large datasets like ride-hailing records and GPS — information commonly generated by the average American. According to the company’s website, CellHawk uses GPS records in its “unique animation analysis tool,” which, according to company promotional materials, plots a target’s calls and locations over time. “Watch data come to life as it moves around town or the entire county,” the site states.

The tool can also help map interpersonal connections, with an ability to animate more than 20 phones at once and “see how they move relative to each other,” according to a promotional brochure.

CellHawk helps police exploit information already collected by private telecommunications providers.

The company has touted features that make CellHawk sound more like a tool for automated, continuous surveillance than for just processing the occasional spreadsheet from a cellular company. CellHawk’s website touts the ability to send email and text alerts “to surveillance teams” when a target moves, or enters or exits a particular “location or Geozone (e.g. your entire county border).”

On its website, Hawk Analytics claims this capability can help investigators “view plots & maps of the cell towers used most frequently at the beginning and end of each day.” But in brochures sent to potential clients, it was much more blunt, claiming that CellHawk can help “find out where your suspect sleeps at night.”

Data Sharing and Loose Regulation in Minnesota

The sheriff’s office in Hennepin County, Minnesota, which includes Minneapolis, certainly seemed impressed after it started using the software in early 2015. One criminal intelligence analyst lauded CellHawk’s ease of use in a February 2016 email comparing the subscription software to a competing tool. “CellHawk is pretty new and a lot cheaper! The great thing about cellhawk is that it is ‘hands off’ by the user, as the software does everything for you. It is drag and drop. The software can download calls from all major phone companies. The biggest selling point is of course the mapping. it also has animation, which is cool!”

Hennepin County Sheriff’s Office uses CellHawk as part of an effort to share intelligence through a Minnesota fusion center known as the Metro Regional Information Center, which brings together the FBI and eight counties serving up to 4 million people, according to the St. Cloud Times. In February 2018, the latest year for which The Intercept obtained HCSO invoices, the sheriff’s office renewed its annual subscription, providing the capability to store 250,000 CDRs.

A spokesperson for the sheriff’s office, Andrew Skoogman, said the office used certain CellHawk features infrequently. For example, it is “extremely rare” for HCSO to analyze tower dumps, he said, and “fairly rare” for it to use CellHawk’s automated location alerting service, which is used “based in the analytical needs of the investigator.”

The telecommunications data at the heart of CellHawk is shared extensively by providers. For example, Verizon in 2019 received more than 260,000 subpoenas, orders, warrants, and emergency requests from various U.S. law enforcement entities, including more than 24,000 for location information. But the legal requirements for obtaining that information are sometimes unclear. The American Civil Liberties Union in 2014 called the legal standards related to tower dumps “extremely murky.” A 2018 Brennan Center report stated that the courts were “split” on the handling of such dumps, with some lower courts allowing access to the data using a court order, which under the Stored Communications Act is obtained using a lower evidentiary standard than a warrant, requiring only “reasonable grounds to believe” the records are relevant to an ongoing investigation. Location records particular to a given subscriber, meanwhile, can be obtained with just a court order — unless they span seven days or more, in which case police need to get a full warrant, according to a 2018 Supreme Court ruling. Courts have also been divided on whether police need a court order or warrant to obtain “real-time” cellular location data.

Hennepin County defined its own legal standards to rely upon in deploying technology like CellHawk.

Hennepin County defined its own legal standards to rely upon in deploying technology like CellHawk. These were articulated in a sheriff’s office policy document dated August 2015 — months after CellHawk was already in use. The document, titled “Criminal Information Sharing and Analysis,” was released following a data request that was initiated in 2018 and fulfilled several years later following the election of a new sheriff. It stated that the office needed “[r]easonable suspicion,” which was deemed “present when sufficient facts are established to give … a basis to believe that there is, or has been, a reasonable possibility that an individual or organization is involved in a definable criminal activity or enterprise.”

The policy does not say that investigators must receive approval from a judge to retain information. Skoogman did not respond to The Intercept’s question about what legal standard is applied to the collection of CDRs.

Chad Marlow, senior advocacy and policy counsel for the ACLU, when asked to review Hennepin County’s CellHawk policy, said the CellHawk technology was “not inherently problematic” but that the county set a low standard for how it handles the collection of CellHawk data. Requiring “reasonable suspicion” is a typical threshold for traffic stops, not for intrusive searches, which require probable cause. CellHawk’s capabilities — combing through data from calls, texts, ride-hailing applications, etc. — are patently more intrusive than a traffic stop. Beyond that, Marlow said, the county’s “definition of reasonable suspicion is bizarrely convoluted” and should require that investigators “have to have a reasonable basis for a crime being committed not MAY BE being committed.”

Hennepin County’s policy continued:

Criminal intelligence information shall be retained for up to five years from the date of collection of use, whichever is later. After that time, this information shall be deleted unless new information revalidates ongoing criminal activities of that individual and/or organization. When updated criminal intelligence information is added into the file on a suspect individual or organization, such entries revalidate the reasonable suspicion and reset the five year standard for retention of that file.

The policy empowers HCSO investigators to scoop up this data and retain it for five years based on a fairly low legal standard.

And while this policy says the sheriff may not retain information based “solely” on support for “unpopular causes” or an individual’s “race, gender, age or ethnic background” and “personal habits and/or predilections that do not break any laws or threaten the safety of others” — mentioning activities covered by the First Amendment — if a crime were to occur during a protest, as is routine, that data is considered fair game by law enforcement. Under such low standards and with such a powerful surveillance utility, it wouldn’t take long to map out the social network of an entire protest movement.

Under such low standards and with such a powerful surveillance utility, it wouldn’t take long to map out the social network of an entire protest movement.

For instance, during a protest outside a detention center in downtown Minneapolis to show solidarity with demonstrations in neighboring Wisconsin following the shooting of an unarmed Black man by the Kenosha Police Department, Dave Hutchinson, the Hennepin County sheriff, said, “11 individuals were arrested and are being held on probable cause riot, damage to property and unlawful assembly,” according to an HCSO press release. Should the criminal intelligence investigators at the fusion center run those individuals’ information through CellHawk, it is not at all a stretch to say that the police would then possess a map of those individuals’ associations based on calls, texts, and other records. That map of social interactions could include thousands of activists who were not at all party to the crimes of which those 11 individuals are accused. Hawk Analytics markets such social network analysis as a primary feature.

When asked whether the use of CellHawk undermined the presumption of innocence — essentially reversing the investigative process, so that evidence comes first and suspicion of a specific crime after — Skoogman replied, essentially, that innocent people had nothing to fear. “People come under suspicion of having committed a crime based on information developed by investigators,” he wrote. “Based on evidence developed by those investigations, a suspect’s cell phone records may be obtained and analyzed. On occasion, that analysis has developed information suggesting that the suspect did not commit the crime under investigation. This is the investigative process. It is exactly why data is analyzed. To determine whether the data available supports continued focus on an individual as a suspect or perhaps rules them out.”

Screenshot from a Hawk Analytics promotional video displaying “link analysis,” which reveals a large network of “co-conspirators and associates” in a matter of seconds. The more data points, in this case cellphone numbers, run through CellHawk likely exponentially expands the number of other individuals roped into an investigation.

Deployed — and Promoted — Across the Country

Hawk Analytics CEO Mike Melson, whose bio on the company website describes him as a former NASA engineer, offers free trials to law enforcement organizations to which he hopes to sell his product. Additionally, Melson has worked as an expert witness, ready to testify on behalf of prosecutors. His testimony sometimes appears in local news outlets without mention of the fact that he is the CEO of the company that could stand to financially benefit, albeit indirectly, from a conviction. Hawk Analytics failed to comment on the record after multiple attempts were made over the phone and by email.

“This highlights how the rapid development of surveillance tech outstrips existing laws.”

In December 2013, Heather Elvis went missing from her South Carolina home after becoming embroiled in a lovers’ quarrel. Several years later, an 11-day trial resulted in two 30-year sentences for one Tammy Moorer. During the second day of that trial, Melson made an appearance as “an expert witness when it comes to analyzing cell phone data,” according to WBTW News 13. The station did not include that Melson was intimately involved in the creation of software that helped connect the dots in this case.

Additionally, according to reports from Northern Virginia, Hawk Analytics was reimbursed for their expert services which led to “the prosecution of a man convicted of first-degree murder in the 2017 shooting death of a … CVS store manager.” For their “cellular data analysis and two days of expert testimony,” Hawk Analytics was paid $8,175. That certainly isn’t a windfall, but it rivals the amount made from the sale of a small number of CellHawk subscriptions, and it effectively compounds revenue streams from multiple sides of the criminal justice system.

CellHawk is not the only technology that investigators in the Twin Cities use to process intelligence about suspects and others. Hennepin County and their law enforcement partners use automated license plate readers; stingrays and competing, similar devices; aerial surveillance; and social media intelligence, among other spy tech. CellHawk alone is powerful — but added to the area police’s already expansive arsenal, it tips local law enforcement toward becoming more like intelligence agencies than municipal cops.

Lengthy data retention policies and the power of these surveillance tools create a litany of frightening possibilities for overreach and abuse. While HCSO has acknowledged its use of some of these tools, it has not released any public reports on its use of CellHawk. Rachel Levinson-Waldman, deputy director of the Brennan Center’s liberty and national security program, who reviewed Hennepin County’s policy said, “The reference to use is concerning, since that could significantly expand the time for retention.”

Minnesota state law requires an individual whose electronic device was subject to a tracking warrant be notified within 90 days if that evidence did not end up in court. This “tracking warrant” law has been on the books since 2014 and yet, judging from press reports in recent years, it’s not clear any one in the state has ever received such a notice or if a tracking warrant has ever been unsealed by the courts. The law seems to have been thwarted in part by police avoiding warrants and obtaining instead court orders under the much lower “reasonable suspicion” standard. This, despite the fact that Minnesota law clearly states, under a subdivision titled “Tracking warrant required for location information,” that “a warrant granting access to location information must be issued only if the government entity shows that there is probable cause the person who possesses an electronic device or is using a unique identifier is committing, has committed, or is about to commit a crime.”

Julia Decker, policy director for the ACLU of Minnesota, said that “there doesn’t seem to be oversight” for the use of CellHawk in the state, even though surveillance should get oversight of “the highest standard possible.” She also said that Hennepin’s policy to retain CellHawk and similar data for five years raises the potential for harm to civil liberties.

“I think this highlights how the rapid development of surveillance tech outstrips existing laws, and how that can be really problematic,” said Decker. “Without oversight/regulation, powerful surveillance technology is integrated into already-existing investigatory frameworks, instead of being examined and considered beforehand for its potential to actually expand or push the limits/bounds of those frameworks and encroach on civil liberties. … In this moment of talking about police reform, use of surveillance tech needs to be part of the discussion.”

Hawk Analytics has many clients around the United States. This reporter conducted a survey using the Freedom of Information Act to collect invoices for CellHawk subscriptions from agencies referenced on CellHawk’s website, referred to in CellHawk’s training sessions, or mentioned in local news reports. He found numerous agencies fielding the technology: Atlanta and Fayette County, Ga.; Kansas City, Kan.; Franklin County, Va.; Utah County, Utah,; Fort Collins, Colo.; Hidalgo County, Texas; Orange County, Calif.; and, of course, the FBI all have paid for CellHawk in the last several years. The Madison, Wisconsin, police department appears to have thousands of potential CellHawk records from 2018 alone but has demanded close to $700 to examine and provide them.

The post Powerful Mobile Phone Surveillance Tool Operates in Obscurity Across the Country appeared first on The Intercept.

Microsoft’s links to law enforcement agencies have been obscured by the company, whose public response to the outrage that followed the murder of George Floyd has focused on facial recognition software. This misdirects attention away from Microsoft’s own mass surveillance platform for cops, the Domain Awareness System, built for the New York Police Department and later expanded to Atlanta, Brazil, and Singapore. It also obscures that Microsoft has partnered with scores of police surveillance vendors who run their products on a “Government Cloud” supplied by the company’s Azure division and that it is pushing platforms to wire police field operations, including drones, robots, and other devices.

With partnership, support, and critical infrastructure provided by Microsoft, a shadow industry of smaller corporations provide mass surveillance to law enforcement agencies. Genetec offers cloud-based CCTV and big data analytics for mass surveillance in major U.S. cities. Veritone provides facial recognition services to law enforcement agencies. And a wide range of partners provide high-tech policing equipment for the Microsoft Advanced Patrol Platform, which turns cop cars into all-seeing surveillance patrols. All of this is conducted together with Microsoft and hosted on the Azure Government Cloud.

Last month, hundreds of Microsoft employees petitioned their CEO, Satya Nadella, to cancel contracts with law enforcement agencies, support Black Lives Matter, and endorse defunding the police. In response, Microsoft ignored the complaint and instead banned sales of its own facial recognition software to police in the United States, directing eyes away from Microsoft’s other contributions to police surveillance. The strategy worked: The press and activists alike praised the move, reinforcing Microsoft’s said position as a moral leader in tech.

Yet it’s not clear how long Microsoft will escape major scrutiny. Policing is increasingly done with active cooperation from tech companies, and Microsoft, along with Amazon and other cloud providers, is one of the major players in this space.

Because partnerships and services hosting third party vendors on the Azure cloud do not have to be announced to the public, it is impossible to know full extent of Microsoft’s involvement in the policing domain, or the status of publicly announced third party services, potentially including some of the previously announced relationships mentioned below.

Microsoft declined to comment.

Microsoft: From Police Intelligence to the Azure Cloud

In the wake of 9/11, Microsoft made major contributions to centralized intelligence centers for law enforcement agencies. Around 2009, it began working on a surveillance platform for the NYPD called the Domain Awareness System, or DAS, which was unveiled to the public in 2012. The system was built with leadership from Microsoft along with NYPD officers.

While some details about the DAS have been disclosed to the public, many are still missing. The most comprehensive account to date appeared in a 2017 paper by NYPD officers.

The DAS integrates disparate sources of information to perform three core functions: real-time alerting, investigations, and police analytics.

Through the DAS, the NYPD watches the personal movements of the entire city. In its early days, the system ingested information from closed-circuit TV cameras, environmental sensors (to detect radiation and dangerous chemicals), and automatic license plate readers, or ALPRs. By 2010, it began adding geocoded NYPD records of complaints, arrests, 911 calls, and warrants “to give context to the sensor data.” Thereafter, it added video analytics, automatic pattern recognition, predictive policing, and a mobile app for cops.

By 2016, the system had ingested 2 billion license plate images from ALPR cameras (3 million reads per day, archived for five years), 15 million complaints, more than 33 billion public records, over 9,000 NYPD and privately operated camera feeds, videos from 20,000-plus body cameras, and more. To make sense of it all, analytics algorithms pick out relevant data, including for predictive policing.

The NYPD has a history of police abuse, and civil rights and liberties advocates like Urban Justice Center’s Surveillance Technology Oversight Project have protested the system out of constitutional concerns, with little success to date.

While the DAS has received some attention from the press — and is fairly well-known among activists — there is more to the story of Microsoft policing services.

Over the years, Microsoft has grown its business through the expansion of its cloud services, in which storage capacity, servers, and software running on servers are rented out on a metered basis. One of its offerings, Azure Government, provides dedicated data hosting in exclusively domestic cloud centers so that the data never physically leaves the host country. In the U.S., Microsoft has built several Azure Government cloud centers for use by local, state, and federal organizations.

Unbeknownst to most people, Microsoft has a “Public Safety and Justice” division with staff who formerly worked in law enforcement. This is the true heart of the company’s policing services, though it has operated for years away from public view.

Microsoft’s police surveillance services are often opaque because the company sells little in the way of its own policing products. It instead offers an array of “general purpose” Azure cloud services, such as machine learning and predictive analytics tools like Power BI (business intelligence) and Cognitive Services, which can be used by law enforcement agencies and surveillance vendors to build their own software or solutions.

Microsoft’s Surveillance-Based IoT Patrol Car

A rich array of Microsoft’s cloud-based offerings is on full display with a concept called “The Connected Officer.” Microsoft situates this concept as part of the Internet of Things, or IoT, in which gadgets are connected to online servers and thus made more useful. “The Connected Officer,” Microsoft has written, will “bring IoT to policing.”

With the Internet of Things, physical objects are assigned unique identifiers and transfer data over networks in an automated fashion. If a police officer draws a gun from its holster, for example, a notification can be sent over the network to alert other officers there may be danger. Real Time Crime Centers could then locate the officer on a map and monitor the situation from a command and control center.

According to this concept, a multitude of surveillance and IoT sensor data is sent onto a “hot path” for fast use in command centers and onto a “cold path” to be used later by intelligence analysts looking for patterns. The data is streamed along through Microsoft’s Azure Stream Analytics product, stored on the Azure cloud, and enhanced by Microsoft analytics solutions like Power BI — providing a number of points at which Microsoft can make money.

While the “Connected Officer” was a conceptual exercise, the company’s real-world patrol solution is the Microsoft Advanced Patrol Platform, or MAPP. MAPP is an IoT platform for police patrol vehicles that integrates surveillance sensors and database records on the Azure cloud, including “dispatch information, driving directions, suspect history, a voice-activated license plate reader, a missing persons list, location-based crime bulletins, shift reports, and more.”

The MAPP vehicle is outfitted with gear from third-party vendors that stream surveillance data into the Azure cloud for law enforcement agencies. Mounted to the roof, a 360-degree high-resolution camera streams live video to Azure and the laptop inside the vehicle, with access also available on a mobile phone or remote computer. The vehicle also sports an automatic license plate reader that can read 5,000 plates per minute — whether the car is stationary or on the move — and cross-check them against a database in Azure and run by Genetec’s license plate reader solution, AutoVu. A proximity camera on the vehicle is designed to alert the officers when their vehicle is being approached.

Patrolling the skies is a drone provided by Microsoft partner Aeryon Labs, the SkyRanger, to provide real-time streaming video. (Aeryon Labs is now part of surveillance giant FLIR Systems.) According to Nathan Beckham of Microsoft Public Safety and Justice, the vehicle’s drones “follow it around and see a bigger view of it.” The drones, writes DroneLife, can “provide aerial views to the integrated data platform, allowing officers to assess ongoing situations in real time, or to gather forensic evidence from a crime scene.”

Police robots are also part of the MAPP platform. Products from ReconRobotics, for example, “integrat[ed] with Microsoft’s Patrol Car of the Future Program” in 2016. Microsoft says ReconRobotics provides their MAPP vehicle with a “small, lightweight but powerful robot” that “can be easily deployed and remotely controlled by patrol officers to provide real-time information to decision-makers.”

Another Microsoft partner, SuperDroid Robots, has also announced they will provide the Microsoft MAPP vehicle with two compact remote-controlled surveillance robots, the MLT “Jack Russell” and the LT2-F “Bloodhound,” the latter of which can climb stairs and obstacles.

Although it sports a Microsoft insignia on the hood and door, the physical vehicle the company uses to promote MAPP isn’t for sale by Microsoft, and you probably won’t see Microsoft-labeled cars driving around. Rather, Microsoft provides MAPP as a platform through which to transform existing cop cars into IoT surveillance vehicles: “It’s really about being able to take all this data and put it up in the cloud, being able to source that data with their data, and start making relevant information out of it,” said Beckham.

Indeed, Microsoft says “the car is becoming the nerve center for law enforcement.” According to Beckham, the information collected and stored in the Azure cloud will help officers “identify bad actors” and “let the officers be aware of the environment that is going on around them.” As an example, he said, “We’re hoping with machine learning and AI in the future, we can start pattern matching” with MAPP vehicles providing data to help find “bad actors.”

Last October, South African police announced Microsoft partnered with the city of Durban for “21st century” smart policing. Durban’s version of the the MAPP solution includes a 360-degree ALPR to scan license plates and a facial recognition camera from Chinese video surveillance firm Hikvision for use when the vehicle is stationary (e.g., parked at an event).

According to South African news outlet ITWeb, the metro police will use the MAPP solution “to deter criminal activities based on data analysis through predictive modeling and machine learning algorithms.” The vehicle has already been rolled out in Cape Town, where Microsoft recently opened a new Azure data center — an extension of the digital colonialism I wrote about in 2018.

Microsoft’s MAPP patrol vehicle in Durban sports a facial recognition camera from China-based Hikvision. Photos taken from Multimedia Live presentation, ‘Metro police go high-tech for festive season.’ Images: Multimedia Live presentation

Much like the U.S. (albiet with some different dynamics), South Africa faces the scourge of police brutality that disproportionately impacts people of color. The country had its own George Floyd moment during the recent Covid-19 lockdown when the military and police brutally beat 40-year-old Collins Khosa in the poor Alexandra township, leading to his death — over a cup of beer. (A military inquiry found that Khosa’s death was not linked to his injuries at the hands of authorities; Khosa’s family and many others in South Africa have rejected the review as a whitewash.)

The MAPP solution will be used for “zero tolerance” policing. For example, Durban Metro Police spokesperson Parboo Sewpersad said the rollout aims to punish “littering, drinking and driving, and drinking and walking” during summer festivities.

It is difficult to determine where else the MAPP vehicle may be deployed. The rollout in South Africa suggests Microsoft sees Africa as a place to experiment with its police surveillance technologies.

Microsoft: Powering CCTV and Police Intelligence in the City

Beyond wiring police vehicles, video surveillance provides another lucrative source of profits for Microsoft, as it is loaded with data packets to transmit, store, and process — earning fees each step of the way.

When building a CCTV network packed with cameras, cities and businesses typically use a video management system, or VMS, to do things like display multiple camera feeds on a video wall or offer the option to search through footage. A leading VMS provider, Genetec, offers the core VMS integrated into Microsoft’s Domain Awareness System. A close partner of Microsoft for over 20 years, the two companies work together on integrating surveillance services on the Azure cloud.

Some of the most high-profile city police forces are using Genetec and Microsoft for video surveillance and analytics.

Through a public-private partnership called Operation Shield, Atlanta’s camera network has grown from 17 downtown cameras to a wide net of 10,600 cameras that officials hope will soon cover all city quadrants. Genetec and Microsoft Azure power the CCTV network.

On June 14, Atlanta’s Chief of Police, Erika Shields, resigned after APD cops shot and killed a 27-year-old Black man, Rayshard Brooks. Last month, six Atlanta police officers were charged for using excessive force against protesters of police violence.

In 2019, Atlanta Police Foundation COO Marshall Freeman told me the foundation had just completed a “department-wide rollout” for Microsoft Aware (Domain Awareness System). Freeman said the Atlanta Police Department uses Microsoft machine learning to correlate data, and plans to add Microsoft’s video analytics. “We can always continue to go back to Microsoft and have the builders expand on the technology and continue to build out the platform,” he added.

In Chicago, 35,000 cameras cover the city with a plug-in surveillance network. The back-end currently uses Genetec Stratocast and Genetec’s Federation service, which manages access to cameras across a federated network of CCTV cameras — a network of camera networks, so to speak.

In 2017, Genetec custom-built their Citigraf platform for the Chicago Police Department — the second-largest police force in the country — as a way to make sense of the department’s vast array of data. Powered by Microsoft Azure, Citigraf ingests information from surveillance sensors and database records. Using real-time and historical data, it performs calculations, visualizations, alerts, and other tasks to create “deep situational awareness” for the CPD. Microsoft is partnering with Genetec to build a “correlation engine” to make sense of the surveillance data.

Chicago’s police force has a brutal history of racism, corruption, and even two decades’ worth of torturing suspects. During police violence protests following Floyd’s murder, the CPD attacked and beat protesters, including five Black protesters to the point of hospitalization.

The city of Detroit uses Genetec Stratocast and Microsoft Azure to power their controversial Project Green Light. Launched in 2016 in tandem with a new Real Time Crime Center, the project allows local businesses — or other participating entities, such as churches and public housing — to install video cameras on their premises and stream surveillance feeds to the Detroit Police Department. Participants can place a “green light” next to the cameras to warn the public — which is 80 percent Black — that “you are being watched by the police.”

In 2015, the DPD stated, “the day is coming where police will have access to cameras everywhere allowing the police to virtually patrol nearly any area of the city without ever stepping foot.”

DPD Assistant Chief David LeValley explained to me that prior to creating the new command center, the department sent a team of people to several other U.S. cities, including New York, Chicago, Atlanta, Boston, and the Drug Enforcement Administration center in El Paso, Texas, to scope out their intel centers. “Our Real Time Crime Center is an all-encompassing intelligence center, it’s not just Project Green Light,” he explained.

The expansion of police surveillance in Detroit has been swift. Today, Project Green Light has around 2,800 cameras installed across over 700 locations, and two smaller Real Time Crime Centers are being added, a development trending in cities like Chicago. LeValley told me those RTTCs will do things like “pattern recognition” and “reports for critical incidents.”

In the wake of George Floyd’s murder, activists in Detroit have recharged their efforts to abolish Project Green Light in the fight against police surveillance, which local community advocates like Tawana Petty and Eric Williams deem racist. This year, two Black men, Robert Julian-Borchak Williams and Michael Oliver, were wrongfully arrested after being misidentified by the DPD’s facial recognition technology.

Nakia Wallace, a co-organizer of Detroit Will Breathe, told me Project Green Light “pre-criminalizes” people and “gives the police the right to keep tabs on you if they think you are guilty” and “harass Black and brown communities.” “Linking together cameras” across wide areas is “hyper-surveillance” and “has to be stopped,” she added.

The “function that the [DPD] serve,” Wallace said, is “the protection of property and white supremacy.” “They’re hyper-militarized, and even in the wake of that, people are still dying in the city” because “they have no interest in the livelihood of Detroit citizens.” Instead of militarizing, we need to “stop pretending like poor Black people are inherently criminals, and start looking at social services and things that prevent people from going into a life of crime.”

In a 2017 blog post, Microsoft boasted about the partnership with Genetec for the DPD, stating that Project Green Light is “a great example of how cities can improve public safety, citizens’ quality of life, and economic growth with today’s technologies.”

Microsoft Actually Does Supply Facial Recognition Technology

While Microsoft has been powering intelligence centers and CCTV networks in the shadows, the company has publicly focused on facial recognition regulations. On June 11, Microsoft joined Amazon and IBM in saying it will not sell its facial recognition technology to police until there are regulations in place.

This is a PR stunt that confused how Microsoft’s relationship to policing works technically and ethically, in a number of ways.

First, while the press occasionally criticizes Microsoft’s Domain Awareness System, most attention to Microsoft policing focuses on facial recognition. This is mistaken: Microsoft is providing software to power a variety of policing technologies that undermine civil rights and liberties — even without facial recognition.

Second, facial recognition is a notable feature of many video surveillance systems and Real Time Crime Centers that Microsoft powers. The cities of New York, Atlanta, Chicago, and Detroit are among those utilizing Microsoft services to collect, store, and process the visual surveillance data used for facial recognition. Microsoft services are part and parcel of many police facial recognition surveillance systems.

Third, at least one facial recognition company, Veritone, has been left out of the conversation. A Microsoft partner, the Southern California artificial intelligence outfit offers cloud-based software called IDentify, which runs on Microsoft’s cloud and helps law enforcement agencies flag the faces of potential suspects.

In a 2020 keynote at the Consumer Electronics Show, speaking alongside executives from Microsoft, Deloitte, and Oracle, Veritone CEO Chad Steelberg claimed that thanks to Veritone’s IDentify software on Azure, cops have helped catch “hundreds and hundreds of suspects and violent offenders.” Veritone’s Redact product expedites prosecutions, and Illuminate allows investigators to “cull down evidence” and obtain anomaly “detection insights.”

In a recent webinar, Veritone explained how IDentify leverages data police already have, such as arrest records. If a person is detected and has no known match, the IDentify software can profile suspects by creating a “person of interest database” that “will allow you to simply save unknown faces to this database and continuously monitor for those faces over time.”

Veritone claims to deploy services in “about 150 locations,” but does not name which ones use IDentify. It launched a pilot test with the Anaheim Police Department in 2019.

Microsoft lists Veritone IDentify as a facial recognition law enforcement product offering in its app repository online. The promotional video on the Microsoft website advertises IDentify’s ability to:

… compare your known offender and person of interest databases with video evidence to quickly and automatically identify suspects for investigation. Simply upload evidence from surveillance systems, body cameras, and more. … But best of all, you’re not chained to your desk! Snap a picture and identify suspects while out on patrol, to verify statements, and preserve ongoing investigations.

Veritone has been a staunch defender of its facial recognition technology. In May 2019, the company tweeted:

Amazon’s facial-recognition technology is supercharging local policing in Oregon. Did you know Veritone IDentify can kick it up a notch by harnessing the power of state booking databases to uncover their suspect leads faster? #IDentifyhttps://t.co/LMmqBkrP6I

— Veritone (@veritoneinc) May 30, 2019

In a promotional video featuring Microsoft, Veritone’s Jon Gacek said, “You can see why at Veritone we’re excited to be tightly partnered with Microsoft Azure team. Their vision and our vision is very common.”

Smoke, Mirrors, and Misdirection

Despite claims to the contrary, Microsoft is providing facial recognition services to law enforcement through partnerships and services to companies like Veritone and Genetec, and through its Domain Awareness System.

Microsoft’s public relations strategy is designed to mislead the public by veering attention away from its wide-ranging services to police. Instead, Microsoft president and chief legal officer Brad Smith urges the public to focus on facial recognition regulation and the issue of Microsoft’s own facial recognition software, as if their other software and service offerings, partnerships, concepts, and marketing are not integral to a whole ecosystem of facial recognition and mass surveillance systems offered by smaller companies.

Esteemed Microsoft scholars, such as Kate Crawford, co-founder of the Microsoft-funded think tank, AI Now Institute, have followed this playbook. Crawford recently praised Microsoft’s facial recognition PR and criticized companies like Clearview AI and Palantir, while ignoring the Microsoft Domain Awareness System, Microsoft’s surveillance partnerships, and Microsoft’s role as a cloud provider for facial recognition services.

https://twitter.com/katecrawford/status/1271133485747625984

Crawford and AI Now co-founder Meredith Whittaker have condemned predictive policing but haven’t explained the fact that Microsoft plays a central role in predictive policing for police. Crawford did not respond to a request for comment.

If these Microsoft clients were offering sex trafficking services on the Azure cloud, Microsoft would surely close their accounts.

Microsoft and its advocates may claim that it is a “neutral” cloud provider and it’s up to other companies and police departments to decide how they use Microsoft software. Yet these companies are partnering with Microsoft, and Microsoft is getting paid to run their mass surveillance and facial recognition services on the Azure cloud — services that disproportionately affect people of color.

If these Microsoft clients were offering sex trafficking services on the Azure cloud, Microsoft would surely close their accounts. And because law enforcement agencies purchase surveillance technologies using taxpayer dollars, the public is actually paying Microsoft for its own police surveillance.

If activists force corporations like Microsoft, Amazon, Google, IBM, and Oracle to terminate partnerships and infrastructure services for third parties conducting police surveillance, then cloud providers would have to acknowledge they are accountable for what is done on their clouds. Moving forward, activists could press to replace corporate ownership of digital infrastructure and data with community ownership at the local level.

There is a lot at stake in this moment.

The post The Microsoft Police State: Mass Surveillance, Facial Recognition, and the Azure Cloud appeared first on The Intercept.

Private businesses and homes are starting to plug their cameras into police networks, and rapid advances in artificial intelligence are investing closed-circuit television, or CCTV, networks with the power for total public surveillance. In the not-so-distant future, police forces, stores, and city administrators hope to film your every move — and interpret it using video analytics.

The rise of all-seeing smart camera networks is an alarming development that threatens civil rights and liberties throughout the world. Law enforcement agencies have a long history of using surveillance against marginalized communities, and studies show surveillance chills freedom of expression — ill effects that could spread as camera networks grow larger and more sophisticated.

To understand the situation we’re facing, we have to understand the rise of the video surveillance industrial complex — its history, its power players, and its future trajectory. It begins with the proliferation of cameras for police and security, and ends with a powerful new industry imperative: complete visual surveillance of public space.

Video Management Systems and Plug-in Surveillance Networks

In their first decades of existence, CCTV cameras were low-resolution analog devices that recorded onto tapes. Businesses or city authorities deployed them to film a small area of interest. Few cameras were placed in public, and the power to track people was limited: If police wanted to pursue a person of interest, they had to spend hours collecting footage by foot from nearby locations.

In the late 1990s, video surveillance became more advanced. A company called Axis Communications invented the first internet-enabled surveillance camera, which converted moving images to digital data. New businesses like Milestone Systems built Video Management Systems, or VMS, to organize video information into databases. VMS providers created new features like motion sensor technology that alerted guards when a person was caught on camera in a restricted area.

As time marched on, video surveillance spread. On one account, about 50 years ago, the United Kingdom had somewhere north of 60 permanent CCTV cameras installed nationwide. Today, the U.K. has over 6 million such devices, while the U.S. has tens of millions. According to marketing firm IHS Markit, 1 billion cameras will be watching the world by the end of 2021, with the United States rivaling China’s per person camera penetration rate. Police can now track people across multiple cameras from a command-and-control center, desktop, or smartphone.

While it is possible to link thousands of cameras in a VMS, it is also expensive. To increase the amount of CCTVs available, cities recently came up with a clever hack: encouraging businesses and residents to place privately owned cameras on their police network — what I call “plug-in surveillance networks.”

Detroit has popularized plug-in surveillance networks through its controversial Project Green Light program. With Project Green Light, businesses can purchase CCTV cameras and connect them to police headquarters. They can also place a bright green light next to the cameras to indicate they are part of the police network. The project claims to deter crime by signaling to residents: The police are watching you.

Detroit is not alone. Chicago, New Orleans, New York, and Atlanta have also deployed plug-in surveillance networks. In these cities, private businesses and/or homes provide feeds that are integrated into crime centers so that police can access live streams and recorded footage. The police department in New Haven, Connecticut, told me they are looking into plug-in surveillance, and others are likely considering it.

The number of cameras on police networks now range from tens of thousands (Chicago) to several hundred (New Orleans). With so many cameras in place, and only a small team of officers to watch them, law enforcement agencies face a new challenge: How do you make sense of all that footage?

The answer is video analytics.

Video Analytics Takes Off

Around 2006, a young Israeli woman was recording family videos every weekend, but as a student and parent, she didn’t have time to watch them. A computer scientist at her university, Professor Shmuel Peleg, told me he tried to create a solution for her: He would take a long video and condense the interesting activity into a short video clip.

His solution failed: It only worked on stationary cameras, and the student’s video camera was moving when she filmed her family.

Peleg soon found another use case in the surveillance industry, which relies on stationary cameras. His solution became BriefCam, a video analytics firm that can summarize video footage from a scene across time so that investigators can view all relevant footage in a short space of time.

Using a feature called Video Synopsis, BriefCam overlays footage of events happening at different times as if they are appearing simultaneously. For example, if several people walked past a camera at 12:30 p.m., 12:40 p.m., and 12:50 p.m., BriefCam will aggregate their images into a single scene. Investigators can view all footage of interest from a given day in minutes instead of hours.

Thanks to rapid advances in artificial intelligence, summarization is just one feature in BriefCam’s product line and the rapidly expanding video analytics industry.

Behavior recognition includes video analytics capabilities like fight detection, emotion recognition, fall detection, loitering, dog walking, jaywalking, toll fare evasion, and even lie detection.

Object recognition can recognize faces, animals, cars, weapons, fires, and other things, as well as human characteristics like gender, age, and hair color.

Anomalous or unusual behavior detection works by recording a fixed area for a period of time — say, 30 days — and determining “normal” behavior for that scene. If the camera sees something unusual — say, a person running down a street at 3:00 a.m. — it will flag the incident for attention.

Video analytics systems can analyze and search across real-time streams or recorded footage. They can also isolate individuals or objects as they traverse a smart camera network.

Chicago; New Orleans; Detroit; Springfield, Massachusetts; and Hartford, Connecticut, are some of the cities currently using BriefCam for policing.

To Search and Surveil

With city spaces blanketed in cameras, and video analytics to make sense of them, law enforcement agencies gain the capacity to record and analyze everything, all the time. This provides authorities the power to index and search a vast database of objects, behaviors, and anomalous activity.

In Connecticut, police have used video analytics to identify or monitor known or suspected drug dealers. Sergeant Johnmichael O’Hare, former Director of the Hartford Real-Time Crime Center, recently demonstrated how BriefCam helped Hartford police reveal “where people go the most” in the space of 24 hours by viewing footage condensed and summarized in just nine minutes. Using a feature called “pathways,” he discovered hundreds of people visiting just two houses on the street and secured a search warrant to verify that they were drug houses.

Video analytics startup Voxel51 is also adding more sophisticated searching to the mix. Co-founded by Jason Corso, a professor of electrical engineering and computer science at the University of Michigan, the company offers a platform for video processing and understanding.

Corso told me his company hopes to offer the first system where people can “search based on semantic content about their data, such as, ‘I want to find all the video clips that have more than 3-way intersections … with at least 20 vehicles during daylight.’” Voxel51 “tries to make that possible” by taking video footage and “turning it into structured searchable data across different types of platforms.”

Unlike BriefCam, which analyzes video using nothing but its own software, Voxel51 offers an open platform which allows third parties to add their own analytics models. If the platform succeeds, it will supercharge the ability to search and surveil public spaces.

Corso told me his company is working on a pilot project with the Baltimore police for their CitiWatch surveillance program and plans to trial the software with the Houston Police Department.

As cities start deploying a wide range of monitoring devices from the so-called internet of things, researchers are also developing a technique known as video analytics and sensor fusion, or VA/SF, for police intelligence. With VA/SF, multiple streams from sensors are combined with video analytics to reduce uncertainties and make inferences about complex situations. As one example, Peleg told me BriefCam is developing in-camera audio analytics that uses microphones to discern actions that may confuse AI systems, such as whether people are fighting or dancing.

VMSs also offer smart integration across technologies. Former New Haven Chief of Police Anthony Campbell told me how ShotSpotters, controversial devices that listen for gunshots, integrate with specialized software so when a gun is fired, nearby swivel cameras instantly alter their direction to the location of the weapons discharge.

Officers can also use software to lock building doors from a control center, and companies are developing analytics to alert security if one car is being followed by another.

Toward a “Minority Report” World

Video analytics captures a wide variety of data about the areas covered by smart camera networks. Not surprisingly, the information captured is now being proposed for predictive policing: the use of data to predict and police crime before it happens.

In 2002, the dystopian film “Minority Report” depicted a society using “pre-crime” analytics for police to intervene in lawbreaking before it occurs. In the end, the officers in charge tried to manipulate the system for their own interests.

A real-world version of “Minority Report” is emerging through real-time crime centers used to analyze crime patterns for police. In these centers, law enforcement agencies ingest information from sources like social media networks, data brokers, public databases, criminal records, and ShotSpotters. Weather data is even included for its impact on crime (because “bad guys don’t like to get wet”).

In a 2018 document, the data storage firm Western Digital and the consultancy Accenture predicted mass smart camera networks would be deployed “across three tiers of maturity.” This multi-stage adoption, they contended, would “allow society” to gradually abandon “concerns about privacy” and instead “accept and advocate” for mass police and government surveillance in the interest of “public safety.”

Tier 1 encompasses the present where police use CCTV networks to investigate crimes after-the-fact.

By 2025, society will reach Tier 2 as municipalities transform into “smart” cities, the document said. Businesses and public institutions, like schools and hospitals, will plug camera feeds into government and law enforcement agencies to inform centralized, AI-enabled analytics systems.

Tier 3, the most predictive-oriented surveillance system, will arrive by 2035. Some residents will voluntarily donate their camera feeds, while others will be “encouraged to do so by tax-break incentives or nominal compensation.” A “public safety ecosystem” will centralize data “pulled from disparate databases such as social media, driver’s licenses, police databases, and dark data.” An AI-enabled analytics unit will let police assess “anomalies in real time and interrupt a crime before it is committed.”

That is to say, to catch pre-crime.

Rise of the Video Surveillance Industrial Complex

While CCTV surveillance began as a simple tool for criminal justice, it has grown into a multibillion-dollar industry that covers multiple industry verticals. From policing and smart cities to schools, health care facilities, and retail, society is moving toward near-complete visual surveillance of commercial and urban spaces.

Denmark-based Milestone Systems, a top VMS provider with half its revenues in the U.S., had less than 10 employees in 1999. Today they are a major corporation that claims offices in over 20 countries.

Axis Communications used to be a network printer outfit. They have since become a leading camera provider pushing over $1 billion in sales per year.

BriefCam began as a university project. Now it is among the world’s top video analytics providers, with clients, it says, spanning over 40 countries.

Over the past six years, Canon purchased all three, giving the imaging conglomerate ownership of industry giants in video management software, CCTV cameras, and video analytics. Motorola recently acquired a top VMS provider, Avigilon, for $1 billion. In turn, Avigilon and other large firms have purchased their own companies.

The public is paying for their own high-tech surveillance three times over.

Familiar big tech giants are also in on the action. Lieutenant Patrick O’Donnell of the Chicago police force told me his department is working on a non-disclosure agreement with Google for a video analytics pilot project to detect people reacting to gunfire, and if they are in the prone position, so the police can receive real-time alerts. (Google did not respond to a request for comment.)

Video monitoring networks inevitably entangle and implicate a whole ecosystem of vendors, some of whom have offered, or may yet offer, services specifically targeted at such systems. Microsoft, Amazon, IBM, Comcast, Verizon, and Cisco are among those enabling the networks with technologies like cloud services, broadband connectivity, or video surveillance software.

In the public sector, the National Institute of Standards and Technology is funding “public analytics” and communications networks like the First Responder Network Authority, or FirstNet, for real-time video and other surveillance technologies. FirstNet will cost $46.5 billion, and is being built by AT&T.

Voxel51 is another NIST-backed venture. The public is thus paying for their own high-tech surveillance three times over: first, through taxes for university research; second, through grant money for the formation of a for-profit startup (Voxel51); and third, through the purchase of Voxel51’s services by city police departments using public funds.

With the private and public sector looking to expand the presence of cameras, video surveillance has become a new cash cow. As Corso put it, “there will be something like 45 billion cameras in the world within a few decades. That’s a lot of (video) pixels. For the most part, most of those pixels go unused.” Corso’s estimate mirrors a 2017 forecast from New York venture capital firm LDV, which believes smartphones will evolve to have even more cameras than they do today, contributing to the growth.

Companies that began with markets for police and security are now diversifying their offerings to the commercial sector. BriefCam, Milestone, and Axis advertise the use of video analytics for retailers, where they can monitor foot traffic, queue length, shopping patterns, floor layouts, and conduct A/B testing. Voxel51 has an option built for the fashion industry and plans to expand across industry verticals. Motionloft offers analytics for smart cities, retailers, commercial real estate, and entertainment venues. Other examples abound.

Public and private sector actors are pressing for a world full of smart video surveillance. Peleg, for example, told me of a use case for smart cities: If you drive into the city, you could “just park and go home” without using a parking meter. The city would send a bill to your house at the end of the month. “Of course, you lose your privacy,” he added. “The question is, do you really care about Big Brother knows where you are, what you do, etc.? Some people may not like it.”

How to Rein in Smart Surveillance

Those who do not like new forms of Big Brother surveillance are presently fixated on facial recognition. Yet they have largely ignored the shift to smart camera networks — and the industrial complex driving it.

Thousands of cameras are now set to scrutinize our every move, informing city authorities whether we are walking, running, riding a bike, or doing anything “suspicious.” With video analytics, artificial intelligence is used to identify our  sex, age, and type of clothes, and could potentially be used to categorize us by race or religious attire.

Such surveillance could have a severe chilling effect on our freedom of expression and association. Is this the world we want to live in?

The capacity to track individuals across smart CCTV networks can be used to target marginalized communities. The detection of “loitering” or “shoplifting” by cameras concentrated in poor neighborhoods may deepen racial bias in policing practices.

This kind of racial discrimination is already happening in South Africa, where “unusual behavior detection” has been deployed by smart camera networks for several years.

In the United States, smart camera networks are just emerging, and there is little information or transparency about their use. Nevertheless, we know surveillance has been used throughout history to target oppressed groups. In recent years, the New York Police Department secretly spied on Muslims, the FBI used surveillance aircraft to monitor Black Lives Matter protesters, and the U.S. Customs and Border Protection began building a high-tech video surveillance “smart border” across the Tohono O’odham reservation in Arizona.

Law enforcement agencies claim smart camera networks will reduce crime, but at what cost? If a camera could be put in every room in every house, domestic violence might go down. We could add automated “filters” that only record when a loud noise is detected, or when someone grabs a knife. Should police put smart cameras inside every living room?

The commercial sector is likewise rationalizing the advance of surveillance capitalism into the physical domain. Retailers, employers, and investors want to put us all under smart video surveillance so they can manage us with visual “intelligence.”

When asked about privacy, several major police departments told me they have the right to see and record everything you do as soon as you leave your home. Retailers, in turn, won’t even approach public disclosure: They are keeping their video analytics practices secret.

In the United States, there is generally no “reasonable expectation” of privacy in public. The Fourth Amendment encompasses the home and a few public areas we “reasonably” expect to be private, such as a phone booth. Almost everything else — our streets, our stores, our schools — is fair game.

Even if rules are updated to restrict the use of video surveillance, we cannot guarantee those rules will remain in place. With thousands of high-res cameras networked together, a dystopian surveillance state is a mouse click away. By installing cameras everywhere, we are opening a Pandora’s box.

To address the privacy threats of smart camera networks, legislators should ban plug-in surveillance networks and restrict the scope of networked CCTVs beyond the premise of a single site. They should also limit the density of camera and sensor coverage in public. These measures would block the capacity to track people across wide areas and prevent the phenomenon of constantly being watched.

The government should also ban video surveillance analytics in publicly accessible spaces, perhaps with exceptions for rare cases such as the detection of bodies on train tracks. Such a ban would disincentivize mass camera deployments because video analytics is needed to analyze large volumes of footage. Courts should urgently reconsider the scope of the Fourth Amendment and expand our right to privacy in public.

Police departments, vendors, and researchers need to disclose and publicize their projects, and engage with academics, journalists, and civil society.

It is clear we have a crisis in the works. We need to move beyond the limited conversation of facial recognition and address the broader world of video surveillance, before it is too late.

The post The Rise of Smart Camera Networks, and Why We Should Ban Them appeared first on The Intercept.

Many spectators are puzzled by Ito’s influential role as an ethicist of artificial intelligence. Indeed, his initiatives were crucial in establishing the discourse of “ethical AI” that is now ubiquitous in academia and in the mainstream press. In 2016, then-President Barack Obama described him as an “expert” on AI and ethics. Since 2017, Ito financed many projects through the $27 million Ethics and Governance of AI Fund, an initiative anchored by the MIT Media Lab and the Berkman Klein Center for Internet and Society at Harvard University. What was all the talk of “ethics” really about?

For 14 months, I worked as a graduate student researcher in Ito’s group on AI ethics at the Media Lab. I stopped on August 15, immediately after Ito published his initial “apology” regarding his ties to Epstein, in which he acknowledged accepting money from the financier both for the Media Lab and for Ito’s outside venture funds. Ito did not disclose that Epstein had, at the time this money changed hands, already pleaded guilty to a child prostitution charge in Florida, or that Ito took numerous steps to hide Epstein’s name from official records, as The New Yorker later revealed.

The discourse of “ethical AI” was aligned strategically with a Silicon Valley effort seeking to avoid legally enforceable restrictions of controversial technologies.

Inspired by whistleblower Signe Swenson and others who have spoken out, I have decided to report what I came to learn regarding Ito’s role in shaping the field of AI ethics, since this is a matter of public concern. The emergence of this field is a recent phenomenon, as past AI researchers had been largely uninterested in the study of ethics. A former Media Lab colleague recalls that Marvin Minsky, the deceased AI pioneer at MIT, used to say that “an ethicist is someone who has a problem with whatever you have in your mind.” (In recently unsealed court filings, victim Virginia Roberts Giuffre testified that Epstein directed her to have sex with Minsky.) Why, then, did AI researchers suddenly start talking about ethics?

At the Media Lab, I learned that the discourse of “ethical AI,” championed substantially by Ito, was aligned strategically with a Silicon Valley effort seeking to avoid legally enforceable restrictions of controversial technologies. A key group behind this effort, with the lab as a member, made policy recommendations in California that contradicted the conclusions of research I conducted with several lab colleagues, research that led us to oppose the use of computer algorithms in deciding whether to jail people pending trial. Ito himself would eventually complain, in private meetings with financial and tech executives, that the group’s recommendations amounted to “whitewashing” a thorny ethical issue. “They water down stuff we try to say to prevent the use of algorithms that don’t seem to work well” in detention decisions, he confided to one billionaire.

I also watched MIT help the U.S. military brush aside the moral complexities of drone warfare, hosting a superficial talk on AI and ethics by Henry Kissinger, the former secretary of state and notorious war criminal, and giving input on the U.S. Department of Defense’s “AI Ethics Principles” for warfare, which embraced “permissibly biased” algorithms and which avoided using the word “fairness” because the Pentagon believes “that fights should not be fair.”

Ito did not respond to requests for comment.

Meanwhile, corporations have tried to shift the discussion to focus on voluntary “ethical principles,” “responsible practices,” and technical adjustments or “safeguards” framed in terms of “bias” and “fairness” (e.g., requiring or encouraging police to adopt “unbiased” or “fair” facial recognition). In January 2018, Microsoft published its “ethical principles” for AI, starting with “fairness.” In May, Facebook announced its “commitment to the ethical development and deployment of AI” and a tool to “search for bias” called “Fairness Flow.” In June, Google published its “responsible practices” for AI research and development. In September, IBM announced a tool called “AI Fairness 360,” designed to “check for unwanted bias in datasets and machine learning models.” In January 2019, Facebook granted $7.5 million for the creation of an AI ethics center in Munich, Germany. In March, Amazon co-sponsored a $20 million program on “fairness in AI” with the U.S. National Science Foundation. In April, Google canceled its AI ethics council after backlash over the selection of Kay Coles James, the vocally anti-trans president of the right-wing Heritage Foundation. These corporate initiatives frequently cited academic research that Ito had supported, at least partially, through the MIT-Harvard fund.

To characterize the corporate agenda, it is helpful to distinguish between three kinds of regulatory possibilities for a given technology: (1) no legal regulation at all, leaving “ethical principles” and “responsible practices” as merely voluntary; (2) moderate legal regulation encouraging or requiring technical adjustments that do not conflict significantly with profits; or (3) restrictive legal regulation curbing or banning deployment of the technology. Unsurprisingly, the tech industry tends to support the first two and oppose the last. The corporate-sponsored discourse of “ethical AI” enables precisely this position. Consider the case of facial recognition. This year, the municipal legislatures of San Francisco, Oakland, and Berkeley — all in California — plus Somerville, Massachusetts, have passed strict bans on facial recognition technology. Meanwhile, Microsoft has lobbied in favor of less restrictive legislation, requiring technical adjustments such as tests for “bias,” most notably in Washington state. Some big firms may even prefer this kind of mild legal regulation over a complete lack thereof, since larger firms can more easily invest in specialized teams to develop systems that comply with regulatory requirements.

Thus, Silicon Valley’s vigorous promotion of “ethical AI” has constituted a strategic lobbying effort, one that has enrolled academia to legitimize itself. Ito played a key role in this corporate-academic fraternizing, meeting regularly with tech executives. The MIT-Harvard fund’s initial director was the former “global public policy lead” for AI at Google. Through the fund, Ito and his associates sponsored many projects, including the creation of a prominent conference on “Fairness, Accountability, and Transparency” in computer science; other sponsors of the conference included Google, Facebook, and Microsoft.

Although the Silicon Valley lobbying effort has consolidated academic interest in “ethical AI” and “fair algorithms” since 2016, a handful of papers on these topics had appeared in earlier years, even if framed differently. For example, Microsoft computer scientists published the paper that arguably inaugurated the field of “algorithmic fairness” in 2012. In 2016, the paper’s lead author, Cynthia Dwork, became a professor of computer science at Harvard, with simultaneous positions at its law school and at Microsoft. When I took her Harvard course on the mathematical foundations of cryptography and statistics in 2017, I interviewed her and asked how she became interested in researching algorithmic definitions of fairness. In her account, she had long been personally concerned with the issue of discriminatory advertising, but Microsoft managers encouraged her to pursue this line of work because the firm was developing a new system of online advertising, and it would be economically advantageous to provide a service “free of regulatory problems.” (To be fair, I believe that Dwork’s personal intentions were honest despite the corporate capture of her ideas. Microsoft declined to comment for this article.)

After the initial steps by MIT and Harvard, many other universities and new institutes received money from the tech industry to work on AI ethics. Most such organizations are also headed by current or former executives of tech firms. For example, the Data & Society Research Institute is directed by a Microsoft researcher and initially funded by a Microsoft grant; New York University’s AI Now Institute was co-founded by another Microsoft researcher and partially funded by Microsoft, Google, and DeepMind; the Stanford Institute for Human-Centered AI is co-directed by a former vice president of Google; University of California, Berkeley’s Division of Data Sciences is headed by a Microsoft veteran; and the MIT Schwarzman College of Computing is headed by a board member of Amazon. During my time at the Media Lab, Ito maintained frequent contact with the executives and planners of all these organizations.

But even if the Partnership’s activities may not meet the legal threshold requiring registration as lobbyists — for example, by seeking to directly affect the votes of individual elected officials — the partnership has certainly sought to influence legislation. For example, in November 2018, the Partnership staff asked academic members to contribute to a collective statement to the Judicial Council of California regarding a Senate bill on penal reform (S.B. 10). The bill, in the course of eliminating cash bail, expanded the use of algorithmic risk assessment in pretrial decision making, and required the Judicial Council to “address the identification and mitigation of any implicit bias in assessment instruments.” The Partnership staff wrote, “we believe there is room to impact this legislation (and CJS [criminal justice system] applications more broadly).”

In December 2018, three Media Lab colleagues and I raised serious objections to the Partnership’s efforts to influence legislation. We observed that the Partnership’s policy recommendations aligned consistently with the corporate agenda. In the penal case, our research led us to strongly oppose the adoption of risk assessment tools, and to reject the proposed technical adjustments that would supposedly render them “unbiased” or “fair.” But the Partnership’s draft statement seemed, as a colleague put it in an internal email to Ito and others, to “validate the use of RA [risk assessment] by emphasizing the issue as a technical one that can therefore be solved with better data sets, etc.” A second colleague agreed that the “PAI statement is weak and risks doing exactly what we’ve been warning against re: the risk of legitimation via these industry led regulatory efforts.” A third colleague wrote, “So far as the criminal justice work is concerned, what PAI is doing in this realm is quite alarming and also in my opinion seriously misguided. I agree with Rodrigo that PAI’s association with ACLU, MIT and other academic / non-profit institutions practically ends up serving a legitimating function. Neither ACLU nor MIT nor any non-profit has any power in PAI.”

Worse, there seemed to be a mismatch between the Partnership’s recommendations and the efforts of a grassroots coalition of organizations fighting jail expansion, including the movement Black Lives Matter, the prison abolitionist group Critical Resistance (where I have volunteered), and the undocumented and queer/trans youth-led Immigrant Youth Coalition. The grassroots coalition argued, “The notion that any risk assessment instrument can account for bias ignores the racial disparities in current and past policing practices.” There are abundant theoretical and empirical reasons to support this claim, since risk assessments are typically based on data of arrests, convictions, or incarcerations, all of which are poor proxies for individual behaviors or predispositions. The coalition continued, “Ultimately, risk-assessment tools create a feedback-loop of racial profiling, pre-trial detention and conviction. A person’s freedom should not be reduced to an algorithm.” By contrast, the Partnership’s statement focused on “minimum requirements for responsible deployment,” spanning such topics as “validity and data sampling bias, bias in statistical predictions; choice of the appropriate targets for prediction; human-computer interaction questions; user training; policy and governance; transparency and review; reproducibility, process, and recordkeeping; and post-deployment evaluation.”

To be sure, the Partnership staff did respond to criticism of the draft by noting in the final version of the statement that “within PAI’s membership and the wider AI community, many experts further suggest that individuals can never justly be detained on the basis of their risk assessment score alone, without an individualized hearing.” This meek concession — admitting that it might not be time to start imprisoning people based strictly on software, without input from a judge or any other “individualized” judicial process — was easier to make because none of the major firms in the Partnership sell risk assessment tools for pretrial decision-making; not only is the technology too controversial but also the market is too small. (Facial recognition technology, on the other hand, has a much larger market in which Microsoft, Google, Facebook, IBM, and Amazon all operate.)

In December 2018, my colleagues and I urged Ito to quit the Partnership. I argued, “If academic and nonprofit organizations want to make a difference, the only viable strategy is to quit PAI, make a public statement, and form a counter alliance.” Then a colleague proposed, “there are many other organizations which are doing much more substantial and transformative work in this area of predictive analytics in criminal justice — what would it look like to take the money we currently allocate in supporting PAI in order to support their work?” We believed Ito had enough autonomy to do so because the MIT-Harvard fund was supported largely by the Knight Foundation, even though most of the money came from tech investors Pierre Omidyar, founder of eBay, via the Omidyar Network, and Reid Hoffman, co-founder of LinkedIn and Microsoft board member. I wrote, “If tens of millions of dollars from nonprofit foundations and individual donors are not enough to allow us to take a bold position and join the right side, I don’t know what would be.” (Omidyar funds The Intercept.)

It is strange that Ito, with no formal training, became positioned as an “expert” on AI ethics, a field that barely existed before 2017.

Ito did acknowledge the problem. He had just received a message from David M. Siegel, co-chair of the hedge fund Two Sigma and member of the MIT Corporation. Siegel proposed a self-regulatory structure for “search and social media” firms in Silicon Valley, modeled after the Financial Industry Regulatory Authority, or FINRA, a private corporation that serves as a self-regulatory organization for securities firms on Wall Street. Ito responded to Siegel’s proposal, “I don’t feel civil society is well represented in the industry groups. We’ve been participating in Partnership in AI and they water down stuff we try to say to prevent the use of algorithms that don’t seem to work well like risk scores for pre-trial bail. I think that with personal data and social media, I have concerns with self-regulation. For example, a full blown genocide [of the Rohingya, a mostly Muslim minority group in Myanmar] happened using What’s App and Facebook knew it was happening.” (Facebook has admitted that its platform was used to incite violence in Myanmar; news reports have documented how content on the Facebook platform facilitated a genocide in the country despite repeated warnings to Facebook executives from human rights activists and researchers. Facebook texting service WhatsApp made it harder for its users to forward messages after WhatsApp was reportedly used to spread misinformation during elections in India.)

But the corporate-academic alliances were too robust and convenient. The Media Lab remained in the Partnership, and Ito continued to fraternize with Silicon Valley and Wall Street executives and investors. Ito described Siegel, a billionaire, as a “potential funder.” With such people, I saw Ito routinely express moral concerns about their businesses — but in a friendly manner, as he was simultaneously asking them for money, whether for MIT or his own venture capital funds. For corporate-academic “ethicists,” amicable criticism can serve as leverage for entering into business relationships. Siegel replied to Ito, “I would be pleased to speak more on this topic with you. Finra is not an industry group. It’s just paid for by industry. I will explain more when we meet. I agree with your concerns.”

In private meetings, Ito and tech executives discussed the corporate lobby quite frankly. In January, my colleagues and I joined a meeting with Mustafa Suleyman, founding co-chair of the Partnership and co-founder of DeepMind, an AI startup acquired by Google for about $500 million in 2014. In the meeting, Ito and Suleyman discussed how the promotion of “AI ethics” had become a “whitewashing” effort, although they claimed their initial intentions had been nobler. In a message to plan the meeting, Ito wrote to my colleagues and me, “I do know, however, from speaking to Mustafa when he was setting up PAI that he was meaning for the group to be much more substantive and not just ‘white washing.’ I think it’s just taking the trajectory that these things take.” (Suleyman did not respond to requests for comment.)

Regardless of individual actors’ intentions, the corporate lobby’s effort to shape academic research was extremely successful. There is now an enormous amount of work under the rubric of “AI ethics.” To be fair, some of the research is useful and nuanced, especially in the humanities and social sciences. But the majority of well-funded work on “ethical AI” is aligned with the tech lobby’s agenda: to voluntarily or moderately adjust, rather than legally restrict, the deployment of controversial technologies. How did five corporations, using only a small fraction of their budgets, manage to influence and frame so much academic activity, in so many disciplines, so quickly? It is strange that Ito, with no formal training, became positioned as an “expert” on AI ethics, a field that barely existed before 2017. But it is even stranger that two years later, respected scholars in established disciplines have to demonstrate their relevance to a field conjured by a corporate lobby.

The majority of well-funded work on “ethical AI” is aligned with the tech lobby’s agenda: to voluntarily or moderately adjust, rather than legally restrict, the deployment of controversial technologies.

The recommendations seek to compel the Pentagon to increase military investments in AI and to adopt “ethical AI” systems such as those developed and sold by Silicon Valley firms. The innovation board calls the Pentagon a “deeply ethical organization” and offers to extend its “existing ethics framework” to AI. To this end, the board cites the AI ethics research groups at Google, Microsoft, and IBM, as well as academics sponsored by the MIT-Harvard fund. However, there are caveats. For example, the board notes that although “the term ‘fairness’ is often cited in the AI community,” the recommendations avoid this term because of “the DoD mantra that fights should not be fair, as DoD aims to create the conditions to maintain an unfair advantage over any potential adversaries.” Thus, “some applications will be permissibly and justifiably biased,” specifically “to target certain adversarial combatants more successfully.” The Pentagon’s conception of AI ethics forecloses many important possibilities for moral deliberation, such as the prohibition of drones for targeted killing.

The corporate, academic, and military proponents of “ethical AI” have collaborated closely for mutual benefit. For example, Ito told me that he informally advised Schmidt on which academic AI ethicists Schmidt’s private foundation should fund. Once, Ito even asked me for second-order advice on whether Schmidt should fund a certain professor who, like Ito, later served as an “expert consultant” to the Pentagon’s innovation board. In February, Ito joined Carter at a panel titled “Computing for the People: Ethics and AI,” which also included current and former executives of Microsoft and Google. The panel was part of the inaugural celebration of MIT’s $1 billion college dedicated to AI. Other speakers at the celebration included Schmidt on “Computing for the Marketplace,” Siegel on “How I Learned to Stop Worrying and Love Algorithms,” and Henry Kissinger on “How the Enlightenment Ends.” As Kissinger declared the possibility of “a world relying on machines powered by data and algorithms and ungoverned by ethical or philosophical norms,” a protest outside the MIT auditorium called attention to Kissinger’s war crimes in Vietnam, Cambodia, and Laos, as well as his support of war crimes elsewhere. In the age of automated targeting, what atrocities will the U.S. military justify as governed by “ethical” norms or as executed by machines beyond the scope of human agency and culpability?

No defensible claim to “ethics” can sidestep the urgency of legally enforceable restrictions to the deployment of technologies of mass surveillance and systemic violence. Until such restrictions exist, moral and political deliberation about computing will remain subsidiary to the profit-making imperative expressed by the Media Lab’s motto, “Deploy or Die.” While some deploy, even if ostensibly “ethically,” others die.

The post How Big Tech Manipulates Academia to Avoid Regulation appeared first on The Intercept.

Now, in his new memoir “Permanent Record,” Snowden explains how his revolutionary act of whistleblowing came to occur. At its root was a decision dating to Snowden’s earliest contact with the NSA — “the first thing that you might call a principle that occurred to me during this idle but formative time,” as the future government systems engineer puts it in the excerpt below: The determination to live in an honest world, a world where people could show their true faces and own their full history, a world without shame. This was the ideal that guided Snowden into the NSA. And of course it would be the ideal that guided him out, as well.

After my injured legs forced me out of the Army, I still had the urge to serve my country. I would have to serve it through my head and hands — through computing. That, and only that, would be giving my country my best. Though I wasn’t much of a veteran, having passed through the military’s vetting could only help my chances of working at an intelligence agency, which was where my talents would be most in demand and, perhaps, most challenged.

That meant that I needed a security clearance. There are, generally speaking, three levels of security clearance in the American Intelligence Community, or IC: from low to high, confidential, secret, and top secret. The last of these can be further extended with a Sensitive Compartmented Information qualifier, creating the coveted TS/SCI access required by positions with the top-tier agencies — CIA and NSA. The TS/SCI was by far the hardest access to get, but also opened the most doors, and so I went back to Anne Arundel Community College while I searched for jobs that would sponsor my application for the grueling background investigation the clearance required. The approval process for a TS/SCI can take a year or more. All it involves is filling out some paperwork, then sitting around with your feet up and trying not to commit too many crimes while the federal government renders its verdict. The rest, after all, is out of your hands.

On paper, I was a perfect candidate. I was a kid from a service family, nearly every adult member of which had some level of clearance; I’d tried to enlist and fight for my country until an unfortunate accident had laid me low. I had no criminal record, no drug habit. My only financial debt was the student loan for my Microsoft certification, and I hadn’t yet missed a payment.

None of this stopped me, of course, from being nervous.

I drove to and from classes at community college as the National Background Investigations Bureau rummaged through nearly every aspect of my life and interviewed almost everyone I knew: my parents, my extended family, my classmates and friends. They went through my spotty school transcripts and, I’m sure, spoke to a few of my teachers. I got the impression that they even spoke to a guy I’d worked with one summer at a snow cone stand at Six Flags America. The goal of all this background checking was not only to find out what I’d done wrong, but also to find out how I might be compromised or blackmailed. The most important thing to the IC is not that you’re 100 percent perfectly clean, because if that were the case, they wouldn’t hire anybody. Instead, it’s that you’re robotically honest — that there’s no dirty secret out there that you’re hiding that could be used against you, and thus against the agency, by an enemy power.

I didn’t want to live in a world where everyone had to pretend that they were perfect, because that was a world that had no place for me or my friends.

This, of course, set me thinking — sitting stuck in traffic as all the moments of my life that I regretted went spinning around in a loop inside my head. Nothing I could come up with would have raised even an iota of eyebrow from investigators who are used to finding out that the middle-aged analyst at a think tank likes to wear diapers and get spanked by grandmothers in leather. Still, there was a paranoia that the process created, because you don’t have to be a closet fetishist to have done things that embarrass you and to fear that strangers might misunderstand you if those things were exposed. I mean, I grew up on the Internet, for Christ’s sake. If you haven’t entered something shameful or gross into that search box, then you haven’t been online very long — though I wasn’t worried about the pornography. Everybody looks at porn, and for those of you who are shaking your heads, don’t worry: Your secret is safe with me. My worries were more personal, or felt more personal: the endless conveyor belt of stupid jingoistic things I’d said, and the even stupider misanthropic opinions I’d abandoned, in the process of growing up online. Specifically, I was worried about my chat logs and forum posts, all the supremely moronic commentary that I’d sprayed across a score of gaming and hacker sites. Writing pseudonymously had meant writing freely, but often thoughtlessly. And since a major aspect of early Internet culture was competing with others to say the most inflammatory thing, I’d never hesitate to advocate, say, bombing a country that taxed video games, or corralling people who didn’t like anime into reeducation camps. Nobody on those sites took any of it seriously, least of all myself.

When I went back and reread the posts, I cringed. Half the things I’d said I hadn’t even meant at the time — I’d just wanted attention — but I didn’t fancy my odds of explaining that to a gray-haired man in horn-rimmed glasses peering over a giant folder labeled PERMANENT RECORD. The other half, the things I think I had meant at the time, were even worse, because I wasn’t that kid anymore. I’d grown up. It wasn’t simply that I didn’t recognize the voice as my own — it was that I now actively opposed its overheated, hormonal opinions. I found that I wanted to argue with a ghost. I wanted to fight with that dumb, puerile, and casually cruel self of mine who no longer existed. I couldn’t stand the idea of being haunted by him forever, but I didn’t know the best way how to express my remorse and put some distance between him and me, or whether I should even try to do that. It was heinous, to be so inextricably, technologically bound to a past that I fully regretted but barely remembered.

This might be the most familiar problem of my generation, the first to grow up online. We were able to discover and explore our identities almost totally unsupervised, with hardly a thought spared for the fact that our rash remarks and profane banter were being preserved for perpetuity, and that one day we might be expected to account for them. I’m sure everyone who had an Internet connection before they had a job can sympathize with this — surely everyone has that one post that embarrasses them, or that text or email that could get them fired.

My situation was somewhat different, however, in that most of the message boards of my day would let you delete your old posts. I could put together one tiny little script — not even a real program — and all of my posts would be gone in under an hour. It would’ve been the easiest thing in the world to do. Trust me, I considered it.

But ultimately, I couldn’t. Something kept preventing me. It just felt wrong. To blank my posts from the face of the earth wasn’t illegal, and it wouldn’t even have made me ineligible for a security clearance had anyone found out. But the prospect of doing so bothered me nonetheless. It would’ve only served to reinforce some of the most corrosive precepts of online life: that nobody is ever allowed to make a mistake, and anybody who does make a mistake must answer for it forever. What mattered to me wasn’t so much the integrity of the written record but that of my soul. I didn’t want to live in a world where everyone had to pretend that they were perfect, because that was a world that had no place for me or my friends. To erase those comments would have been to erase who I was, where I was from, and how far I’d come. To deny my younger self would have been to deny my present self’s validity.

I decided to leave the comments up and figure out how to live with them. I even decided that true fidelity to this stance would require me to continue posting. In time, I’d outgrow these new opinions, too, but my initial impulse remains unshakable, if only because it was an important step in my own maturity. We can’t erase the things that shame us, or the ways we’ve shamed ourselves, online. All we can do is control our reactions — whether we let the past oppress us, or accept its lessons, grow, and move on.

This was the first thing that you might call a principle that occurred to me during this idle but formative time, and though it would prove difficult, I’ve tried to live by it.

We can’t erase the things that shame us, or the way we’ve shamed ourselves, online. All we can do is control our reactions.

Believe it or not, the only online traces of my existence whose past iterations have never given me worse than a mild sense of embarrassment were my dating profiles. I suspect this is because I’d had to write them with the expectation that their words truly mattered — since the entire purpose of the enterprise was for somebody in Real Life to actually care about them, and, by extension, about me.

I’d joined a website called HotOrNot.com, which was the most popular of the rating sites of the early 2000s, like RateMyFace and AmIHot. (Their most effective features were combined by a young Mark Zuckerberg into a site called FaceMash, which later became Facebook.) HotOrNot was the most popular of these pre-Facebook rating sites for a simple reason: It was the best of the few that had a dating component.

Basically, how it worked was that users voted on each other’s photos: Hot or Not. An extra function for registered users such as myself was the ability to contact other registered users, if each had rated the other’s photos Hot and clicked “Meet Me.” This banal and crass process is how I met Lindsay Mills, my partner and the love of my life.

Looking at the photos now, I’m amused to find that 19-year-old Lindsay was gawky, awkward, and endearingly shy. To me at the time, though, she was a smoldering blonde, absolutely volcanic. What’s more, the photos themselves were beautiful: They had a serious artistic quality, self-portraits more than selfies. They caught the eye and held it. They played coyly with light and shade. They even had a hint of meta fun: there was one taken inside the photo lab where she worked, and another where she wasn’t even facing the camera.

I rated her Hot, a perfect 10. To my surprise, we matched (she rated me an eight, the angel), and in no time we were chatting. Lindsay was studying fine art photography. She had her own website, where she kept a journal and posted more shots: forests, flowers, abandoned factories, and — my favorite — more of her.

I scoured the Web and used each new fact I found about her to create a fuller picture: the town she was born in (Laurel, Maryland), her school’s name (MICA, the Maryland Institute College of Art). Eventually, I admitted to cyberstalking her. I felt like a creep, but Lindsay cut me off. “I’ve been searching about you, too, mister,” she said, and rattled off a list of facts about me. She’d checked my email address against dozens of sites, figuring out which ones I’d registered on.

I felt like a creep, but Lindsay cut me off. “I’ve been searching about you, too, mister.”

These were among the sweetest words I’d ever heard, yet I was reluctant to see her in person. We scheduled a date, and as the days ticked down my nervousness grew. It’s a scary proposition, to take an online relationship offline. It would be scary even in a world without ax murderers and scammers. In my experience, the more you’ve communicated with someone online, the more disappointed you’ll be by meeting them in person. Things that are the easiest to say on-screen become the most difficult to say face-to-face. Distance favors intimacy: No one talks more openly than when they’re alone in a room, chatting with an unseen someone alone in a different room. Meet that person, however, and you lose your latitude. Your talk becomes safer and tamer, a common conversation on neutral ground.

Online, Lindsay and I had become total confidants, and I was afraid of losing our connection in person. In other words, I was afraid of being rejected.

I shouldn’t have been.

Lindsay — who’d insisted on driving — told me that she’d pick me up at my mother’s condo. The appointed hour found me standing outside in the twilight cold, guiding her by phone through the similarly named, identical-looking streets of my mother’s development. I was keeping an eye out for a gold ’98 Chevy Cavalier, when suddenly I was blinded, struck in the face by a beam of light from the curb. Lindsay was flashing her brights at me across the snow.

“Buckle up.” Those were the first words that Lindsay said to me in person, as I got into her car. Then she said, “What’s the plan?”

It’s then that I realized that despite all the thinking I had been doing about her, I’d done no thinking whatsoever about our destination.

If I’d been in this situation with any other woman, I’d have improvised, covering for myself. But with Lindsay, it was different. With Lindsay, it didn’t matter. She drove us down her favorite road — she had a favorite road — and we talked until we ran out of miles on Guilford and ended up in the parking lot of the Laurel Mall. We just sat in her car and talked.

It was perfection. Talking face-to-face turned out to be just an extension of all our phone calls, emails, and chats. Our first date was a continuation of our first contact online and the start of a conversation that will last as long as we will. We talked about our families, or what was left of them. Lindsay’s parents were also divorced: Her mother and father lived 20 minutes apart, and as a kid Lindsay had been shuttled back and forth between them. She’d lived out of a bag. Mondays, Wednesdays, and Fridays she slept in her room at her mother’s house. Tuesdays, Thursdays, and Saturdays she slept in her room at her father’s house. Sundays were the dramatic day, because she had to choose.

She told me how bad my taste was and criticized my date apparel: a button-down shirt decorated with metallic flames over a wifebeater and jeans (I’m sorry). She told me about the two other guys she was dating, whom she’d already mentioned online, and Machiavelli would’ve blushed at the ways in which I set about undermining them (I’m not sorry). I told her everything, too, including the fact that I wouldn’t be able to talk to her about my work — the work I hadn’t even started. This was ludicrously pretentious, which she made obvious to me by nodding gravely.

I told her I was worried about the upcoming polygraph required for my clearance, and she offered to practice with me — a goofy kind of foreplay. The philosophy she lived by was the perfect training: Say what you want, say who you are, never be ashamed. If they reject you, it’s their problem. I’d never been so comfortable around someone, and I’d never been so willing to be called out for my faults. I even let her take my photo.

I told her I was worried about the upcoming polygraph. The philosophy she lived by was the perfect training: say what you want, say who you are, never be ashamed.

I had her voice in my head on my drive to the NSA’s oddly named Friendship Annex complex for the final interview for my security clearance. I found myself in a windowless room, bound like a hostage to a cheap office chair. Around my chest and stomach were pneumographic tubes that measured my breathing. Finger cuffs on my fingertips measured my electrodermal activity, a blood pressure cuff around my arm measured my heart rate, and a sensor pad on the chair detected my every fidget and shift. All of these devices — wrapped, clamped, cuffed, and belted tightly around me — were connected to the large black polygraph machine placed on the table in front of me.

I’d passed with flying colors.

As required, I had to answer the series of questions three times in total, and all three times I passed, which meant that not only had I qualified for the TS/SCI, I’d also cleared the “full scope polygraph” — the highest clearance in the land.

I had a girlfriend I loved, and I was on top of the world.

I was 22 years old.

Excerpted from “Permanent Record” by Edward Snowden, published by Metropolitan Books, an imprint of Henry Holt and Company. Copyright ©2019 by Edward Snowden. All rights reserved.

The post “Never Be Ashamed”: Why I Decided Not to Delete My Old Internet Posts appeared first on The Intercept.

The U.K. government also exposed a small quantity of code for running a government website, as well as a limited number of emails. All told, between the two governments, a total of 50 Trello pages, known on the site as “boards,” were published on the open web and indexed by Google.

The computer researcher who found the sensitive material, Kushagra Pathak, had disclosed just this past April a wide swath of additional private data exposed to the public on Trello, which is widely used by software developers, among others. That earlier disclosure revealed how, on dozens of public Trello boards run by various organizations and individuals, the information available included email and social media credentials, as well as specific information on unfixed bugs and security vulnerabilities. Pathak even found an NGO sharing login details to a donor management software database, which in turn contained, he said, personally identifiable information and financial records on donors. In both the April and new security research, the sensitive data on Trello was tracked down starting with a simple Google query.

The data exposures underscore how easy it has become to improperly leak sensitive data in the era of cloud computing. More broadly, they show how the use and development of software has become a complex endeavor, involving a wide range of independent online systems, and how this complexity itself represents a security risk, encouraging users and developers to take shortcuts intended to cut through the morass. Tools like Trello can help master the tangle of development in a safe and constructive way, but can also be misused.

He hopes to draw attention to what he believes is a major issue: the proliferation of sensitive information on public Trello boards. It is incredibly easy to search for such boards on Google.

In his new research, Pathak first discovered 25 public Trello boards belonging to different U.K. government departments. These included login credentials to a U.K. government account on a domain registrar, emails that had been pasted onto the boards, a link to a snippet of backend code of a government site, and information on bugs, albeit not bugs disclosing security issues. Also included were boards with conference call details and access codes, login information for a server administration tool known as CPanel, a discussion of how to prevent personal information from being exposed to Google’s web analytics platform, and details about an earlier incident in which such information was exposed to the platform. Pathak reported this through the U.K. National Cyber Security Centre, which identified the boards and removed most of them within two or three days.

Shortly thereafter, Pathak found 25 Canadian government boards that had even more sensitive information, such as remote file access, or FTP, credentials, and login details for the Eventbrite event-planning platform. Other boards included a link to an Excel file about managing control of web applications, discussion of additional security testing in the aftermath of a recent security incident, links to a Google folder with research documents, a security working group’s board with tasks related to audits and security testing, and a bug discussion. Pathak reported these to the Canadian Cyber Incident Response Centre, which also took prompt action to remove the boards, most of which were down within a week.

Pathak began researching computer science and hacking when he was young, eventually teaching himself to program. He hopes to draw attention to what he believes is a major issue: the proliferation of sensitive information on public Trello boards. It is incredibly easy to search such boards on Google; one could recently find and search within them, for example, using the search modifier like “inurl:https://trello.com/b/,” which restricts Google to finding only results whose address begins with that text. Trello cards can be searched with the modifier “inurl:https://trello.com/c/” — this yields thousands (if not millions) of results, and many contain sensitive information.

Pathak said that in many cases, it can be very difficult to identify the organization to which a board belongs. “I literally spent hours finding the contact details of organizations to which a board belonged so I could report them,” he told me.

Trello co-founder Michael Pryor provided a written statement highlighting the company’s privacy safeguards.

“Trello boards are set to private by default and must be manually changed to public by the user,” the statement read. “We strive to make sure public boards are being created intentionally and have built in safeguards to confirm the intention of a user before they make a  board publicly visible. Additionally, visibility settings are displayed persistently on the top of every board.”

In a Medium comment, Pathak said that he has seen many organizations using public Trello boards to share useful information that they want to be listed in the search results, so there are good reasons to expose some boards. But he also said it’s possible that some boards are made public due to sheer laziness: it’s slightly easier to make a board public and share the URL internally than it is to add people to a Trello team of authorized viewers.

It’s true, as Pryor stated, that Trello’s boards are set to private by default and that when a user sets a board to public, the visibility setting and what it entails (including search engine indexing) is clearly explained. But Pathak had three additional suggestions to these built-in safeguards: Trello could highlight the visibility in red if a board is set to public; it could show a pop-up notice to users when they create or change board visibility to public in order to let them know that this can be viewed by anyone with the link and is indexed by search engines; and it could add to the Trello interface that automatically checks to try and detect if a user has posted a username or password to a public board.

Informed of Pathak’s suggestions, Pryor said that Trello is looking at other similar cloud apps and how they balance users’ quite often safe decision to share a set of information publicly with the desire to protect against inappropriate sharing of sensitive data. In the meantime, security researchers who find additional boards with sensitive information can send them to support@trello.com, and Trello will get in contact with the owner and close them down if needed, according to Pryor.

U.K.’s Government Digital Service, which declined to comment for publication, provided its staff with internal communication guidance to make sure it is using online tools such as Trello appropriately; the guidance states that no personal or sensitive data should be published on Trello. The service also has an Information Assurance Team to guide staff on the appropriate use of online tools.

A written statement provided by a spokesperson for the government of Canada said, “The Government of Canada recognizes that open access to modern digital tools is essential to transforming how public servants work and serve Canadians. … Departments and agencies of the Government of Canada must also apply adequate security controls to protect their users, information, and assets. This includes ensuring that their users are appropriately educated about their obligation to safeguard information and assets and to never use external web services and tools for communicating or storing sensitive information unless the service is approved by the appropriate security and technical authorities. Government of Canada employees are being reminded of their obligation never to communicate or store sensitive information on Trello boards or any other unauthorized digital tool or service.”

The post British and Canadian Governments Accidentally Exposed Passwords and Security Plans to the Entire Internet appeared first on The Intercept.

The 9th Circuit of Appeals is currently deliberating Chamber of Commerce v. City of Seattle, a suit brought on Uber’s behalf by the pro-business organization. Uber and the chamber hope to label the Seattle ordinance, passed unanimously by the city council in 2015, an antitrust violation. The argument, in essence, is that the city’s coalition of largely working-class and immigrant drivers would violate antitrust rules if they were allowed to negotiate together with the ride-sharing companies that sign their paychecks. Since the drivers are classified as independent business operators, the logic goes, they would be illegally conspiring to set prices.

Recently, Uber’s side got a boost from lawyers from the U.S. Department of Justice, led by an outspoken Donald Trump supporter and former aide, and from the Federal Trade Commission. The agencies filed an amicus brief late last year, and an FTC lawyer presented oral arguments last month in front of a three-judge panel. The City of Seattle, for its part, maintains it should able to set its own labor rules, and that it wants to be a “laboratory’ for testing innovative policy responses to the problems created by new technologies and the changing economy.”

The appeals case, the culmination of a more than two years of legal battle, stands as an example of how Uber has cultivated support well over the heads of local officials, who are directly exposed to its operations and often most inclined to regulate it. Beyond the courts and sympathetic members of the executive branch, Uber also benefits from a sprawling army of lobbyists. Recruited from both parties, these lobbyists help enact industry-friendly transportation laws at the state level, which can make Seattle-style unionization efforts nearly impossible. Against this political backdrop, Chamber of Commerce v. City of Seattle takes on an added urgency: It underlines just how difficult it is for workers in the precarious gig economy, who generally cannot unionize, to gain any leverage over the well-capitalized platforms for which they work

Uber’s battle against municipal legislation has been long, grinding, and multifaceted. It has also tended to get lost in the news cycle, even as Uber’s scandals have become increasingly explosive. Allegations that the company fostered a top-to-bottom culture of sexual harassment, that it stole self-driving car technology from Google, that it built software to evade regulatory monitoring — these charges and others have been scrupulously documented and dissected, down to how much water ousted Uber CEO Travis Kalanick drank during recent court testimony. The company’s political and legal maneuvers, meanwhile, tend to rumble below the surface. But the outcome of the Seattle case, like other slogging regulatory Uber fights, could have far-reaching implications for countless workers trying to earn a living in the app-based labor market.

Seattle’s “Enterprising” Effort to Help Uber Drivers

The city ordinance aims to create a framework for the city’s drivers to vote and decide if they want to collectively bargain with ride-sharing companies like Uber and Lyft over working conditions. It didn’t define these drivers as official employees. But it would set up an alternative system that recognized the unique predicament of ride-sharing drivers, sitting somewhere in between traditional salaried employees, and independent contractors who completely control their work environment. “It was an enterprising proposal,” said Charlotte Garden, a professor and labor law expert at the Seattle University School of Law who supports the ordinance. Garden stressed that the legislation would empower drivers in the city to address a range of concerns, including low wages and opaque deactivation rules. If negotiations break down, the ordinance provides mechanisms to facilitate an agreement. Either party can request arbitration, under the supervision of the city.

An economist called the Trump administration’s use of antitrust law against Uber drivers “galling.”

Uber moved quickly to fight the Seattle law on multiple fronts. It created an anti-unionization podcast, offered free pizza to drivers who showed up to anti-union meetings, and bought local TV ads critical of the Teamsters, the union working to organize drivers on the ground.

One of its local subsidiaries in Seattle teamed up with the Chamber of Commerce and launched a suit shortly after the ordinance passed. The plaintiffs argued, among other things, that the city was violating antitrust rules. By allowing drivers to form an organization and bargain to set prices and working conditions, the chamber argued, the drivers were setting up what amounted to an illegal cartel. Although a district court ruled against Uber in 2015, the chamber appealed to the 9th Circuit, where it was eventually joined by the FTC and DOJ. (The FTC has not always been in Uber’s corner; last year, it fined the company $20 million for misleading drivers about pay).

While the Seattle law is tied up in court, Uber drivers have not been able to convene a bargaining unit as the ordinance allows.

The merits of the Seattle case hinge on a series of highly technical questions. Seattle argues that a Washington state transportation law from the 1990s, which empowers cities to regulate the for-hire vehicle industry, now authorizes the city to regulate the relationship between Uber drivers and the company. Uber and its allies say it doesn’t. The city argues that its law doesn’t interfere with federal antitrust regulations, because it falls under something known as the “state-action exemption,” a legal standard that allows elected governments, in some circumstances, to sanction anti-competitive behavior, such as price floors for drivers. This position is supported by a dozen state attorneys general, the AFL-CIO, and the National Employment Law Project. Uber and its allies disagree, and arguments by federal attorneys have focused on establishing that, between Seattle’s ordinance and the older state law on which it rests, this exemption has not been properly met.

Antitrust and labor experts have come down on both sides. Marshall Steinbaum, an economist who serves as research director at the left-leaning Roosevelt Institute, called the federal government’s decision to use antitrust law to block Uber drivers from negotiating better working conditions “galling.”

“Their job is to make the economy competitive,” he said. “That does not include siding with the Chamber of Commerce and Uber in a case against labor.” (When an Uber customer in New York filed a suit accusing Uber themselves of price-fixing, the FTC did not side with that customer, and the case was eventually sent to arbitration.)

The top DOJ lawyer on the case, Makan Delrahim, is a Trump supporter and the president’s former deputy assistant. He was accused of politicizing the recent enforcement of antitrust rules against a communications merger involving CNN, of which Trump has been critical. (The DOJ did not respond to a request for comment.)

Still, the Uber-Seattle spat is not so clear-cut. The federal antitrust concerns in the case bear some resemblance to past regulatory action, including a groundbreaking 2015 Supreme Court ruling that the FTC could enforce an antitrust order against North Carolina’s State Board of Dental Examiners, which the state had claimed was immune from antitrust law. The case went to the Supreme Court, which ruled in 2015 that the FTC had correctly identified the scheme as an antitrust violation.

Christopher Koopman, the director of the Technology Policy Program at the Mercatus Center at George Mason University, wrote in an email to The Intercept that the Seattle plan in unfair because only some drivers would be allowed to bargain; the ordinance only covers longtime drivers who drive close to full time. This is an argument Uber has been making as well. Boycotts or work stoppages, Koopman argued, would be a better way to pressure Uber to improve working conditions. “A much more powerful mechanism, and one that can be used by all drivers to voice concerns, is refusing to drive,” Koopman wrote.

For drivers on the ground organizing in Seattle, the lawsuit — and the federal government’s decision to side with Uber — feels like a gut punch: “To me, it looks like the government is sheltering the business class from us,” said Don Creery, an Uber driver in Seattle who is also on the leadership team of the App-Based Drivers Association, the organization leading that driver negotiating effort. Creery’s been waiting for two years for the law to go into effect, and he’s starting to despair. He’s been working longer hours to earn the same amount of money, his rent keeps creeping up too. Meanwhile, other drivers are less and less interested in getting organized. “I don’t blame them,” Creery said. “What do we have to show for it?”

How Uber Cancels Local Regulations

A recent report out from the National Employment Law Project and the Partnership for Working Families underlines just how significant the battle in Seattle is. It charts how Uber steadily built up one of the country’s most extensive lobbying juggernauts — in 2016, it had 370 active lobbyists working on its behalf, more than Amazon, Microsoft, and Walmart combined. The lobbying campaign helped enact statewide regulatory regimes that would preempt efforts by cities to craft their own rules governing safety issues, insurance, background checks, and, in Seattle’s case, collective bargaining arrangements.

Uber and its allies have not been able to pass such a law in Washington state, which is why Seattle was able to make some headway with its collective bargaining ordinance in the first place.

“It looks like the government is sheltering the business class from us.”

But Seattle is an outlier. According to the report, more than 40 states have enacted legislation that can block local transportation network regulations before they ever end up in a courtroom, by stripping cities of their regulatory power outright. The lobbying efforts were tightly focused on local politics: In Portland, Oregon, where Uber’s preferred legislation ultimately failed in the state legislature, the company’s lobbying activity in 2015 accounted for 30 percent of the city’s total lobbying that year.

“Uber took advantage of legislatures’ lack of familiarity with the industry,” said Miya Saika Chen, one of the report’s authors, and a lawyer with the Partnership for Working Families. What’s perhaps most striking about the lobbying effort, Saika Chen said, is just how bipartisan it is: In Pennsylvania, Uber hired Krystjan Callahan, the former chief of staff to the Republican House speaker; in Texas its PAC hired former Democratic mayor of Austin, Lee Leffingwell. Uber even deployed former Obama adviser David Plouffe to Seattle back in 2015, to squash the drivers’ collective bargaining campaign.

Sometimes, Uber has been a bit overzealous; Plouffe had to pay a $90,000 fine for violating lobbying rules in Chicago.

And while they don’t always win, the influence of these Uber lobbyists is hard to overstate. Take Ohio, where Uber’s lobbying efforts are laid bare thanks to public documents obtained through the Freedom of Information Act and provided to The Intercept by the authors of the new report. In the spring of  2015, Robert Klaffky, a lobbyist working for Uber in Ohio, sent Mike Duffey, a state representative from the small affluent town of Worthington, an email to his private Gmail account. “Here is a draft bill for Ohio,” the lobbyist wrote. “Please review and let’s set a time we can chat to walk through it.”

At that time, a number of cities in Ohio had begun disseminating their own rules and regulations for how ride-sharing companies — including Uber and Lyft — would operate. In Columbus, for example, city leaders had worked for a year on a set of regulations for driver background checks and safety inspections. Uber protested that these rules were too onerous.

The file Klaffky sent to Duffey contained a new state law that would cancel out any local regulations. The records show that Klaffky even drafted responses for Duffey to send to other lawmakers skeptical of the bill. And just eight months after Klaffky emailed Duffey, the bill found itself on Ohio Gov. John Kasich’s desk. As Cleveland.com once reported, Klaffky was considered to be in Kasich’s inner circle and a member of his “kitchen cabinet.” And Kasich prompted sign a bill that closely resembled Uber’s original wording into law. It came over the objections from organizations like the Ohio Municipal League, which argued that the bill stripped cities of their ability to regulate their own transportation sector.

In an email to The Intercept, Duffey defended the bill as a necessary fix. As individual cities moved to regulate Uber, he says, the legislature needed to step in and provide a statewide standard. “Every bill involves input from the affected industries, including draft language for review,” Duffey wrote.

Uber Says It’s “Confusing” When Cities Have Their Own Laws

“Regulating ride-share at a city level creates barriers to entry and costs to drivers, confusion for riders, and unnecessary administrative costs for local governments — all without any increase in safety for riders and drivers or benefits for local jurisdictions,” an Uber spokesperson told The Intercept. “We will continue working with lawmakers and regulators to develop rules and policies that benefit riders and drivers while providing businesses like ours legal certainty.”

Critics of Uber’s strategy call this technique “preemption” or “state interference.” Pioneered by conservative pressure groups, this legislative strategy has been used to block city-level attempts to raise minimum wages and enact gun control by passing sweeping state laws that nullify local ordinances.

Klaffky, the lobbyist, told The Intercept that Uber’s efforts in Ohio are a “fairly ordinary” example of how industry shapes its regulatory environment. Though, he’s noticed that Uber’s government affairs team is a cut above the rest: “They are very sophisticated,” he said. “Most of them come out of government, there are Republicans and Democrats, and they know how government works.”

Uber is currently pushing a regulatory law in the Washington state legislature — although, the company says it is happy to let the courts decide the fate of Seattle’s collective bargaining scheme.

The Seattle case could set a strong precedent, either inviting a new wave of driver organizing or solidifying the labor model that Uber wants. “Other states and cities are waiting to see what happens,” said Garden, the labor lawyer. A similar effort by the California legislature has already stalled. Assembly Member Lorena Gonzalez, who had been pushing to unionize California ride-sharing drivers, pulled her bill in 2016 because, her office said at the time, it relied on “a number of untested legal theories.”

The 9th Circuit could throw the case back to district court, or it’s possible that the court could make a definitive ruling, provoking a potential Supreme Court appeal. The future of the law is still up in the air — though during oral arguments, the three-judge panel was reportedly unsympathetic to the city’s case (video is available here and here).

Meanwhile, Uber’s effort to smooth out its regulatory environment continued apace. An industry-backed bill passed the Alabama legislature last month with unanimous support. Uber’s lobbying team in the state includes a former deputy attorney general and a former chief of staff to the governor.

Back in Seattle, Greery, the driver and labor leader, is not at all optimistic that he’ll ever be allowed to sit across the table from the company he works for and bargain. “People say it could go to the Supreme Court” he said, sounding despondent. “That’s an anti-labor court — and I think we would lose.”

Corrections

March 26, 2018: An earlier version of this story misidentified the plaintiff in a New York case accusing Uber of price fixing; the plaintiff was a customer, not a driver.

March 29, 2018: An earlier version of this story contained a passage incorrectly tying Uber to a fine for lobbying in California. In fact, the lobbying was for Lyft.

Top photo: An Uber car waits for a client in Manhattan a day after it was announced that Uber co-founder Travis Kalanick will take a leave of absence as chief executive on June 14, 2017 in New York City.

The post Trump Administration Fights Effort to Unionize Uber Drivers appeared first on The Intercept.

But about three years after entering the U.S., around the time he converted back to Islam, Kurbanov was placed under FBI surveillance. According to emails and internet chat logs obtained by the government, Kurbanov was disgusted by having seen Americans burn the Quran and by reports that an American soldier had tried to rape a Muslim girl. “My entire life, everything, changed,” Kurbanov wrote in a July 31, 2012 email.

After the FBI assigned one informant to live with him and another informant to attend his truck-driving school, Kurbanov was arrested in May 2013. Prosecutors accused him of providing material support to the Islamic Movement of Uzbekistan and possessing bomb-making materials.

During Kurbanov’s trial, the government notified him that his conversations with an alleged Islamic Movement of Uzbekistan associate based in Pakistan had been intercepted. The spying, federal prosecutors said, had been authorized under the Foreign Intelligence Surveillance Act of 1978, which regulates the monitoring of agents of foreign governments and terrorist organizations. Kurbanov was convicted at trial and sentenced to 25 years in prison, after which he’ll be deported to Uzbekistan. He is an apparent success story for U.S. counterterrorism officials. If there was any doubt about Kurbanov’s propensity for violence, he eliminated it by stabbing a prison warden in California, an act for which he is now facing additional charges.

But Justice Department lawyers gained their conviction against Kurbanov after failing to disclose a legally significant fact: Kurbanov’s conversations with his alleged terrorist associate had been captured through PRISM, a National Security Agency mass surveillance program whose existence was revealed in documents provided by whistleblower Edward Snowden. Under PRISM, the government obtains communications directly from at least eight large technology companies without the need for warrants, a type of practice authorized in 2008, when Congress provided new surveillance powers under FISA.

The government must disclose when information against defendants originates from warrantless surveillance — but prosecutors did not do so to Kurbanov.

While traditional FISA authority permits spying on a particular person or group through warrants issued by the secret Foreign Intelligence Surveillance Court, under the new powers, codified in FISA Section 702, monitoring is approved in bulk by the court through what is essentially a recipe for mass surveillance. Once approved, such a recipe can be used against thousands of targets. Under Section 702 authority, the NSA is currently monitoring digital communications of more than 100,000 people; it swept up an estimated 250 million internet communications each year as of a 2011 Foreign Intelligence Surveillance Court opinion. The FBI frequently searches Section 702 databases when it opens national security and domestic criminal “assessments,” precursors to full investigations.

According to a slide in an NSA presentation, provided by Snowden and published for the first time today by The Intercept, the interception of Kurbanov’s conversations was a “Reporting Highlight” for PRISM. The document indicates that the NSA captured Kurbanov’s Skype conversations from October 2012 through April 2013, roughly the same period the FBI was investigating him with undercover informants. It further details how an NSA unit in April 2013 issued a report describing “how Kurbanov believed he was under surveillance (which he is by the FBI) but was cautiously continuing his work, which was not specified — could be raising money for the IMU or explosive testing.” The alleged terrorist associate with whom Kurbanov was communicating “wanted Kurbanov to set this work in motion, probably related to sending money back to the IMU,” the document added.

The government is obligated to disclose to criminal defendants when information against them originates from Section 702 reporting, but federal prosecutors did not do so in Kurbanov’s case. In fact, when Kurbanov’s lawyers demanded disclosure of FISA-related evidence and the suppression of that evidence, Attorney General Eric Holder asserted national security privilege, claiming in a declaration that disclosure of FISA information would “harm the national security of the United States.” Kurbanov’s lawyer, Chuck Peterson, declined to comment about the government’s use of Section 702 surveillance against his client.

Kurbanov does not appear to be the only defendant kept in the dark about how warrantless surveillance was used against him. A nationwide review of federal court records by The Intercept found that of 75 terrorism defendants notified of some type of FISA spying since Section 702 became law, just 10 received notice of Section 702 surveillance. And yet Section 702 was credited with “well over 100 arrests on terrorism-related offenses” in a July 2014 report from the Privacy and Civil Liberties Oversight Board, the federal entity created to oversee intelligence authorities granted in the wake of the 9/11 attacks. Additional documents from Snowden, previously unpublished and dated before the Kurbanov case, provide further examples of how NSA intelligence repeatedly played an undisclosed role in bringing accused terrorists to trial in U.S. courts over the past decade and a half. They also reveal an instance in which the NSA incorrectly identified a U.S. citizen as a foreign target of a FISA warrant.

Civil liberties advocates have long suspected that the Justice Department is underreporting Section 702 cases in order to limit court challenges to the controversial law. Some theorize that the government conceals Section 702 use through a process known as “parallel construction,” in which evidence obtained from the warrantless surveillance authority is reobtained through traditional FISA authorization, and the government only discloses the latter authority in U.S. District Court. One defense lawyer referred to this practice in a court filing as “laundering” Section 702 evidence. Beyond the Kurbanov case, circumstantial evidence in other  prosecutions suggests that this type of parallel construction could be widespread.

“The government intercepts Americans’ emails and phone calls in vast quantities. … Yet only a handful of individuals have ever received notice.”

“The government intercepts Americans’ emails and phone calls in vast quantities using this spying law and stores them in databases for years,” said Patrick Toomey, staff attorney for the American Civil Liberties Union’s National Security Project. “FBI agents around the country then go searching through that trove of data as a matter of course, including in domestic criminal investigations. Yet, over almost a decade, only a handful of individuals have ever received notice.”

The Justice Department, FBI, and NSA declined to comment for this article. The New York Times in 2013 reported that lawyers in the Justice Department’s National Security Division had believed they did not need to disclose in court whether evidence obtained through FISA specifically originated with Section 702 unless they were presenting material received directly from a Section 702 sweep. The U.S. solicitor general then successfully pushed for a change in policy, bolstered by fallout from the Snowden disclosures; this was followed by a review of past cases by the National Security Division, after which prosecutors filed supplemental Section 702 notices in a handful of cases around the country. In four such cases, the defendants had already been convicted by the time of the disclosure. And whatever changes occurred in 2013 were clearly limited, given that fewer than a dozen such notices have ever been given in court cases, and none at all has been filed in the last year and a half. Kurbanov, meanwhile, was convicted in 2015, well after the purported change in policy.

The government’s handling of its Section 702 authority is particularly important at the moment because the powers are scheduled to expire at the end of the year unless Congress reauthorizes them. Three reauthorization bills are winding through Congress. The Senate Intelligence Committee and the House Judiciary Committee have each produced one, while a third has been sponsored by U.S. senators and longtime intelligence community critics Ron Wyden, an Oregon Democrat, and Rand Paul, a Republican from Kentucky. As currently written, the Wyden-Paul bill would strengthen notification requirements and curb the Justice Department’s ability to launder Section 702 evidence through traditional FISA. The bill would require notification of Section 702 surveillance even when evidence derived from that surveillance “was subsequently reobtained through other means.” Meanwhile, the bill that emerged from the Senate Intelligence Committee appears to expand Section 702 without providing additional safeguards.

The undisclosed use of warrantless surveillance to win prosecutions is also troubling from a constitutional standpoint, foreclosing a rare opportunity to discover Section 702 abuses and challenge the law, which civil liberties advocates have argued is unconstitutional. Although FISA stipulates that targets of surveillance may challenge the order that led to spying against them, and although Section 702 is clearly used on a massive scale, courts have been strict in deciding who is a “target” of the surveillance authority, and of similar mass spying programs, and thus has standing to challenge the monitoring. For example, the Supreme Court in 2013 ruled, in a 5-4 decision, that Amnesty International and other plaintiffs could not bring a Section 702-related lawsuit because their claim that they would be targeted or harmed by such eavesdropping was too speculative. During arguments prior to the ruling, the U.S. solicitor general specifically told the justices that more suitable plaintiffs would likely emerge because people charged due to Section 702 surveillance would be notified by prosecutors and could then challenge the use of the surveillance in court.

“The failure to provide notice not only prevents defendants from challenging surveillance programs in court, but also stymies the public’s interest in understanding how and when its vast authorities are used,” said Faiza Patel, co-director of the Brennan Center’s Liberty and National Security Program. “We know that the FBI has a practice of trawling through the vast databases of information captured under Section 702 for information about Americans, but it has only acknowledged relying on such surveillance in a handful of cases and then only when its failure to provide the legally required notice generated public pressure to do so.”

In the immediate years after the 9/11 attacks, as the FBI and NSA refocused on counterterrorism as their top priority, the NSA was acutely reliant on the FBI for its relationships with the Foreign Intelligence Surveillance Court, a secret judicial body that provides oversight of surveillance authorization requests, and with U.S. internet and telecommunications companies. In large measure, in these early years the NSA needed the FBI to function effectively as a signals intelligence agency for counterterrorism purposes. For example, when the NSA required authority to target for surveillance a specific phone number or email address — even when the NSA did not know the identity of the person behind that phone number or email address — the FBI went before the Foreign Intelligence Surveillance Court to obtain authorization on the NSA’s behalf. In turn, once that authorization was granted, the NSA needed the FBI to contact the internet or telecommunications company to obtain the data.

The NSA defined a U.S. citizen’s email address as not being related to a U.S. person when the NSA and FBI should have known this was incorrect — Tarik Shah  had played at Bill Clinton’s inauguration.

An August 17, 2005, edition of SIDtoday, the internal newsletter of the NSA’s Signals Intelligence Directorate, disclosed that at the time 40 percent of all NSA counterterrorism reporting was derived from FISA collection. The newsletter added: “NSA gets most of its (counterterrorism)-related FISA collection from the FBI. The FBI collects, formats, and disseminates international terrorism-related FISA intercept to NSA, CIA, and internally to FBI agents and analysts.” In 2004, the NSA began to embed employees in the FBI’s Data Intercept Technology Unit, in Quantico, Virginia, so that NSA employees could speak more directly with U.S. data providers, such as internet companies, about formatting data to NSA specifications. “This is the first time that the NSA FISA team has had direct access to the providers, which has proven to be extremely useful to NSA,” the newsletter stated.

According to internal NSA documents, FISA data obtained by the FBI is funneled into a special partition in PINWALE , the NSA’s massive database of digital communications that can be queried by email address, internet protocol address, and other parameters. From 2002 through 2008, according to internal files, the NSA kept a spreadsheet titled “FISA recap” of 7,485 FISA surveillance targets consisting of email addresses or phone numbers, with columns indicating the start and end dates of the authorized surveillance and whether the target was associated with a U.S. person, defined by law as a citizen or lawful resident.

A decade later, most of these email addresses and phone numbers can’t be traced to anyone; many belonged at the time to foreigners the government suspected were involved with terrorist organizations. Others were used by civil rights activists, lawyers, and academics in the United States who were never charged with federal crimes, such as Nihad Awad of the Council on American-Islamic Relations and Rutgers University professor Hooshang Amirahmadi. To have obtained FISA surveillance authority for those U.S. persons, the government had to have demonstrated to the Foreign Intelligence Surveillance Court that they were acting as agents of a foreign power. It’s unknown how the government demonstrates this, since individual FISA applications are secret, even when evidence derived from FISA surveillance is introduced against criminal defendants.

In the case of at least one FISA target, the NSA defined a U.S. citizen’s email address as not being related to a U.S. person when the NSA and FBI should have known this was incorrect, suggesting the government did not have to prove the target was a foreign agent. Tarik Shah, a jazz bassist who had played at Bill Clinton’s inauguration, was arrested in 2005 following an informant-led FBI sting, in which Shah pledged allegiance to Al Qaeda before an undercover agent. Shah’s FISA-authorized surveillance from October 2004 through June 2005 occurred concurrently with the FBI’s sting. Shah had a friend, Mahmud Faruq Brent, who had attended a Lashkar-e-Taiba training camp in Pakistan and complained about how “difficult it was to be back in the United States.” But the primary link between Shah and overseas terrorists was the undercover FBI agent who pretended to be from Al Qaeda. And there was no reasonable reason for ambiguity about whether the email address belonged to Tarik Shah, the U.S. citizen, as opposed to another Tarik Shah somewhere else in the world. The email address was thebassman_12963@hotmail.com, the username a reference to Shah’s music profession. In a September 2006 filing, Attorney General Alberto Gonzales asserted national security privilege to prevent disclosure of Shah’s FISA application. Shah pleaded guilty to a material support charge; he is scheduled to be released from prison next year. It’s impossible to know from available NSA records whether the classification of Shah’s email address as a non-U.S. person was an anomaly or part of a broader NSA practice of targeting U.S. persons without having to provide probable cause to the FISA court that they were agents of foreign powers — a requirement intended protect U.S. citizens and legal residents from unreasonable search and seizure.

Because the FBI stood between the NSA and FISA data collection, NSA analysts encountered bottlenecks that frustrated counterterrorism and intelligence operations, internal NSA communication show. In April 2006, for example, the NSA was monitoring Ehsanul Islam Sadequee through a FISA authorization the FBI had obtained. A Bangladeshi-American who was born in the United States and grew up in the Atlanta suburbs, Sadequee came to the attention of U.S. authorities after he and a friend, Syed Haris Ahmed, traveled to Toronto to meet with several young men who were being investigated for terrorism in Canada. After that meeting in Toronto, Sadequee traveled to Bangladesh. He told U.S. counterterrorism agents prior to leaving that he was going to Bangladesh to be married. On April 5, 2006, as the FBI was closing in to arrest Sadequee, an NSA analyst urgently emailed the agency’s FBI liaison asking for the bureau’s help documenting their FISA authorization on Sadequee’s email address. “The reason we are pursing (sic) this is because we would like to retrieve a file that was passed between him and an associate about three weeks ago,” the NSA employee wrote. Sadequee was found guilty at trial of terrorism-related offenses, including material support for terrorists, and sentenced to 17 years in prison. His friend, Ahmed, was also found guilty at trial and received 13 years in prison; he was released in August.

In 2003, following a sting operation involving two informants and a meeting in Germany, Yemeni cleric Mohammed Ali Hassan al-Moayad was arrested in Frankfurt and extradited to the United States, where he was charged with raising money for Hamas and Al Qaeda. Moayad was convicted at trial in 2005. In an August 3, 2005, edition of SIDtoday, an NSA employee gave the agency credit for Moayad’s conviction. “Although this fact is unknown to the general public, and to the vast majority of the law enforcement community, NSA reporting played a key role in bringing the sheikh to trial,” the NSA employee wrote. It’s not clear what role NSA played in Moayad’s investigation. Moayad, who was not a U.S. person during the investigation, was not notified of FISA surveillance, court records show; nonetheless, his verdict was overturned after an appeals court ruled that testimony about unrelated terrorist activity had been allowed to prejudice the jury. Moayad was deported to Yemen in 2009 as part of a deal in which he pleaded guilty to conspiring to raise money for Hamas.

A week after crowing about its secret role in Moayad’s trial, the NSA boasted internally through SIDtoday that the agency played a key role in investigating Abdurahman Muhammad al-Amoudi, a U.S. citizen who was involved in financial transactions with Libya and a plot to assassinate the Saudi crown prince. According to SIDtoday, Libyan President Moammar Gadhafi organized the failed assassination plot after a perceived insult and threat by the Saudi crown prince during an Arab League summit. In 2004, Amoudi pleaded guilty to terrorism-related charges and was sentenced to 23 years in prison. “NSA’s contributions were significant,” the agency’s newsletter reported.

“Although this fact is unknown to the general public, NSA reporting played a key role in bringing the sheikh to trial.” —Top-secret passage in internal NSA newsletter

The NSA also played a previously undisclosed role in the capture of Nancy Conde Rubio, who at the time of her arrest was the fourth-ranking member of Marxist guerrilla group FARC in Colombia. Rubio had joined the FARC when she was 16 years old, and U.S. intelligence indicated that she was the girlfriend of a FARC commander suspected of holding hostage three U.S. citizens. Through digital communications intercepts, the NSA discovered that Rubio was to travel from Venezuela to Colombia without valid paperwork, according to a 2008 SIDtoday article. U.S. government officials provided that information to Colombian law enforcement, whose agents arrested Rubio and extradited her to Washington, D.C., for federal prosecution. She pleaded guilty to material support charges and was sentenced to 11 years and six months in prison.

Following the exposure of the NSA’s warrantless wiretapping programs, and the legalization of mass surveillance programs through the FISA Amendments Acts of 2008, which added Section 702 and other new provisions, the NSA continued to play a large, and largely secret, role in terrorism prosecutions in the United States.

One of the most notable examples involves Najibullah Zazi, who was arrested before he could move forward in an Al Qaeda-backed plot to bomb the New York subway. Zazi, a legal permanent resident of the United States, pleaded guilty to terrorism-related offenses in February 2010. The next month, on March 11, 2010, SIDtoday celebrated “a watershed period in the fight against terrorism and radical extremist groups,” noting that the NSA first discovered Zazi’s email connections to Al Qaeda operatives in Pakistan.

“Without that SIGINT lead on Zazi, his activities might not have come to the attention of the US intelligence and law enforcement communities until he actually conducted a terrorist attack against the US homeland,” an NSA employee wrote, referring to signals intelligence.

In July 2015, five years after Zazi pleaded guilty, prosecutors in New York notified him that he had been subjected to Section 702 surveillance. Zazi has not yet been sentenced; he is now a cooperating witness, part of a larger effort to flip well-connected terrorists into government informants. His case has become the prime example for counterterrorism officials defending the utility of Section 702 in stopping attacks in the United States.

According to a review of nationwide court records by The Intercept, the most recent Section 702 notification was delivered in April 2016, when prosecutors in Chicago informed Aws Mohammed Younis Al-Jayab, a Palestinian refugee who emigrated from Iraq. Jayab is awaiting trial on charges that he lied to federal agents about fighting with terrorist groups in Syria.

“Something is funky on one side of the ledger.”

To those who follow these notifications, the absence of any new Section 702 filings for more than 18 months — a period during which more than 50 terrorism defendants have been charged in U.S. courts and counterterrorism officials have trumpeted the critical need for Section 702 — is suspicious.

“Something is funky on one side of the ledger,” said Neema Singh Guliani, a legislative counsel at the ACLU in Washington, D.C.

If the FBI uses parallel construction to conceal intelligence community information, it would not be the only federal law enforcement agency doing so. In 2013, Reuters obtained documents from the U.S. Drug Enforcement Administration that showed how agents were trained to “recreate” investigative trails to conceal how intelligence intercepts helped to identify criminal targets. Separately, MuckRock obtained DEA documents that suggested FISA could be used by law enforcement agencies “for prosecutorial purposes in a manner that protects [intelligence community] sources and methods.”

Adding to the suspicion that FBI counterterrorism agents use parallel construction to conceal NSA cooperation is a growing number of filings in terrorism cases in which defense lawyers say circumstantial evidence suggestss some form of mass surveillance program was used against their clients.

In South Florida, the FBI nabbed two brothers, Sheheryar Alam Qazi and Raees Alam Qazi, in an informant-led sting, in which the brothers discussed and planned for a bomb plot in New York. Federal prosecutors notified the Qazis that evidence against them included surveillance authorized under traditional FISA authority. But Sheheryar Alam Qazi’s lawyer questioned whether that evidence might have been first obtained from Section 702 and then re-obtained through traditional FISA. “That argument was what was suspected but no hard evidence to support,” said Daniel L. Ecarius, an assistant federal public defender in Miami. The judge ruled that the government’s FISA notification was legally sufficient.

Across the country, in California, Adam Shafi was accused of providing material support to terrorist groups after the FBI discovered that Shafi had disappeared from his family for two days while they were in Egypt. Shafi later told his family and the FBI that he had traveled to Turkey to see the conditions of Syrian refugee camps, but in an affidavit to support a criminal charge, the FBI disclosed that intercepted communications revealed that Shafi had discussed traveling to Syria to join Nusra Front. Prosecutors in June told Shafi’s lawyer, Galia Amram, that they did not intend to file Section 702 notice in the case. Amram demanded that the judge determine whether Section 702 notice was required, as Qazi’s lawyer had. The judge in California also ruled that the government’s notification was legally sufficient.

The case of Khalid Ouazzani is even more perplexing. In May 2016 testimony before the Senate Judiciary Committee, Matthew G. Olsen, former director of the National Counterterrorism Center, specifically touted Ouazzani’s arrest as a success story for Section 702 surveillance.

“NSA conducted surveillance under Section 702 of an email address used by a suspected extremist in Yemen,” Olsen said. “This surveillance led NSA to discover a connection between the extremist and an unknown person in Kansas City, Missouri, who was then identified as Khalid Ouazzani. The follow-up investigation revealed that Ouazzani was connected to other Al Qaeda associates in the United States, who were part of an earlier plot to bomb the New York Stock Exchange.”

Ouazzani, a used car and auto parts dealer, pleaded guilty in 2010 to sending $23,500 to Al Qaeda. But court records in his case show that he was not notified of either traditional FISA or Section 702 surveillance.

Explaining why Ouazzani would not be notified of Section 702 surveillance while 10 other terrorism defendants were notified of such surveillance is impossible because the Justice Department has refused to release documents related to its notification policy. The ACLU sued the Justice Department in 2013 under the Freedom of Information Act to release documents related to the policy. The Justice Department still refused to comply, claiming none of its documents contained a “binding” interpretation of the obligation to provide Section 702 notice.

“Without knowing the government’s policy, it’s impossible to even begin to audit whether these notifications are taking place in all cases where they are legally required,” said Andrew Crocker, a staff attorney for the Electronic Frontier Foundation.

The notification concerns surrounding Section 702 do not affect only accused terrorists. While to date only terrorism defendants have received notification of Section 702 evidence, the FBI does not have a policy limiting the use of Section 702 searches to suspected terrorists. The searches are available for all domestic criminal investigations.

“The immense authorities given to security agencies for counterterrorism purposes should be of concern to every American,” said Patel of the Brennan Center. “The government is able to circumvent the Fourth Amendment’s warrant requirement to go poking around into private communications. This allows for targeting for reasons of politics and prejudice.”

Documents

• SSO Weekly Brief 25 April 2013: Excerpt
• SIDtoday: FISA: Teaming with the FBI in the Global War on Terrorism
• PINWALE: Transnational DNI Training
• Re: Ehsanul Sadequee FISA Request
• SIDtoday: Life as the SID Liaison to the Joint Terrorism Task Force in NYC
• SIDtoday: The Saudi Assassination Plot — How It Was Thwarted
• SIDtoday: 2009: A Watershed Year in the Fight Against Terrorism
• SIDtoday: Perseverance Pays Off: Eight-Year SIGINT Effort Culminates in the Arrest of Elusive Colombian Terrorist
• NSA Classification Guide for FISA

Top photo: A security officer stands outside of U.S. Federal Court House on the morning the court begins jury selection for the Abu Hamza terrorism trial on April 14, 2014 in New York City.

The post NSA Secretly Helped Convict Defendants in U.S. Courts, Classified Documents Reveal appeared first on The Intercept.

Scanning the sky he saw the hovering chopper that had dropped the weapon. He tried to snap photos as it loomed above the rubble, but the images looked fuzzy. Abdulsalam hopped on the back of a passing ambulance and was among the first on the scene. He trained his camera on the smoldering facade of a bakery, panned to series of blasted-apart food stalls, and then settled his lens on mangled bodies. He kept snapping photos in rapid succession, until he spotted his cousin amid the carnage. Holstering his camera, Abdulsalam decided to join the rescue effort and helped his relative to a nearby hospital.

It was January 2014, almost two years after the Syrian army opened fire on protesters in Abdulsalam’s hometown of al-Bab, in the north of Aleppo province, bringing the country’s raging war to a farming community that had, until that point, remained largely untouched. Since then, Abdulsalam had worked with a group of local media activists to publicize the human toll of the civil war as rebel fighters established a foothold in al-Bab and the Assad regime pounded the town from above.

Within hours of the attack that injured his cousin, Abdulsalam uploaded his photos to Facebook. He thought it was the best way to simultaneously preserve the images — he didn’t know when his camera or computer could be destroyed — and get them out to the world. “It was a particularly horrific bombing,” he told me recently. There had been a pause in the fighting that week, and families who’d spent months cowering inside had just emerged to stroll through an outdoor bazaar near the mosque.

Seven months later, Abdulsalam got an automated email from Facebook notifying him that the images had been removed. Other users had complained that his photos were too gory. By the time he got the email, Abdulsalam’s other copies of the pictures were gone; his hard drive had been burned, along with his small office, when the Islamic State stormed al-Bab and Abdulsalam fled across the border to Turkey.

There’s good reason to believe Abdulsalam’s photos could have been used to address the atrocities he had witnessed. Since the beginning of the Syrian Civil War, investigators with Human Rights Watch have been making regular trips to Aleppo to document potential war crimes, including a disturbing pattern of Syrian helicopters blowing up bakeries with barrel bombs. By the time Abdulsalam snapped his pictures, the Islamic State had begun to move into the city, and HRW could no longer collect on-the-ground evidence. Ole Solvang, an HRW researcher who visited Aleppo more than a dozen times, in part to research the bakery attacks, said of Abdulsalam’s photos, which he never saw, “If there is ever a trial, this is the stuff that could become important evidence.”

The disappearance of Abdusalam’s photos are part of a pattern that’s causing a quiet panic among human rights groups and war crimes investigators. Social media companies can, and do, remove content with little regard for its evidentiary value. First-hand accounts of extrajudicial killings, ethnic cleansing, and the targeting of civilians by armies can disappear with little warning, sometimes before investigators notice. When groups do realize potential evidence has been erased, recovering it can be a kafkaesque ordeal. Facing a variety of pressures — to safeguard user privacy, neuter extremist propaganda, curb harassment and, most recently, combat the spread of so-called fake news — social media companies have over and over again chosen to ignore, and, at times, disrupt the work of human rights groups scrambling to build cases against war criminals.

“It’s something that keeps me awake at night,” says Julian Nicholls, a senior trial lawyer at the International Criminal Court,  where he’s responsible for prosecuting cases against war criminals, “the idea that there’s a video or photo out there that I could use, but before we identify it or preserve it, it disappears.”

Worries over disappearing evidence are not just theoretical. This past summer, YouTube rolled out a new artificial intelligence system designed to identify violent content that may be extremist propaganda or disturbing to viewers. Almost overnight, it shut down 900 groups and individuals documenting the civil war in Syria. That included a channel run by Bellingcat, a reputable U.K.-based organization devoted to analyzing images coming out of conflict zones including Syria, Ukraine, and Libya. YouTube also took down content from the group AirWars, which tracks the toll of U.S. airstrikes in Iraq and Syria. Countless media organizations run from Syria were also shut down, including the Idlib Media Center, one of the few groups producing videos from the last Syrian province controlled by rebels. Meanwhile, in September, Facebook began removing photos and images documenting ethnic cleansing and torture of the Rohingya ethnic minority at the hands of the Myanmar government. Like the images taken by Abdulsalam, other users had flagged the Rohingya images as disturbing, and Facebook agreed.

The takedowns, and the murky processes that led to them, represent a dramatic shift from the heady days of the Arab Spring, when protesters posted images of their governments firing on them, and social media chiefs promoted their platforms as nearly limitless tools for reform. “Anyone with a mobile handset and access to the Internet will be able to play a part in promoting accountability,” Google Executive Chair Eric Schmidt wrote in his 2013 book, “The New Digital Age.”  Around the same time, Facebook CEO Mark Zuckerberg declared, in a 10-page paper about wiring the world for internet: “I believe connectivity is a human right.”

“They could have said: ‘Don’t use your platforms for this,’” said Alexa Koenig, executive director at the Human Rights Center at UC Berkeley. “But they actually tried to get these people use their platforms [for it] — they held themselves up as arbiters of social good, and at that point of creating dependency, I would argue they acquired a heightened responsibility.”

“They had grandiose ideas,” added Keith Hiatt, a former software engineer turned human rights activist who’s served as a sort of intermediary for the tech industry and the human rights community. He is now vice president of Human Rights Programs at the NGO, Benetech, and serves on the Technology Advisory Board for the ICC, a group of experts trying to bridge the gap between investigators and technology. “The big story these companies told, justifying the massive freedom that they had to operate, was that their technologies would lead to openness — and openness will lead to democracy and human freedom,” he said.

Now that their own behavior is at issue, social media companies seem oblivious to the stakes, said Mohammad Al Abdallah, executive director of the Syrian Justice and Accountability Centre, an NGO backed by more 30 governments, including the U.S., which works to preserve social media evidence of atrocities.

“They just don’t appreciate what’s going on on their platforms,” he said. “They don’t take this as seriously as they should.”

Facebook would not answer specific questions about war crimes evidence. A spokesperson, who would not agree to sit for an interview or be named, said Facebook tried to be flexible and allow violent content to live on its platform when that content had some social or documentary value, and pointed to a year-old blog post in which the company said it would be “working closely with experts, publishers, journalists, photographers, law enforcement officials and safety advocates about how to do better when it comes to the kinds of items we allow.”

YouTube defended the way it deals with war crimes evidence and its relationship with the human rights groups who collect that evidence. “We are committed to ensuring human rights activists and citizen journalists have a voice on YouTube and are proud of how our service has been used to expose what is happening across the globe,” Juniper Downs, YouTube’s director of public policy, said. “We collaborate across civil society on many issues, including working with human rights groups to better understand the needs of content creators on the ground. Their expertise helps us make smarter policies and enforcement decisions, and we value the collaboration.”

Social media evidence is increasingly used to build cases against perpetrators of abuses by human rights organizations, by European courts that have “universal jurisdiction” and can bring war crimes charges, and by United Nations investigators. Over the summer, the ICC issued an arrest warrant for a Libyan commander accused of extrajudicial killings on the battlefield, basing the warrant, in part, on videos posted to Facebook. (One of the prosecutors on that case is Nicholls, the ICC lawyer who frets about atrocity evidence disappearing on social media.) Last year in Germany, an ISIS fighter was found guilty of posing with decapitated prisoners based in part on evidence found on Facebook. This year, in Sweden, Syrian regime and rebel fighters were successfully prosecuted for war crimes using evidence from both Facebook and YouTube. In total, there are 30 ongoing war crimes investigations in Swedish and German courts connected to crimes committed in Syria and Iraq. On the other side of the world, the government of Myanmar has barred NGOs and aid agencies from entering northern parts of the country, where human rights groups say a genocide is taking place against the Rohingya population. Human rights workers are often reliant on social media evidence to document the atrocities. At the same time, the U.N. has launched an independent investigation into the Syria conflict — known as the International, Impartial and Independent Mechanism — which has a specific mandate to collect evidence of war crimes in Syria, much of which is housed on social media platforms.

For some who post on social media to document ongoing atrocities, the takedowns seem, at best, a destruction of evidence — and, at worst, complicity in atrocities. “Three years of documentation, just gone, in a moment,” Obayda Abo-Al Bara, a manager at the Idlib Media Center, said. Mohammad Anwar, one of the Rohingya activists whose posts were deleted by Facebook, told The Intercept that “I did feel that Facebook was colluding with the Myanmar regime in the Rohingya genocide.”

Facebook declined to address that statement directly, but said through a spokesperson that it is now making exceptions to its community standards for that conflict, working with NGOs, and conceded some mistakes in its handling of posts from Myanmar after they were brought to light by the Daily Beast in September.

In the tribunals of the future, investigators imagine a constellation of evidence — social media content will be introduced alongside traditional materials, such as eyewitness testimony or official documents to build stronger, more durable, cases against war criminals. Social media will never replace flesh-and-blood witnesses or old-fashioned forensics. But such evidence is clearly growing in importance — and is uniquely concentrated on the servers of Silicon Valley corporations.

“These platforms are now essentially privately owned evidence lockers,” said Christoph Koettl, a senior analyst at Amnesty International.

“But they are not in the business of being a human rights evidence locker; that work is not included in their business model.”

Koettl, who is also the founder of Citizen Evidence Lab, a group that trains human rights researchers to use social media to gather evidence of atrocities, recently received a YouTube link from a source who said it depicted an extrajudicial killing in Nigeria. By the time he clicked the link, the material had been taken down. When he contacted the company to ask for it to be restored, he said, they told him it wasn’t possible. A spokesperson at YouTube told The Intercept that, in such a scenario, the company has to respect the wishes of the video’s original poster — even if a human rights group like Amnesty flags the media as potential war crimes evidence.

Cases like the Nigeria video place social media companies in a difficult position, trying to strike a balance between the thirst for evidence of atrocities and privacy guarantees made to users. Nonprofit rights groups see less noble priorities at play, as well. Koenig has worked for years to help forge cooperation between human rights crusaders and the major social media companies. In 2014, she helped convene a meeting between investigators at the ICC and major tech companies in San Francisco; Google sent a representative, but Facebook pulled out last minute. (Koenig was able to debrief Facebook the week after at the 2014 meeting of RightsCon, an annual digital human rights conference.) This was the first meeting of its kind, she said, and the differences between the two camps were laid bare. “When you’re talking about privately held companies, with loyalty to their shareholders, they think on quarterly timelines and about maximizing profits,” she added.  “With war crimes, we’re talking about a totally different set of priorities, and a timeline of five years minimum.”

Silicon Valley’s attitude is not the only obstacle to deploying social media content in war crimes proceedings. Courts and prosecutors are still hammering out how the evidence can be used, how much weight to give it, and how to make sure defense attorneys can fairly rebut it. There’s the perpetual question of how to distinguish real from fake: Is a YouTube video of an execution authentic or staged? To address such concerns, investigators and activists are racing to standardize how they archive social media evidence, to make it searchable and easier to verify. One priority is sifting through hundreds of thousands of videos and photos to separate so-called lead evidence, content that indicates a crime has taken place, from “linkage evidence,” content that connects perpetrators to that crime.

Beyond the question of how to handle evidence is the challenge of obtaining it in the first place. Courts in European countries where war crimes prosecutions often take place can only submit warrants to American social media companies using cumbersome processes that operate via mutual legal assistance treaties, or MLATs, between their nations and the U.S. Through such channels, it can take years for the data to make its way into the hands of prosecutors. On top of that, the ICC is blocked from getting any social media data (or other information) from U.S. companies, thanks to the American Service-Members’ Protection Act, a law signed by former President George W. Bush in 2002 that shields U.S. soldiers from war crimes prosecutions and also prevents U.S. companies from turning over evidence to the ICC.

Of course, information shared openly on social networks is fair game. And it’s hard to overstate the potency of such evidence — or the consequences of its deletion. Take the trial of Haisam Omar Sakhanh last February. A former Syrian rebel fighter, he sought asylum in Sweden and was then investigated by Swedish authorities for allegedly withholding details of his past. During that investigation, his role in an extrajudicial killing on the Syrian battlefield in 2012 came to light, and he was charged with a violation of international law. He was subsequently convicted and sentenced to life in prison.

Social media evidence proved crucial, the chief prosecutor on the case, Henrik Attorps, told The Intercept. A video published by the New York Times in 2013 showed Sakhanh with an anti-Assad militia, known as the Suleiman Soldiers, executing bound prisoners after a battle in the northern province of Idlib.

Sakhanh claimed that those prisoners had been sentenced to death in a lengthy trial. Attorps was able to use social media to eviscerate that defense. He started Googling Sakhanh’s name and found videos posted on YouTube showing Sakhanh participating in the Idlib battle. He later subpoenaed YouTube for precise times that those videos were posted. He also subpoenaed Facebook for data from a deleted account of the Suleiman Soldiers; this included time-stamped announcements of the group’s attack on Syrian soldiers. Attorps then built a timeline showing that between the announcement on Facebook by the Suleiman Soldiers, the battle itself, and the execution, no more than 48 hours could have elapsed.

If YouTube had removed videos showing Sakhanh participating in that Idlib battle, Attorps could very well have failed to convict. But, the prosecutors still had mixed feeling about social media companies taking down disturbing images that could also be war crimes evidence. “As a prosecutor in this field of law, I’m worried,” he admitted. “But as a citizen, I’m a bit relieved.” Such images and video, Attorps said, can be disturbing for the general public and can serve as propaganda for extremist groups like ISIS.

Social media companies are under tremendous pressure to deny these extremist groups a safe haven for their propaganda. In September, U.K. Prime Minister Theresa May demanded that such firms come up with a way to remove extremist content within two hours of its posting. This presents a real dilemma, an official at YouTube told The Intercept: one person’s extremist propaganda is another person’s war-crime evidence.

“A video of a terrorist attack may be informative news reporting if uploaded by a news outlet or citizen journalist,” Downs of YouTube said. “But that same video clip can be glorification of violence if uploaded in a different context by a different user.”

Cognizant of these tensions, human rights groups are building ways to preserve potential war crimes evidence outside of the purview of social media companies — a sort of emergent, anarchic alternative architecture for media collection. That effort is centered on the Syrian Civil War; the group Syrian Archive, for example, is building a parallel evidence locker, downloading and organizing thousands of hours of video, with a team of six and a budget of $96,000. Researchers are also coming up with new ways to amass atrocity evidence in conflicts in other regions, including sub-Saharan Africa, Eastern Europe, and Asia.

“NGOs are doing the work that companies should do,” said Dia Kayyali, a tech and advocacy program manager at Witness, a group that also maintains a network of contacts in conflict zones documenting human rights abuses on video. “They should be paying people to be in contact with these groups and have relationships with them.”

Of course, the human rights groups, scouring social media for evidence, have longstanding relationships with the platforms — especially YouTube. In 2012, YouTube partnered with Witness to release a tool that allows activists to blur the faces in a video so investigators could collect testimony from anonymous witnesses. More recently, YouTube worked with Eliot Higgins, founder of Bellingcat, the U.K. NGO stung by YouTube’s AI this summer, to develop a tool called “Montage” to help investigators crowdsource analysis of conflict videos. Facebook, human rights activists say, has been less open to such collaborations. “Facebook has been a mess forever,” Higgins told The Intercept. He points to one egregious case: In 2013, after the Syrian regime launched a chemical attack on the civilian population of Damascus, Higgins said that 80 percent of the firsthand reports of the attack, including videos and images, posted to Facebook were erased from the platform. (Facebook declined to answer a question about Higgins’s claim.)

Even human rights groups with strong ties to social media companies often feel buffeted by the whims of the platforms. Rules about what can and can’t be shared can change without much warning. In 2014, for example, YouTube decided to change its Application Program Interface, or API, essentially the language that outside organizations rely on to create software to extract data from, or otherwise interact with, the platform. The Syria Justice and Accountability Centre, a nonprofit group that has collected hundreds of thousands of videos of potential war crimes in Syria, was caught totally unaware and its system crashed. This summer, when YouTube introduced its new AI, channels feeding SJAC again disappeared.

“These companies don’t consult us or even give us educational guidance about how to post to not avoid things being blocked,” Abdallah, the group’s executive director, told The Intercept.

Even Witness was caught off guard by the company’s AI rollout. Many of the groups they partner with in conflict zones found their content removed.

“Who designs this AI? What was their understanding of these conflicts? We don’t know,” said Kayyali. “Huge companies need to recognize that every change they make … will have an effect on human rights users,” Kayyali added. “Instead of working to fix issues after policies and tools have already been instituted, it just makes sense to reach out to stakeholders.”

Screenshot of Syrian Archive website.

In August, when YouTube’s new AI removed thousands of videos associated with human rights and war crimes research, it caused a minor scandal. Higgins reamed the company to his 60,000 Twitter followers: “So far, YouTube’s attempts to remove ISIS and Jihadi content has proven to be a total flop, loads of false positives,” he wrote. YouTube has worked closely with human rights groups to restore videos and channels that its AI took down. A company spokesperson admitted that the rollout was executed poorly, and human rights groups should have been more in the loop.

“Inevitably, both humans and machines make mistakes. We use these errors to retrain our teams and our technology,” Downs, the YouTube spokesperson said. “We are also working on ways to educate those who share video meant to document or expose violence on how to add necessary context, so our reviewers can distinguish their videos from more malicious uploads.”

But more than three months after the botched AI rollout, human rights groups are still reeling:

“All our efforts have shifted to deal with YouTube thing,” said Hadi al-Khatib, the co-founder of the Syrian Archive.

He used to spend his days archiving potential war crimes evidence; now he’s engaged in a Sisyphean battle with YouTube’s algorithm. “We spend all our time helping Syrian media organizations whose content is deleted — we take their accounts, we check them out, make sure they are doing good work, then we we send to YouTube,” he explained. “A few days later, it’s deleted again.” This couldn’t be happening at a worse time, Khatib says. The Syrian regime and its allies are quickly retaking large swaths of Syria from ailing rebel groups and Islamic extremists. “They are demolishing all  types of evidence on purpose — some of what we collect is the the only thing that is left indicating that a crime took place,” he said. In mid-October, for example, YouTube removed bloody video evidence of a Russian airstrike that Khatib said targeted civilians in the Idlib countryside. “This was quite crucial,” he says. “It was a violation of international law and, until now, we can’t get it restored.”

This ad-hoc process for restoring videos raises a lot of questions. Groups and individuals in Europe and the U.S. who have ties to the social media companies have a shot at getting their content back. But for others it’s not within reach: Talal Kharrat, a manager with the Turkish-based Qasioun News Agency, said his organization draws on 80 correspondents, some of them undercover, spread across Syria. Since 2014, he says, nearly 6,000 videos from his agency have been removed by YouTube. Sometimes the content is restored, sometimes not. He’s tried over and over again, he said, to get in touch with someone at YouTube using the “help” button on his personal account.  “I receive no reply,” he told The Intercept. “Please separate between people like us, working in a conflict zone, putting our lives in danger, and someone who’s posting violent images from a normal place, or some extremist,” he said.

The Idlib Media Center was only able to restore some of its videos after it appealed to the Syrian Archive. And Ro Nay San Lwin, a Rohingya activist whose account was shut down and later restored by Facebook in September, says he was able to get in touch with someone at the company because a friend knew someone there. “It isn’t so easy to reach them,” he told The Intercept

This all makes Alexa Koenig, the human rights expert at UC Berkeley, nervous: “We have huge equity concerns: What stories are we losing? Whose voices are we not hearing? Who’s in a dire situation who we don’t know about?”

Abdulsalam, the Syrian photographer, is now in Turkey and quite sympathetic to the dilemma a company like YouTube faces.  He’s also thankful to the platform and credits it with helping “spread the voice” of Syrians under duress. “I also understand why they don’t want bloody content,” he said in a recent phone call. “All I’d ask is that they deal with this issue with more integrity.”

Abdulsattar Abogoda and Rajaai Bourhan contributed to this report.

The post YouTube and Facebook Are Removing Evidence of Atrocities, Jeopardizing Cases Against War Criminals appeared first on The Intercept.