http://www.wired.com/images_blogs/threatlevel/2012/04/streetview-200×100.jpg

Photo: dspain/Flickr

The Federal Communications Commission is clearing Google of wrongdoing in connection to it secretly intercepting Americans’ data on unencrypted Wi-Fi routers.

The commission concluded Friday, in an order unveiled Monday, that no wiretapping laws were violated when the search giant’s Street View mapping cars eavesdropped on open Wi-Fi networks across America. The FCC said that, between 2008 and 2010, “Google’s Street View cars collected names, addresses, telephone numbers, URL’s, passwords, e-mail, text messages, medical records, video and audio files, and other information from internet users in the United States.”

Last year, a federal judge ruled that the search-and-advertising giant could be held liable for violating federal wiretapping law, giving the greenlight to lawsuits seeking damages over Google’s objections.

But the commission, which fined Google $ 25,000 for stonewalling the investigation, found that legal precedent — and an unnamed Google engineer’s refusal to speak to FCC investigators — meant Google was off the hook for wiretapping.

“Based on careful review of the existing record and applicable law, the bureau will not take enforcement action,” the FCC’s enforcement bureau wrote (.pdf) in a heavily redacted 25-page order. The agency commenced an investigation after the Electronic Privacy Information Center demanded that the government review Google’s behavior.

The flap has wide-ranging implications for the millions who use open, unencrypted Wi-Fi networks at coffee shops, restaurants or any other business that tries to attract customers by providing free Wi-Fi. Google, while apologizing for its actions, also strenuously argues that it did nothing illegal by sniffing WiFi networks and storing the contents of citizens’ communications.

That argument didn’t pass muster last year with U.S. District Judge James Ware of California. Ware found lawyers representing the public had pleaded “facts sufficient to state a claim for violation of the Wiretap Act.” That means Google could be liable for wiretapping damages for secretly intercepting the data, a decision that Google is appealing.

What’s more, Joel Burin, the FCC’s consumer and government affairs bureau chief, wrote in 2010 that “Google’s behavior also raises important concerns. Whether intentional or not, collecting information sent over Wi-Fi networks clearly infringes on consumer privacy.”

Despite those harsh words, the FCC agreed with Google that its actions did not amount to wiretapping because the unencrypted Wi-Fi signals were “readily accessible to the general public.”

The contradiction did not escape EPIC which said on its blog Monday that, “Surprisingly, the FCC said that Google had not violated the federal Wiretap Act, even though a federal court recently held otherwise.”

Google said it didn’t realize it was sniffing packets of data on unsecured Wi-Fi networks in about a dozen countries until German privacy authorities began questioning what data Google’s Street View cars were collecting. Google, along with other companies, use databases of Wi-Fi networks and their locations to augment or replace GPS when attempting to figure out the location of a computer or mobile device.

The FCC found that Google also “collected and stored encrypted communications sent over unencrypted Wi-Fi networks,” but the FCC found no evidence that Google accessed that data.

The FCC said that an engineer who developed the program asserted the Fifth Amendment right against compelled self-incrimination, which “made it impossible to determine in the course of our investigation whether Google did make any use of the encrypted communications that it collected.”

Google has said the affair was a “mistake,” and that it only collected “fragments” of data as its Street View cars drove through neighborhoods. Google said it has not reviewed the data.

According to the Wiretap Act, amended in 1986, it’s not considered wiretapping “to intercept or access an electronic communication made through an electronic communication system that is configured so that such electronic communication is readily accessible to the general public.”

But Judge Ware said that interpretation did not apply to open, unencrypted Wi-Fi networks and instead applied only to “traditional radio services” like police scanners.

France, Canada and the Netherlands have concluded that Google’s collection of payload data violated their data protection, online privacy, or similar laws and regulations. The U.S. Federal Trade Commission had opened and closed an inquiry in 2010 without taking any action against Google.

Threat Level
David Kravets

http://www.wired.com/images_blogs/threatlevel/2012/04/Pot-Plant_Blazenhoff-200×100.jpg

Photo: Blazenhoff/Flickr

Eight suspects in the United States and elsewhere have been arrested and indicted for their involvement in an online drug market accessible only through the TOR anonymizing network that sold LSD, ecstasy, marijuana and other drugs to some 3,000 customers in 34 countries.

Six of the eight suspects reportedly involved in the Silk Road-like site were nabbed in the U.S. The alleged ringleader, Marc Willems, was arrested Monday morning in the Netherlands. His alleged deputy, a U.S. citizen named Michael Evron who lives in Argentina, was arrested Sunday while attempting to leave Colombia.

Between January 2007 and October 2009, Willems and Evron, who are charged with running the online storefront called “The Farmer’s Market,” processed about 5,256 online orders for drugs that were valued at more than $ 1 million, according to a 66-page indictment (PDF) released on Monday.

The suspects have all been charged with drug trafficking and money laundering. Some of the suspects have also been charged with distribution of LSD and participation in a continuing criminal enterprise.

Authorities seized unknown quantities of hashish, LSD and ecstasy, as well as an indoor psychotropic mushroom grow, and three indoor marijuana grows in the raids.

According to the indictment, the storefront has been in operation since at least 2006 and was initially launched under the name “AdamFlowers.” In the beginning years, the operation processed customer drug orders via Hushmail, an encrypted e-mail service.

In 2007, one of the defendants sent an e-mail to Willems saying that Hushmail was a secure method of communicating because the Canada-based service would not hand over e-mail content to law enforcement agents. That’s an assertion that turned out not to be true, as Threat Level reported that same year.

The indictment does not give any indication how the feds pierced the veil of the technological tools used to shield the operation from being tracked, but the document is filled with evidence gathered from e-mail communications that took place between 2007 and 2009, while the defendants were using Hushmail.

The online drug operation moved to the Tor anonymizing network in 2010.

Tor, which operates on a network of computers around the world, anonymizes traffic so that the IP address from which communication originates is masked. Tor traffic is encrypted as it hops from node to node around the world, but is decrypted at the final exit node before being delivered to its destination. Anyone operating a Tor exit node can therefore view the content of communications at that point if the packets themselves are not encrypted, and the destination IP address, even if they are.

The online drug market worked much the way underground carding forums work. Sellers, who were apparently screened by the forum administrators, advertised their wares anonymously in the online storefront to registered customers. The operators apparently guaranteed delivery of the drugs to customers all over the world and charged a commission based on the value of the order. They also offered customer support services, including advice on how to package and deliver drugs.

Customers paid for their drugs via Western Union, PayPal, iGolder, Pecunix and cash.

Undercover law enforcement agents infiltrated the group in a sting dubbed “Operation Adam Bomb.” According to the indictment, between April and August 2011 one of the defendants received more than $ 261,000 in PayPal transfers for the purchase of drugs, including $ 2,160 that an undercover agent with the Drug Enforcement Administration sent him to buy about 30 grams of LSD.

Drug trafficking carries a maximum sentence of imprisonment for life; money laundering conspiracy carries a maximum sentence of 20 years’ imprisonment.

Threat Level
Kim Zetter

http://www.wired.com/images_blogs/threatlevel/2012/04/bookstacks-200×100.jpg

Photo:

The Supreme Court agreed Monday to decide the global reach of U.S. copyright law, in a case testing whether an overseas purchaser of a copyrighted work may resell it in the United States without the copyright holder’s permission.

The justices will hear the case, which considers the “first-sale” doctrine, in its next term and is expected to set a nationwide standard. Federal circuit courts of appeal are split on the issue.

The first-sale doctrine generally allows the purchaser of any copyrighted work to re-sell or use the work in many ways without the copyright holder’s permission. That’s why used bookstores, libraries, GameStop, video rental stores and even eBay are all legal. But how the doctrine applies to foreign-purchased works — the so-called grey market — has been a matter of considerable debate.

In many ways, this is a battle for non-digital goods. Most digital goods, like software, e-books and MP3s — because of licensing or sandboxing — cannot be resold. However, a U.S. startup, ReDigi, is testing that theory when it comes to online music.

Meanwhile, the high court in 2010 said the first-sale doctrine did not apply to overseas purchases of copyrighted works which were imported for resale in the United States. The 4-4 ruling meant Costco could be liable for copyright infringement for selling foreign-made watches without the manufacturer’s authorization. However, because there was no majority decision, the ruling did not set a nationwide precedent and solely affirmed a lower court’s ruling.

Justice Elena Kagan was recused from the Costco case, as she had worked on it when she was solicitor general. She had urged the justices to side with Omega, the watchmaker. The government’s position was that the “Copyright Act does not apply outside the United States.” Costco had told the Supreme Court that the decision effectively urges U.S.-based manufacturers to flee the United States (PDF) to acquire complete control over distribution of their goods in the American market, arguments now being made in the latest case.

The case the justices decided to review Monday concerns textbook maker John Wiley & Sons and California entrepreneur Supap Kirtsaeng, who was reselling textbooks on eBay purchased overseas to U.S.-based students without the publisher’s consent. The publisher sued, and a New York federal jury agreed with John Wiley & Sons’ position that the first-sale doctrine did not apply, and awarded $ 600,000 in damages for copyright infringement.

A federal appeals court upheld the judgment. (PDF)

Threat Level
David Kravets