Search This Blog

Wednesday, February 7, 2024

Mass surveillance in the United States

From Wikipedia, the free encyclopedia
https://en.wikipedia.org/wiki/Mass_surveillance_in_the_United_States

The practice of mass surveillance in the United States dates back to wartime monitoring and censorship of international communications from, to, or which passed through the United States. After the First and Second World Wars, mass surveillance continued throughout the Cold War period, via programs such as the Black Chamber and Project SHAMROCK. The formation and growth of federal law-enforcement and intelligence agencies such as the FBI, CIA, and NSA institutionalized surveillance used to also silence political dissent, as evidenced by COINTELPRO projects which targeted various organizations and individuals. During the Civil Rights Movement era, many individuals put under surveillance orders were first labelled as integrationists, then deemed subversive, and sometimes suspected to be supportive of the communist model of the United States' rival at the time, the Soviet Union. Other targeted individuals and groups included Native American activists, African American and Chicano liberation movement activists, and anti-war protesters.

The formation of the international UKUSA surveillance agreement of 1946 evolved into the ECHELON collaboration by 1955 of five English-speaking nations, also known as the Five Eyes, and focused on interception of electronic communications, with substantial increases in domestic surveillance capabilities.

Following the September 11th attacks of 2001, domestic and international mass surveillance capabilities grew immensely. Contemporary mass surveillance relies upon annual presidential executive orders declaring a continued State of National Emergency, first signed by George W. Bush on September 14, 2001 and then continued on an annual basis by President Barack Obama. Mass surveillance is also based on several subsequent national security Acts including the USA PATRIOT Act and FISA Amendment Act's PRISM surveillance program. Critics and political dissenters currently describe the effects of these acts, orders, and resulting database network of fusion centers as forming a veritable American police state that simply institutionalized the illegal COINTELPRO tactics used to assassinate dissenters and leaders from the 1950s onwards.

Additional surveillance agencies, such as the DHS and the position of Director of National Intelligence, have greatly escalated mass surveillance since 2001. A series of media reports in 2013 revealed more recent programs and techniques employed by the US intelligence community. Advances in computer and information technology allow the creation of huge national databases that facilitate mass surveillance in the United States by DHS managed fusion centers, the CIA's Terrorist Threat Integration Center (TTIC) program, and the FBI's Terrorist Screening Database (TSDB).

Mass surveillance databases are also cited as responsible for profiling Latino Americans and contributing to "self-deportation" techniques, or physical deportations by way of the DHS's ICEGang national database.

After World War I, the US Army and State Department established the Black Chamber, also known as the Cipher Bureau, which began operations in 1919. The Black Chamber was headed by Herbert O. Yardley, who had been a leader in the Army's Military Intelligence program. Regarded as a precursor to the National Security Agency, it conducted peacetime decryption of material including diplomatic communications until 1929.

In the advent of World War II, the Office of Censorship was established. The wartime agency monitored "communications by mail, cable, radio, or other means of transmission passing between the United States and any foreign country". This included the 350,000 overseas cables and telegrams and 25,000 international telephone calls made each week. "Every letter that crossed international or U.S. territorial borders from December 1941 to August 1945 was subject to being opened and scoured for details."

With the end of World War II, Project SHAMROCK was established in 1945. The organization was created to accumulate telegraphic data entering and exiting from the United States. Major communication companies such as Western Union, RCA Global and ITT World Communications actively aided the project, allowing American intelligence officials to gain access to international message traffic. Under the project, and many subsequent programs, no precedent had been established for judicial authorization, and no warrants were issued for surveillance activities. The project was terminated in 1975.

President Harry S. Truman established the National Security Agency (NSA) in 1952 for the purposes of collecting, processing, and monitoring intelligence data. The existence of NSA was not known to people as the memorandum by President Truman was classified.

When the Citizens' Commission to Investigate the FBI published stolen FBI documents revealing abuse of intelligence programs in 1971, Senator Frank Church began an investigation into the programs that become known as the Church Committee. The committee sought to investigate intelligence abuses throughout the 1970s. Following a report provided by the committee outlining egregious abuse, in 1976 Congress established the Senate Select Committee on Intelligence. It would later be joined by the Foreign Intelligence Surveillance Court in 1978. The institutions worked to limit the power of the agencies, ensuring that surveillance activities remained within the rule of law.

Following the attacks of September 11, 2001, Congress passed The Patriot Act to strengthen security and intelligence efforts. The act granted the President broad powers on the war against terror, including the power to bypass the FISA Court for surveillance orders in cases of national security. Additionally, mass surveillance activities were conducted alongside various other surveillance programs under the head of President's Surveillance Program. Under pressure from the public, the warrantless wiretapping program was allegedly ended in January 2007.

Many details about the surveillance activities conducted in the United States were revealed in the disclosure by Edward Snowden in June 2013. Regarded as one of the biggest media leaks in the United States, it presented extensive details about the surveillance programs of the NSA, that involved interception of Internet data and telephonic calls from over a billion users, across various countries.

National Security Agency (NSA)

At the request of the U.S. Army, those who protested against the Vietnam War were put on the NSA's "watch list".

1947: The National Security Act was signed by President Truman, establishing a National Security Council.

1949: The Armed Forces Security Agency was established to coordinate signal operations between military branches.

1952: The National Security Agency (NSA) was officially established by President Truman by way of a National Security Council Intelligence Directive 9, dated Oct. 24, while the NSA officially came into existence days later on Nov. 4. According to The New York Times, the NSA was created in "absolute secrecy" by President Truman, whose surveillance-minded administration ordered, only six weeks after President Truman took office, wiretaps on the telephones of Thomas Gardiner Corcoran, a close advisor of Franklin D. Roosevelt. The recorded conversations are currently kept at the Harry S. Truman Presidential Library and Museum, along with other documents considered sensitive (≈233,600 pages).

Federal Bureau of Investigation (FBI)

Institutional domestic surveillance was founded in 1896 with the National Bureau of Criminal Identification, which evolved by 1908 into the Bureau of Investigation, operated under the authority of the Department of Justice. In 1935, the FBI had grown into an independent agency under the direction of J. Edgar Hoover whose staff, through the use of wire taps, cable taps, mail tampering, garbage filtering and infiltrators, prepared secret FBI Index Lists on more than 10 million people by 1939.

Purported to be chasing 'communists' and other alleged subversives, the FBI used public and private pressure to destroy the lives of those it targeted during McCarthyism, including those lives of the Hollywood 10 with the Hollywood blacklist. The FBI's surveillance and investigation roles expanded in the 1950s while using the collected information to facilitate political assassinations, including the murders of Fred Hampton and Mark Clark in 1969. FBI is also directly connected to the bombings, assassinations, and deaths of other people including Malcolm X in 1963, Viola Liuzzo in 1965, Dr. Martin Luther King Jr. in 1968, Anna Mae Pictou Aquash in 1976, and Judi Bari in 1990.

As the extent of the FBI's domestic surveillance continued to grow, many celebrities were also secretly investigated by the bureau, including:

  • First Lady Eleanor Roosevelt – A vocal critic of Hoover who likened the FBI to an 'American Gestapo' for its Index lists. Roosevelt also spoke out against anti-Japanese prejudice during the second world war, and was later a delegate to the United Nations and instrumental in creating the Universal Declaration of Human Rights. The 3,000-page FBI dossier on Eleanor Roosevelt reveals Hoover's close monitoring of her activities and writings, and contains retaliatory charges against her for suspected Communist activities.
  • Frank Sinatra – His 1,300 page FBI dossier, dating from 1943, contains allegations about Sinatra's possible ties to the American Communist Party. The FBI spent several decades tracking Sinatra and his associates.
  • Marilyn Monroe – Her FBI dossier begins in 1955 and continues up until the months before her death. It focuses mostly on her travels and associations, searching for signs of leftist views and possible ties to communism. Her ex-husband, Arthur Miller, was also monitored. Monroe's FBI dossier is "heavily censored", but a "reprocessed" version has been released by the FBI to the public.
  • John Lennon – In 1971, shortly after Lennon arrived in the United States on a visa to meet up with anti-war activists, the FBI placed Lennon under surveillance, and the U.S. government tried to deport him from the country. At that time, opposition to the Vietnam War had reached a peak and Lennon often showed up at political rallies to sing his anti-war anthem "Give Peace a Chance". The U.S. government argued that Lennon's 300 page FBI dossier was particularly sensitive because its release may "lead to foreign diplomatic, economic and military retaliation against the United States", and therefore only approved a "heavily censored" version.
  • The Beatles, of which John Lennon was a member, had a separate FBI dossier.
Some of the greatest historical figures of the 20th century, including several U.S. citizens, were placed under warrantless surveillance for the purpose of character assassination – a process that aims to destroy the credibility and reputation of a person, institution, or nation.

Left: Albert Einstein, who supported the anti-war movement and opposed nuclear proliferation, was a member of numerous civil rights groups including the National Association for the Advancement of Colored People (See Albert Einstein's political views). As a result of his political views, Einstein was subjected to telephone tapping, and his mail was searched by the U.S. Federal Bureau of Investigation (FBI) as part of a secret government campaign that aimed to link him with a Soviet espionage ring in order to first discredit him, and then deport him (unsuccessfully) from the United States.

Center: Martin Luther King Jr., a leader of the Civil Rights Movement, was the target of an intensive campaign by the FBI to "neutralize" him as an effective civil rights activist. An FBI memo recognized King to be the "most dangerous and effective Negro leader in the country.", and the agency wanted to discredit him by collecting evidence to (unsuccessfully) prove that he had been influenced by communism.

Right: Daniel Ellsberg, who leaked the Pentagon Papers to the media in 1971, experienced one of the most spectacular episodes of government surveillance and character assassination. The White House tried to steal his medical records and other possibly detrimental information by sending a special unit to break into the office of Ellsberg's psychiatrist. These activities were later uncovered during the course of investigation as the Watergate scandal slowly unfolded, which eventually led to the resignation of President Richard Nixon.

See also: The FBI kept a dossier on Albert Einstein (≈1,500 pages) and Martin Luther King Jr. (≈17,000 pages). Due to a court order, however, some information has been removed and many other pages will not be released until the year 2027.

1967–73: The now-defunct Project MINARET was created to spy on U.S. citizens. At the request of the U.S. Army, those who protested against the Vietnam War were put on the NSA's "watch list".

The Church Committee of the United States Senate published the final report on "Intelligence Activities and the Rights of Americans" in 1976 (PDF, 26.54 MB)
From 1940 until his death in 1966, the American business magnate Walt Disney served as a "S.A.C. Contact" (trusted informant) for the U.S. government to weed out communists and dissidents from the entertainment industry, according to documents obtained by The New York Times.
See also: Hollywood blacklist

Church committee review

1975: The Church Committee of the United States Senate was set up to investigate widespread intelligence abuses by the NSA, CIA and FBI. Domestic surveillance, authorized by the highest executive branch of the federal government, spanned from the FDR Administration to the Presidency of Richard Nixon. The following examples were reported by the Church Committee:

  • President Roosevelt asked the FBI to put in its files the names of citizens sending telegrams to the White House opposing his "national defense" policy and supporting Col. Charles Lindbergh.
  • President Truman received inside information on a former Roosevelt aide's efforts to influence his appointments, labor union negotiating plans, and the publishing plans of journalists.
  • President Eisenhower received reports on purely political and social contacts with foreign officials by Bernard Baruch, Eleanor Roosevelt, and Supreme Court Justice William O. Douglas.
  • The Kennedy administration ordered the FBI to wiretap a congressional staff member, three executive officials, a lobbyist, and a Washington law firm. US Attorney General Robert F. Kennedy received data from an FBI wire tap on Martin Luther King Jr. and an electronic listening device targeting a congressman, both of which yielded information of a political nature.
  • President Johnson asked the FBI to conduct "name checks" on his critics and members of the staff of his 1964 opponent, Senator Barry Goldwater. He also requested purely political intelligence on his critics in the Senate, and received extensive intelligence reports on political activity at the 1964 Democratic Convention from FBI electronic surveillance.
  • President Nixon authorized a program of wiretaps which produced for the White House purely political or personal information unrelated to national security, including information about a Supreme Court justice.

The Final Report (Book II) of the Church Committee revealed the following statistics:

  • Over 26,000 individuals were at one point catalogued on an FBI list of persons to be rounded up in the event of a "national emergency".
  • Over 500,000 domestic intelligence files were kept at the FBI headquarters, of which 65,000 were opened in 1972 alone.
  • At least 130,000 first class letters were opened and photographed by the FBI from 1940 to 1966.
  • A quarter of a million first class letters were opened and photographed by the CIA from 1953 to 1973.
  • Millions of private telegrams sent from, or to, through the United States were obtained by the National Security Agency (NSA), under a secret arrangement with U.S. telegraph companies, from 1947 to 1975.
  • Over 100,000 Americans have been indexed in U.S. Army intelligence files.
  • About 300,000 individuals were indexed in a CIA computer system during the course of Operation CHAOS.
  • Intelligence files on more than 11,000 individuals and groups were created by the Internal Revenue Service (IRS), with tax investigations "done on the basis of political rather than tax criteria".

In response to the committee's findings, the United States Congress passed the Foreign Intelligence Surveillance Act in 1978, which led to the establishment of the United States Foreign Intelligence Surveillance Court, which was authorized to issue surveillance warrants.

Several decades later in 2013, the presiding judge of the FISA Court, Reggie Walton, told The Washington Post that the court only has a limited ability to supervise the government's surveillance, and is therefore "forced" to rely upon the accuracy of the information that is provided by federal agents.

On August 17, 1975 Senator Frank Church stated on NBC's "Meet the Press" without mentioning the name of the NSA about this agency:

In the need to develop a capacity to know what potential enemies are doing, the United States government has perfected a technological capability that enables us to monitor the messages that go through the air. Now, that is necessary and important to the United States as we look abroad at enemies or potential enemies. We must know, at the same time, that capability at any time could be turned around on the American people, and no American would have any privacy left such is the capability to monitor everything — telephone conversations, telegrams, it doesn't matter. There would be no place to hide.

If this government ever became a tyrant, if a dictator ever took charge in this country, the technological capacity that the intelligence community has given the government could enable it to impose total tyranny, and there would be no way to fight back because the most careful effort to combine together in resistance to the government, no matter how privately it was done, is within the reach of the government to know. Such is the capability of this technology.

I don't want to see this country ever go across the bridge. I know the capacity that is there to make tyranny total in America, and we must see to it that this agency and all agencies that possess this technology operate within the law and under proper supervision so that we never cross over that abyss. That is the abyss from which there is no return.

ECHELON

In 1988 an article titled "Somebody's listening" by Duncan Campbell in the New Statesman described the signals-intelligence gathering activities of a program code-named "ECHELON". The program was engaged by English-speaking World War II Allied countries – Australia, Canada, New Zealand, the United Kingdom and the United States (collectively known as AUSCANNZUKUS). It was created by the five countries to monitor the military and diplomatic communications of the Soviet Union and of its Eastern Bloc allies during the Cold War in the early 1960s.

By the 1990s the ECHELON system could intercept satellite transmissions, public switched telephone network (PSTN) communications (including most Internet traffic), and transmissions carried by microwave. The New Zealand journalist Nicky Hager provided a detailed description of ECHELON in his 1996 book Secret Power. While some member governments denied the existence of ECHELON, a report by a committee of the European Parliament in 2001 confirmed the program's use and warned Europeans about its reach and effects. The European Parliament stated in its report that the term "ECHELON" occurred in a number of contexts, but that the evidence presented indicated it was a signals-intelligence collection system capable of interception and content-inspection of telephone calls, fax, e-mail and other data-traffic globally.

James Bamford further described the capabilities of ECHELON in Body of Secrets (2002) about the National Security Agency. Intelligence monitoring of citizens, and their communications, in the area covered by the AUSCANNZUKUS security agreement have, over the years, caused considerable public concern.

Escalation following September 11, 2001 attacks

We will come together to strengthen our intelligence capabilities to know the plans of terrorists before they act and to find them before they strike.

— President Bush speaking in Congress on September 20, 2001
The September 11 attacks on the World Trade Center and the Pentagon led to major reforms of U.S. intelligence agencies, and paved the way for the establishment of the Director of National Intelligence position.
On 1 January 2006, days after The New York Times wrote that "Bush Lets U.S. Spy on Callers Without Courts, the President emphasized that "This is a limited program designed to prevent attacks on the United States of America. And I repeat, limited."

In the aftermath of the September 2001 attacks on the World Trade Center and the Pentagon, bulk domestic spying in the United States increased dramatically. The desire to prevent future attacks of this scale led to the passage of the Patriot Act. Later acts include the Protect America Act (which removes the warrant requirement for government surveillance of foreign targets) and the FISA Amendments Act (which relaxed some of the original FISA court requirements).

In 2002, "Total Information Awareness" was established by the U.S. government in order to "revolutionize the ability of the United States to detect, classify and identify foreign terrorists".

In 2005, a report about President Bush's President's Surveillance Program appeared in The New York Times. According to reporters James Risen and Eric Lichtblau, the actual publication of their report was delayed for a year because "The White House asked The New York Times not to publish this article".

Also in 2005, the existence of STELLARWIND was revealed by Thomas Tamm. In 2006, Mark Klein revealed the existence of Room 641A that he had wired back in 2003. In 2008, Babak Pasdar, a computer security expert, and CEO of Bat Blue publicly revealed the existence of the "Quantico circuit", that he and his team found in 2003. He described it as a back door to the federal government in the systems of an unnamed wireless provider; the company was later independently identified as Verizon.

The NSA's database of American's phone calls was made public in 2006 by USA Today journalist Leslie Cauley in an article titled, "NSA has massive database of Americans' phone calls." The article cites anonymous sources that described the program's reach on American citizens:

... it means that the government has detailed records of calls they made — across town or across the country — to family members, co-workers, business contacts and others. The three telecommunications companies are working under contract with the NSA, which launched the program in 2001 shortly after the Sept. 11 terrorist attacks.

In 2009, The New York Times cited several anonymous intelligence officials alleging that "the N.S.A. made Americans targets in eavesdropping operations based on insufficient evidence tying them to terrorism" and "the N.S.A. tried to wiretap a member of Congress without a warrant".

Acceleration of media leaks (2010–present)

On 15 March 2012, the American magazine Wired published an article with the headline "The NSA Is Building the Country's Biggest Spy Center (Watch What You Say)", which was later mentioned by U.S. Rep. Hank Johnson during a congressional hearing. In response to Johnson's inquiry, NSA director Keith B. Alexander testified that these allegations made by Wired magazine were untrue:

Excerpt from Wired magazine's article originally published on 15 March 2012
NSA Director Keith Alexander's testimony to the United States Congress on 20 March 2012

2013 mass surveillance disclosures

Due to this central server and backbone monitoring, many of the programs overlap and interrelate among one another. These programs are often done with the assistance of US entities such as the United States Department of Justice and the FBI, are sanctioned by US laws such as the FISA Amendments Act, and the necessary court orders for them are signed by the secret Foreign Intelligence Surveillance Court. In addition to this, many of the NSA's programs are directly aided by national and foreign intelligence services, Britain's GCHQ and Australia's DSD, as well as by large private telecommunications and Internet corporations, such as Verizon, Telstra, Google and Facebook.

On 9 June 2013, Edward Snowden told The Guardian:

They (the NSA) can use the system to go back in time and scrutinize every decision you've ever made, every friend you've ever discussed something with, and attack you on that basis to sort of derive suspicion from an innocent life and paint anyone in the context of a wrongdoer.

— Edward Snowden

The US government has aggressively sought to dismiss and challenge Fourth Amendment cases raised: Hepting v. AT&T, Jewel v. NSA, Clapper v. Amnesty International, Al-Haramain Islamic Foundation v. Obama, and Center for Constitutional Rights v. Bush. The government has also granted retroactive immunity to ISPs and telecoms participating in domestic surveillance.

The US district court judge for the District of Columbia, Richard Leon, declared on December 16, 2013 that the mass collection of metadata of Americans' telephone records by the National Security Agency probably violates the Fourth Amendment prohibition of unreasonable searches and seizures.

Given the limited record before me at this point in the litigation – most notably, the utter lack of evidence that a terrorist attack has ever been prevented because searching the NSA database was faster than other investigative tactics – I have serious doubts about the efficacy of the metadata collection program as a means of conducting time-sensitive investigations in cases involving imminent threats of terrorism.

"Plaintiffs have a substantial likelihood of showing that their privacy interests outweigh the government's interest in collecting and analysing bulk telephony metadata and therefore the NSA's bulk collection program is indeed an unreasonable search under the fourth amendment," he wrote.

"The Fourth Amendment typically requires 'a neutral and detached authority be interposed between the police and the public,' and it is offended by 'general warrants' and laws that allow searches to be conducted 'indiscriminately and without regard to their connections with a crime under investigation,'" he wrote. He added:

I cannot imagine a more 'indiscriminate' and 'arbitrary invasion' than this systematic and high-tech collection and retention of personal data on virtually every single citizen for purposes of querying and analyzing it without prior judicial approval. Surely such a program infringes on 'that degree of privacy' that the founders enshrined in the Fourth Amendment. Indeed I have little doubt that the author of our Constitution, James Madison, who cautioned us to beware 'the abridgement of freedom of the people by gradual and silent encroachments by those in power,' would be aghast.

Leon granted the request for a preliminary injunction that blocks the collection of phone data for two private plaintiffs (Larry Klayman, a conservative lawyer, and Charles Strange, father of a cryptologist killed in Afghanistan when his helicopter was shot down in 2011) and ordered the government to destroy any of their records that have been gathered. But the judge stayed action on his ruling pending a government appeal, recognizing in his 68-page opinion the "significant national security interests at stake in this case and the novelty of the constitutional issues."

H.R.4681 – Intelligence Authorization Act for Fiscal Year 2015

On 20 May 2014, U.S. Representative for Michigan's 8th congressional district Republican congressman Mike Rogers introduced Intelligence Authorization Act for Fiscal Year 2015 with the goal of authorizing appropriations for fiscal years 2014 and 2015 for intelligence and intelligence-related activities of the United States Government, the Community Management Account, and the Central Intelligence Agency (CIA) Retirement and Disability System, and for other purposes.

Some of its measures cover the limitation on retention. A covered communication (meaning any nonpublic telephone or electronic communication acquired without the consent of a person who is a party to the communication, including communications in electronic storage) shall not be retained in excess of 5 years, unless: (i) the communication has been affirmatively determined, in whole or in part, to constitute foreign intelligence or counterintelligence or is necessary to understand or assess foreign intelligence or counterintelligence; (ii) the communication is reasonably believed to constitute evidence of a crime and is retained by a law enforcement agency; (iii) the communication is enciphered or reasonably believed to have a secret meaning; (iv) all parties to the communication are reasonably believed to be non-United States persons; (v) retention is necessary to protect against an imminent threat to human life, in which case both the nature of the threat and the information to be retained shall be reported to the congressional intelligence committees not later than 30 days after the date such retention is extended under this clause; (vi) retention is necessary for technical assurance or compliance purposes, including a court order or discovery obligation, in which case access to information retained for technical assurance or compliance purposes shall be reported to the congressional intelligence committees on an annual basis; (vii) retention for a period in excess of 5 years is approved by the head of the element of the intelligence community responsible for such retention, based on a determination that retention is necessary to protect the national security of the United States, in which case the head of such element shall provide to the congressional intelligence committees a written certification describing (I) the reasons extended retention is necessary to protect the national security of the United States; (II) the duration for which the head of the element is authorizing retention; (III) the particular information to be retained; and (IV) the measures the element of the intelligence community is taking to protect the privacy interests of United States persons or persons located inside the United States.

On 10 December 2014, Republican U.S. Representative for Michigan's 3rd congressional district member of Congress Justin Amash criticized the act on his Facebook as being "one of the most egregious sections of law I've encountered during my time as a representative" and "It grants the executive branch virtually unlimited access to the communications of every American".

USA Freedom Act

The USA Freedom Act was signed into law on June 2, 2015, the day after certain provisions of the Patriot Act had expired. It mandated an end to bulk collection of phone call metadata by the NSA within 180 days, but allowed continued mandatory retention of metadata by phone companies with access by the government with case-by-case approval from the Foreign Intelligence Surveillance Court.

Modalities, concepts, and methods

Official seal of the Information Awareness Office – a U.S. agency which developed technologies for mass surveillance

Logging postal mail

Under the Mail Isolation Control and Tracking program, the U.S. Postal Service photographs the exterior of every piece of paper mail that is processed in the United States — about 160 billion pieces in 2012. The U.S. Postmaster General stated that the system is primarily used for mail sorting, but the images are available for possible use by law enforcement agencies. Created in 2001 following the anthrax attacks that killed five people, it is a sweeping expansion of a 100-year-old program called "mail cover" which targets people suspected of crimes. Together, the two programs show that postal mail is subject to the same kind of scrutiny that the National Security Agency gives to telephone calls, e-mail, and other forms of electronic communication.

Mail cover surveillance requests are granted for about 30 days, and can be extended for up to 120 days. Images captured under the Mail Isolation Control and Tracking program are retained for a week to 30 days and then destroyed. There are two kinds of mail covers: those related to criminal activity and those requested to protect national security. Criminal activity requests average 15,000 to 20,000 per year, while the number of requests for national security mail covers has not been made public. Neither the Mail Isolation Control and Tracking program nor the mail cover program require prior approval by a judge. For both programs the information gathered is metadata from the outside of the envelope or package for which courts have said there is no expectation of privacy. Opening the mail to view its contents would require a warrant approved by a judge.

Wiretapping

Billions of dollars per year are spent, by agencies such as the Information Awareness Office, National Security Agency, and the Federal Bureau of Investigation, to develop, purchase, implement, and operate systems such as Carnivore, ECHELON, and NarusInsight to intercept and analyze the immense amount of data that traverses the Internet and telephone system every day.

The Total Information Awareness program, of the Information Awareness Office, was formed in 2002 by the Pentagon and led by former rear admiral John Poindexter. The program designed numerous technologies to be used to perform mass surveillance. Examples include advanced speech-to-text programs (so that phone conversations can be monitored en-masse by a computer, instead of requiring human operators to listen to them), social network analysis software to monitor groups of people and their interactions with each other, and "Human identification at a distance" software which allows computers to identify people on surveillance cameras by their facial features and gait (the way they walk). The program was later renamed "Terrorism Information Awareness", after a negative public reaction.

Legal foundations

The Communications Assistance for Law Enforcement Act (CALEA), passed in 1994, requires that all U.S. telecommunications companies modify their equipment to allow easy wiretapping of telephone, VoIP, and broadband Internet traffic.

In 1999 two models of mandatory data retention were suggested for the US. The first model would record the IP address assigned to a customer at a specific time. In the second model, "which is closer to what Europe adopted", telephone numbers dialed, contents of Web pages visited, and recipients of e-mail messages must be retained by the ISP for an unspecified amount of time. In 2006 the International Association of Chiefs of Police adopted a resolution calling for a "uniform data retention mandate" for "customer subscriber information and source and destination information." The U.S. Department of Justice announced in 2011 that criminal investigations "are being frustrated" because no law currently exists to force Internet providers to keep track of what their customers are doing.

The Electronic Frontier Foundation has an ongoing lawsuit (Hepting v. AT&T) against the telecom giant AT&T Inc. for its assistance to the U.S. government in monitoring the communications of millions of American citizens. It has managed thus far to keep the proceedings open. Recently the documents, which were exposed by a whistleblower who had previously worked for AT&T, and showed schematics of the massive data mining system, were made public.

Internet communications

The FBI developed the computer programs "Magic Lantern" and CIPAV, which it can remotely install on a computer system, in order to monitor a person's computer activity.

The NSA has been gathering information on financial records, Internet surfing habits, and monitoring e-mails. It has also performed extensive surveillance on social networks such as Facebook. Recently, Facebook has revealed that, in the last six months of 2012, they handed over the private data of between 18,000 and 19,000 users to law enforcement of all types—including local police and federal agencies, such as the FBI, Federal Marshals and the NSA. One form of wiretapping utilized by the NSA is RADON, a bi-directional host tap that can inject Ethernet packets onto the same target. It allows bi-directional exploitation of Denied networks using standard on-net tools. The one limitation of RADON is that it is a USB device that requires a physical connection to a laptop or PC to work. RADON was created by a Massachusetts firm called Netragard. Their founder, Adriel Desautels, said about RADON, "it is our 'safe' malware. RADON is designed to enable us to infect customer systems in a safe and controllable manner. Safe means that every strand is built with an expiration date that, when reached, results in RADON performing an automatic and clean self-removal."

The NSA is also known to have splitter sites in the United States. Splitter sites are places where a copy of every packet is directed to a secret room where it is analyzed by the Narus STA 6400, a deep packet inspection device. Although the only known location is at 611 Folsom Street, San Francisco, California, expert analysis of Internet traffic suggests that there are likely several locations throughout the United States.

Advertising data

In September 2022 the EFF and AP revealed their investigation into the use of advertising IDs to develop the Fog Reveal database. Fog Reveal aggregates location data from mobile applications, which is then supplied as a service to United States law enforcement agencies.

Intelligence apparatus to monitor Americans

Since the September 11 attacks, a vast domestic intelligence apparatus has been built to collect information using FBI, local police, state homeland security offices and military criminal investigators. The intelligence apparatus collects, analyzes and stores information about millions of (if not all) American citizens, most of whom have not been accused of any wrongdoing. Every state and local law enforcement agency is to feed information to federal authorities to support the work of the FBI.

The PRISM special source operation system was enabled by the Protect America Act of 2007 under President Bush and the FISA Amendments Act of 2008, which legally immunized private companies that cooperated voluntarily with US intelligence collection and was renewed by Congress under President Obama in 2012 for five years until December 2017. According to The Register, the FISA Amendments Act of 2008 "specifically authorizes intelligence agencies to monitor the phone, email, and other communications of U.S. citizens for up to a week without obtaining a warrant" when one of the parties is outside the U.S.

PRISM was first publicly revealed on 6 June 2013, after classified documents about the program were leaked to The Washington Post and The Guardian by Edward Snowden.

Telephones

In early 2006, USA Today reported that several major telephone companies were cooperating illegally with the National Security Agency to monitor the phone records of U.S. citizens, and storing them in a large database known as the NSA call database. This report came on the heels of allegations that the U.S. government had been conducting electronic surveillance of domestic telephone calls without warrants.

Law enforcement and intelligence services in the United States possess technology to remotely activate the microphones in cell phones in order to listen to conversations that take place nearby the person who holds the phone.

U.S. federal agents regularly use mobile phones to collect location data. The geographical location of a mobile phone (and thus the person carrying it) can be determined easily (whether it is being used or not), using a technique known multilateration to calculate the differences in time for a signal to travel from the cell phone to each of several cell towers near the owner of the phone.

In 2013, the existence of the Hemisphere Project, through which AT&T provides call detail records to government agencies, became publicly known.

Infiltration of smartphones

As worldwide sales of smartphones began exceeding those of feature phones, the NSA decided to take advantage of the smartphone boom. This is particularly advantageous because the smartphone combines a myriad of data that would interest an intelligence agency, such as social contacts, user behavior, interests, location, photos and credit card numbers and passwords.

An internal NSA report from 2010 stated that the spread of the smartphone has been occurring "extremely rapidly"—developments that "certainly complicate traditional target analysis." According to the document, the NSA has set up task forces assigned to several smartphone manufacturers and operating systems, including Apple Inc.'s iPhone and iOS operating system, as well as Google's Android mobile operating system. Similarly, Britain's GCHQ assigned a team to study and crack the BlackBerry.

Under the heading "iPhone capability", the document notes that there are smaller NSA programs, known as "scripts", that can perform surveillance on 38 different features of the iPhone 3 and iPhone 4 operating systems. These include the mapping feature, voicemail and photos, as well as Google Earth, Facebook and Yahoo! Messenger.

Data mining of subpoenaed records

The FBI collected nearly all hotel, airline, rental car, gift shop, and casino records in Las Vegas during the last two weeks of 2003. The FBI requested all electronic data of hundreds of thousands of people based on a very general lead for the Las Vegas New Year's celebration. The Senior VP of The Mirage went on record with PBS' Frontline describing the first time they were requested to help in the mass collection of personal information.

Surveillance cameras

Wide Area Persistent Surveillance (also Wide Area Motion Imaging) is a form of airborne surveillance system that collects pattern-of-life data by recording motion images of an area larger than a city – in sub-meter resolution. This video allows for anyone within the field of regard to be tracked – both live and retroactively, for forensic analysis. The use of sophisticated tracking algorithms applied to the WAMI dataset also enables mass automated geo-location tracking of every vehicle and pedestrian. WAMI sensors are typically mounted on manned airplanes, drones, blimps and aerostats. WAMI is currently in use on the southern border of the US and has been deployed in Baltimore, Dayton Ohio as well as in Los Angeles, specifically targeting Compton. Wide Area Persistent Surveillance systems such as ARGUS WAMI are capable of live viewing and recording a 68 square mile area with enough detail to view pedestrians and vehicles and generate chronographs. These WAMI cameras, such as Gorgon Stare, Angelfire, Hiper Stare, Hawkeye and ARGUS, create airborne video so detailed that pedestrians can be followed across the city through forensic analysis. This allows investigators to rewind and playback the movements of anyone within this 68 square mile area for hours, days or even months at a time depending on the airframe the WAMI sensors are mounted on. JLENS, a surveillance aerostat scheduled for deployment over the east coast of the US, is a form of WAMI that uses sophisticated radar imaging along with electro-optical WAMI sensors to enable mass geo-location tracking of ground vehicles.

While a resistance to the domestic deployment of WAMI has emerged in areas where the public has learned of the technologies use, the deployments have been intentionally hidden from the public, as in Compton California, where the mayor learned about the surveillance from groups like the American Civil Liberties Union, Teame Zazzu and the Center for Investigative Reporting.

PeSEAS and PerMIATE software automate and record the movement observed in the WAMI video. This technology uses software to track and record the movements of pedestrians and vehicles using automatic object recognition software across the entire frame, generating "tracklets" or chronographs of every car and pedestrian movements. 24/7 deployment of this technology has been suggested by the DHS on spy blimps such as the recently killed Blue Devil Airship.

Traffic cameras, which were meant to help enforce traffic laws at intersections, have also sparked some controversy, due to their use by law enforcement agencies for purposes unrelated to traffic violations. These cameras also work as transit choke-points that allow individuals inside the vehicle to be positively identified and license plate data to be collected and time stamped for cross reference with airborne WAMI such as ARGUS and HAWKEYE used by police and Law Enforcement.

The Department of Homeland Security is funding networks of surveillance cameras in cities and towns as part of its efforts to combat terrorism. In February 2009, Cambridge, MA rejected the cameras due to privacy concerns.

In July 2020, the Electronic Frontier Foundation (EFF) reported that the San Francisco Police Department (SFPD) used a camera network in the city's Business Improvement District amid protests against police violence. The report claims that the SFPD's usage of the camera network went beyond investigating footage, likening the department's access to real-time video feeds as "indiscriminate surveillance of protestors."

Surveillance drones

On 19 June 2013, FBI Director Robert Mueller told the United States Senate Committee on the Judiciary that the federal government had been employing surveillance drones on U.S. soil in "particular incidents". According to Mueller, the FBI is currently in the initial stage of developing drone policies.

Earlier in 2012, Congress passed a US$63 billion bill that will grant four years of additional funding to the Federal Aviation Administration (FAA). Under the bill, the FAA is required to provide military and commercial drones with expanded access to U.S. airspace by October 2015.

In February 2013, a spokesman for the Los Angeles Police Department explained that these drones would initially be deployed in large public gatherings, including major protests. Over time, tiny drones would be used to fly inside buildings to track down suspects and assist in investigations. According to The Los Angeles Times, the main advantage of using drones is that they offer "unblinking eye-in-the-sky coverage". They can be modified to carry high-resolution video cameras, infrared sensors, license plate readers, listening devices, and be disguised as sea gulls or other birds to mask themselves.

The FBI and Customs and Border Protection have used drones for surveillance of protests by the Black Lives Matter movement.

Infiltration of activist groups

In 2003, consent decrees against surveillance around the country were lifted, with the assistance of the Justice Department.

The New York City Police Department infiltrated and compiled dossiers on protest groups before the 2004 Republican National Convention, leading to over 1,800 arrests and subsequent fingerprinting.

In 2008, Maryland State Police infiltrated local peace groups.

In 2013, a Washington, D.C. undercover cop infiltrated peace groups.

The Intercept claimed that in 2020, the FBI paid an informant to pose as organizer in Denver, Colorado during the George Floyd protests. This informant particularly infiltrated and undermined protest movements by accusing other genuine activists of being FBI informants.

International cooperation

The "five eyes" of Australia, Canada, New Zealand, the United Kingdom and the United States

During World War II, the BRUSA Agreement was signed by the governments of the United States and the United Kingdom for the purpose of intelligence sharing. This was later formalized in the UKUSA Agreement of 1946 as a secret treaty. The full text of the agreement was released to the public on 25 June 2010.

Although the treaty was later revised to include other countries such as Denmark, Germany, Ireland, Norway, Turkey, and the Philippines, most of the information sharing is performed by the so-called "Five Eyes", a term referring to the following English-speaking western democracies and their respective intelligence agencies:

In 2013, media disclosures revealed how other government agencies have cooperated extensively with the "Five Eyes":

  • Denmark – The Politiets Efterretningstjeneste (PET) of Denmark, a domestic intelligence agency, exchanges data with the NSA on a regular basis, as part of a secret agreement with the United States.
  • Germany – The Bundesnachrichtendienst (Federal Intelligence Service) of Germany systematically transfers metadata from German intelligence sources to the NSA. In December 2012 alone, Germany provided the NSA with 500 million metadata records. The NSA granted the Bundesnachrichtendienst access to X-Keyscore, in exchange for Mira4 and Veras. In early 2013, Hans-Georg Maaßen, President of the German domestic security agency BfV, made several visits to the headquarters of the NSA. According to classified documents of the German government, Maaßen had agreed to transfer all data collected by the BfV via XKeyscore to the NSA. In addition, the BfV has been working very closely with eight other U.S. government agencies, including the CIA.
  • Israel – The SIGINT National Unit of Israel routinely receives raw intelligence data (including those of U.S. citizens) from the NSA. (See also: Memorandum of understanding between the NSA and Israel)
  • Netherlands – The Algemene Inlichtingen en Veiligheidsdienst (General Intelligence and Security Service) of the Netherlands has been receiving and storing user information gathered by U.S. intelligence sources such as PRISM.
  • Singapore – The Defence Ministry of Singapore and its Security and Intelligence Division have been secretly intercepting much of the fibre optic cable traffic passing through the Asian continent. Information gathered by the Government of Singapore is transferred to the Government of Australia as part of an intelligence sharing agreement. This allows the "Five Eyes" to maintain a "stranglehold on communications across the Eastern Hemisphere".
  • Sweden – The National Defence Radio Establishment of Sweden (codenamed Sardines) has been working extensively with the NSA, and it has granted the "five eyes" access to underwater cables in the Baltic Sea.
  • Switzerland – The Federal Intelligence Service (FSI) of Switzerland regularly exchanges information with the NSA, based on a secret agreement. In addition, the NSA has been granted access to Swiss monitoring facilities in Leuk (canton of Valais) and Herrenschwanden (canton of Bern).
Top secret documents leaked by Edward Snowden revealed that the "Five Eyes" have gained access to the majority of Internet and telephone communications flowing throughout Europe, the United States, and other parts of the world.
Left: SEA-ME-WE 3, which runs across the Afro-Eurasian supercontinent from Japan to Northern Germany, is one of the most important submarine cables accessed by the "Five Eyes". Singapore, a former British colony in the Asia-Pacific region (blue dot), plays a vital role in intercepting Internet and telecommunications traffic heading from Australia/Japan to Europe, and vice versa. An intelligence sharing agreement between Singapore and Australia allows the rest of the "Five Eyes" to gain access to SEA-ME-WE 3.
Right:TAT-14, a telecommunications cable linking Europe with the United States, was identified as one of few assets of "Critical Infrastructure and Key Resources" of the USA on foreign territory. In 2013, it was revealed that British officials "pressured a handful of telecommunications and internet companies" to allow the British government to gain access to TAT-14.

Aside from the "Five Eyes", most other Western countries are also participating in the NSA surveillance system and sharing information with each other. However, being a partner of the NSA does not automatically exempt a country from being targeted by the NSA. According to an internal NSA document leaked by Snowden, "We (the NSA) can, and often do, target the signals of most 3rd party foreign partners."

Examples of members of the "Five Eyes" spying for each other:

Uses of intercepted data

Most of the NSA's collected data which was seen by human eyes (i.e., used by NSA operatives) was used in accordance with the stated objective of combating terrorism.

In addition to combatting terrorism, these surveillance programs have been employed to assess the foreign policy and economic stability of other countries.

According to reports by Brazil's O Globo newspaper, the collected data was also used to target "commercial secrets". In a statement addressed to the National Congress of Brazil, journalist Glenn Greenwald testified that the U.S. government uses counter-terrorism as a "pretext" for clandestine surveillance in order to compete with other countries in the "business, industrial and economic fields".

In an interview with Der Spiegel published on 12 August 2013, former NSA Director Michael Hayden admitted that "We [the NSA] steal secrets. We're number one in it". Hayden also added that "We steal stuff to make you safe, not to make you rich".

According to documents seen by the news agency Reuters, information obtained in this way is subsequently funnelled to authorities across the nation to help them launch criminal investigations of Americans. Federal agents are then instructed to "recreate" the investigative trail in order to "cover up" where the information originated, known as parallel construction. (Were the true origins known, the evidence and resulting case might be invalidated as "fruit of the poisonous tree", a legal doctrine designed to deter abuse of power that prevents evidence or subsequent events being used in a case if they resulted from a search or other process that does not conform to legal requirements.)

According to NSA Chief Compliance Officer John DeLong, most violations of the NSA's rules were self-reported, and most often involved spying on personal love interests using surveillance technology of the agency.

Most agricultural surveillance is not covert and is carried out by government agencies such as APHIS (USDA's Animal and Plant Health Inspection Service). DHS has lamented the limited surveillance coverage provided by these inspections and works to augment this protection with their own resources.

Workplace health surveillance

From Wikipedia, the free encyclopedia

Workplace health surveillance or occupational health surveillance (U.S.) is the ongoing systematic collection, analysis, and dissemination of exposure and health data on groups of workers. The Joint ILO/WHO Committee on Occupational Health at its 12th Session in 1995 defined an occupational health surveillance system as "a system which includes a functional capacity for data collection, analysis and dissemination linked to occupational health programmes".

The concept is new to occupational health and is frequently confused with medical screening. Health screening refers to the early detection and treatment of diseases associated with particular occupations, while workplace health surveillance refers to the removal of the causative factors.

Aspects

Medical surveillance

The mission of a medical surveillance program is to keep workers healthy and ensure that employers are meeting OSHA standards in health and safety. Medical surveillance has an emphasis on prevention: it is designed to detect potential workplace hazards before irreversible health effects can occur. Clinicians with expertise in occupational health, industrial exposures, and respiratory protection screen workers with physical examinations, blood testing, spirometry (a measurement lung function), and audiometry. Screenings are performed at set intervals, often annually. The clinicians providing medical surveillance services include board-certified occupational and environmental medicine physicians, mid-level practitioners, nurses, and NIOSH-certified spirometry technicians.

Medical surveillance targets actual health events or a change in a biologic function of an exposed person or persons. Medical surveillance is a second line of defense behind the implementation of direct hazard controls such as engineering controls, administrative controls, and personal protective equipment. NIOSH recommends the medical surveillance of workers when they are exposed to hazardous materials. The elements of a medical surveillance program generally include the following:

  1. An initial medical examination and collection of medical and occupational histories
  2. Periodic medical examinations at regularly scheduled intervals, including specific medical screening tests when warranted
  3. More frequent and detailed medical examinations as indicated on the basis of findings from these examinations
  4. Post-incident examinations and medical screening following uncontrolled or non-routine increases in exposures such as spills
  5. Worker training to recognize symptoms of exposure to a given hazard
  6. A written report of medical findings
  7. Employer actions in response to identification of potential hazards

When the purpose of a medical surveillance program is to detect early signs of work-related illness and disease, it is considered a type of medical screening, to detect preclinical changes in organ function or changes before a person would normally seek medical care and when intervention is beneficial The establishment of a medical screening program should follow established criteria, and specific disease endpoints must be able to be determined by the test selected.

Medical examinations and tests are used in many workplaces to determine whether an employee is able to perform the essential functions of the job. Medical surveillance of workers is also required by law in the United States when there is exposure to a specific workplace hazard, and OSHA has a number of standards that require medical surveillance of workers In addition to substance-specific standards, OSHA has standards with broader applicability. For example, employers must follow the medical evaluation requirements of OSHA's respiratory protection standard (29 CFR 1910.134) when respirators are necessary to protect worker health. Likewise, the OSHA standard for occupational exposure to hazardous chemicals in laboratories (29 CFR 1910.1450) requires medical consultation following the accidental release of hazardous chemicals. NIOSH also recommends medical surveillance, including screening, of workers when there is exposure to certain occupational hazards.

Hazard surveillance

Hazard surveillance involves identifying potentially hazardous practices or exposures in the workplace and assessing the extent to which they can be linked to workers, the effectiveness of controls, and the reliability of exposure measures. Workplace hazards can be chemical, biological, physical, ergonomic, psychosocial, or safety-related in nature. Hazard surveillance is an essential component of any occupational health surveillance effort and is used for defining the elements of the risk management program. Critical elements of a risk management program include recognizing potential exposures and taking appropriate actions to minimize them (for example, implementing engineering controls, employing good work practices, and using personal protective equipment). Hazard surveillance should include the identification of work tasks and processes that involve the production and use of hazardous materials, and should be viewed as one of the most critical components of any risk management program.

Hazard surveillance includes elements of hazard and exposure assessment. The hazard assessment involves reviewing the best available information concerning toxicity of materials. Such an assessment may come from databases, texts, and published literature or available regulations or guidelines. Human studies, such as epidemiologic investigations and case series or reports, and animal studies may also provide valuable information. The exposure assessment involves evaluating relevant exposure routes (inhalation, ingestion, dermal, and/or injection), amount, duration, and frequency (i.e., dose), as well as whether exposure controls are in place and how protective they are. When data are not available, this will be a qualitative process.

Occupational Health Indicators (OHIs)

In 1998, the Council of State and Territorial Epidemiologists (CSTE) joined the CDC's National Institute for Occupational Safety and Health (NIOSH) to form the Occupational Health Surveillance Work Group in order to prioritize occupational health conditions to be placed under surveillance. The Work Group recommended that states use 19 occupational health indicators based on the availability of easily obtainable statewide data, the public health importance of the occupational health effect or exposure, and the potential for intervention activities.

These indicators are useful in assessing the ongoing policies and preventive measures but they also have some limitations. Among the major limitations are the underreporting of occupational health disorders, the inability to recognize potential occupational association of the disorder by health care workers, difficulties in attributing diseases with long latency or multiple causes (such as lung cancer) to occupational exposures, exclusion of special populations (such as self-employed or military personnel), and differences between state-specific databases.

Data Sources

Data for the OHIs come from multiple sources including:

Tools

The usefulness of a surveillance tool may depend on what hazards are present in the workplace and the health effects those hazards may cause. For example, hearing tests will be helpful when noise exposures are present, while tests assessing lung function or biomonitoring may be useful when airborne agents are present. It is also important to distinguish between tools using medical surveillance (measuring health effects) and hazard surveillance/exposure assessment (physical measurements of the type and severity of hazard present). Periodic testing, including a baseline exam when an employee is hired, can often help detect a decline in function by comparing previous results.

Hearing exam

Medical surveillance tools

  • General
  • Chemical or particulate exposures
    • Pulmonary function testing is a way to measure lung function. It can assist in the early detection of occupational lung diseases and provides information about the severity and staging of asthma and other restrictive lung diseases.
      • Spirometry tests measure how quickly air can be pushed out from the lungs and is useful in evaluating diseases that cause obstruction to flow.
      • Plethysmography measures lung volume by having the subject perform breathing tests inside of an air tight box.
      • Flow rates can be measured by asking subjects to blow air out of the lungs as fast and as hard as possible from their largest inhaled breathe (inspiration) to the maximum exhaled breathe (expiration). The volume exhaled in the first second is called the forced expiratory volume in one second (FEV1). These flow rates can be indicators of disease that cause obstruction to airflow, such as asthma, chronic bronchitis, and emphysema.
    • Biomonitoring measures total body burden of a hazardous chemical in a worker via analysis of biological specimens such as urine or blood. Non-invasive procedures are preferred when possible.
  • Noise exposures
  • Other
    • Hand arm assessment (vibration) and dermatological assessments (chemical) are other important tools for workplace health surveillance.

Confidentiality of information

Most countries have specific regulations for individual health data, which require that the worker be informed if this information is ever shared with any third party. Occupational Health Records (OHR) have the same protections as any medical record that has confidential health information. Employers must store OHR in a secured area free from unauthorized access, use, or disclosure. Workers should have the right to access this information whenever they wish.

Spyware

From Wikipedia, the free encyclopedia
https://en.wikipedia.org/wiki/Spyware

Spyware (a portmanteau for spying software) is any software with malicious behavior that aims to gather information about a person or organization and send it to another entity in a way that harms the user by violating their privacy, endangering their device's security, or other means. This behavior may be present in malware and in legitimate software. Websites may engage in spyware behaviors like web tracking. Hardware devices may also be affected.

Spyware is frequently associated with advertising and involves many of the same issues. Because these behaviors are so common, and can have non-harmful uses, providing a precise definition of spyware is a difficult task.

History

The first recorded use of the term spyware occurred on October 16, 1995 in a Usenet post that poked fun at Microsoft's business model. Spyware at first denoted software meant for espionage purposes. However, in early 2000 the founder of Zone Labs, Gregor Freund, used the term in a press release for the ZoneAlarm Personal Firewall. Later in 2000, a parent using ZoneAlarm was alerted to the fact that Reader Rabbit, educational software marketed to children by the Mattel toy company, was surreptitiously sending data back to Mattel. Since then, "spyware" has taken on its present sense.

According to a 2005 study by AOL and the National Cyber-Security Alliance, 61 percent of surveyed users' computers were infected with some form of spyware. 92 percent of surveyed users with spyware reported that they did not know of its presence, and 91 percent reported that they had not given permission for the installation of the spyware. As of 2006, spyware has become one of the preeminent security threats to computer systems running Microsoft Windows operating systems. Computers on which Internet Explorer (IE) was the primary browser are particularly vulnerable to such attacks, not only because IE was the most widely used, but also because its tight integration with Windows allows spyware access to crucial parts of the operating system.

Before Internet Explorer 6 SP2 was released as part of Windows XP Service Pack 2, the browser would automatically display an installation window for any ActiveX component that a website wanted to install. The combination of user ignorance about these changes, and the assumption by Internet Explorer that all ActiveX components are benign, helped to spread spyware significantly. Many spyware components would also make use of exploits in JavaScript, Internet Explorer and Windows to install without user knowledge or permission.

The Windows Registry contains multiple sections where modification of key values allows software to be executed automatically when the operating system boots. Spyware can exploit this design to circumvent attempts at removal. The spyware typically links itself to each location in the registry that allows execution. Once running, the spyware will periodically check if any of these links are removed. If so, they will be automatically restored. This ensures that the spyware will execute when the operating system is booted, even if some (or most) of the registry links are removed.

Overview

Spyware is mostly classified into four types: adware, system monitors, tracking including web tracking, and trojans; examples of other notorious types include digital rights management capabilities that "phone home", keyloggers, rootkits, and web beacons. These four categories are not mutually exclusive and they have similar tactics in attacking networks and devices. The main goal is to install, hack into the network, avoid being detected, and safely remove themselves from the network.

Spyware is mostly used for the stealing information and storing Internet users' movements on the Web and serving up pop-up ads to Internet users. Whenever spyware is used for malicious purposes, its presence is typically hidden from the user and can be difficult to detect. Some spyware, such as keyloggers, may be installed by the owner of a shared, corporate, or public computer intentionally in order to monitor users.

While the term spyware suggests software that monitors a user's computer, the functions of spyware can extend beyond simple monitoring. Spyware can collect almost any type of data, including personal information like internet surfing habits, user logins, and bank or credit account information. Spyware can also interfere with a user's control of a computer by installing additional software or redirecting web browsers. Some spyware can change computer settings, which can result in slow Internet connection speeds, un-authorized changes in browser settings, or changes to software settings.

Sometimes, spyware is included along with genuine software, and may come from a malicious website or may have been added to the intentional functionality of genuine software (see the paragraph about Facebook, below). In response to the emergence of spyware, a small industry has sprung up dealing in anti-spyware software. Running anti-spyware software has become a widely recognized element of computer security practices, especially for computers running Microsoft Windows. A number of jurisdictions have passed anti-spyware laws, which usually target any software that is surreptitiously installed to control a user's computer.

In German-speaking countries, spyware used or made by the government is called govware by computer experts (in common parlance: Regierungstrojaner, literally "Government Trojan"). Govware is typically a trojan horse software used to intercept communications from the target computer. Some countries, like Switzerland and Germany, have a legal framework governing the use of such software. In the US, the term "policeware" has been used for similar purposes.

Use of the term "spyware" has eventually declined as the practice of tracking users has been pushed ever further into the mainstream by major websites and data mining companies; these generally break no known laws and compel users to be tracked, not by fraudulent practices per se, but by the default settings created for users and the language of terms-of-service agreements.

In one documented example, on CBS/CNet News reported, on March 7, 2011, an analysis in The Wall Street Journal revealed the practice of Facebook and other websites of tracking users' browsing activity, which is linked to their identity, far beyond users' visits and activity on the Facebook site itself. The report stated: "Here's how it works. You go to Facebook, you log in, you spend some time there, and then ... you move on without logging out. Let's say the next site you go to is The New York Times. Those buttons, without you clicking on them, have just reported back to Facebook and Twitter that you went there and also your identity within those accounts. Let's say you moved on to something like a site about depression. This one also has a tweet button, a Google widget, and those, too, can report back who you are and that you went there." The Wall Street Journal analysis was researched by Brian Kennish, founder of Disconnect, Inc.

Routes of infection

Spyware does not necessarily spread in the same way as a virus or worm because infected systems generally do not attempt to transmit or copy the software to other computers. Instead, spyware installs itself on a system by deceiving the user or by exploiting software vulnerabilities.

Most spyware is installed without knowledge, or by using deceptive tactics. Spyware may try to deceive users by bundling itself with desirable software. Other common tactics are using a Trojan horse, spy gadgets that look like normal devices but turn out to be something else, such as a USB Keylogger. These devices actually are connected to the device as memory units but are capable of recording each stroke made on the keyboard. Some spyware authors infect a system through security holes in the Web browser or in other software. When the user navigates to a Web page controlled by the spyware author, the page contains code which attacks the browser and forces the download and installation of spyware.

The installation of spyware frequently involves Internet Explorer. Its popularity and history of security issues have made it a frequent target. Its deep integration with the Windows environment make it susceptible to attack into the Windows operating system. Internet Explorer also serves as a point of attachment for spyware in the form of Browser Helper Objects, which modify the browser's behaviour.

Effects and behaviors

A spyware rarely operates alone on a computer; an affected machine usually has multiple infections. Users frequently notice unwanted behavior and degradation of system performance. A spyware infestation can create significant unwanted CPU activity, disk usage, and network traffic. Stability issues, such as applications freezing, failure to boot, and system-wide crashes are also common. Usually, this effect is intentional, but may be caused from the malware simply requiring large amounts of computing power, disk space, or network usage. Spyware, which interferes with networking software commonly causes difficulty connecting to the Internet.

In some infections, the spyware is not even evident. Users assume in those situations that the performance issues relate to faulty hardware, Windows installation problems, or another malware infection. Some owners of badly infected systems resort to contacting technical support experts, or even buying a new computer because the existing system "has become too slow". Badly infected systems may require a clean reinstallation of all their software in order to return to full functionality.

Moreover, some types of spyware disable software firewalls and antivirus software, and/or reduce browser security settings, which opens the system to further opportunistic infections. Some spyware disables or even removes competing spyware programs, on the grounds that more spyware-related annoyances increase the likelihood that users will take action to remove the programs.

Keyloggers are sometimes part of malware packages downloaded onto computers without the owners' knowledge. Some keylogger software is freely available on the internet, while others are commercial or private applications. Most keyloggers allow not only keyboard keystrokes to be captured, they also are often capable of collecting screen captures from the computer.

A typical Windows user has administrative privileges, mostly for convenience. Because of this, any program the user runs has unrestricted access to the system. As with other operating systems, Windows users are able to follow the principle of least privilege and use non-administrator accounts. Alternatively, they can reduce the privileges of specific vulnerable Internet-facing processes, such as Internet Explorer.

Since Windows Vista is, by default, a computer administrator that runs everything under limited user privileges, when a program requires administrative privileges, a User Account Control pop-up will prompt the user to allow or deny the action. This improves on the design used by previous versions of Windows. Spyware is also known as tracking software.

Remedies and prevention

As the spyware threat has evolved, a number of techniques have emerged to counteract it. These include programs designed to remove or block spyware, as well as various user practices which reduce the chance of getting spyware on a system.

Nonetheless, spyware remains a costly problem. When a large number of pieces of spyware have infected a Windows computer, the only remedy may involve backing up user data, and fully reinstalling the operating system. For instance, some spyware cannot be completely removed by Symantec, Microsoft, PC Tools.

Anti-spyware programs

Many programmers and some commercial firms have released products designed to remove or block spyware. Programs such as PC Tools' Spyware Doctor, Lavasoft's Ad-Aware SE and Patrick Kolla's Spybot - Search & Destroy rapidly gained popularity as tools to remove, and in some cases intercept, spyware programs. On December, 2004, Microsoft acquired the GIANT AntiSpyware software, re‑branding it as Microsoft AntiSpyware (Beta 1) and releasing it as a free download for Genuine Windows XP and Windows 2003 users. In November, 2005, it was renamed Windows Defender.

Major anti-virus firms such as Symantec, PC Tools, McAfee and Sophos have also added anti-spyware features to their existing anti-virus products. Early on, anti-virus firms expressed reluctance to add anti-spyware functions, citing lawsuits brought by spyware authors against the authors of web sites and programs which described their products as "spyware". However, recent versions of these major firms home and business anti-virus products do include anti-spyware functions, albeit treated differently from viruses. Symantec Anti-Virus, for instance, categorizes spyware programs as "extended threats" and now offers real-time protection against these threats.

Other Anti-spyware tools include FlexiSPY, Mobilespy, mSPY, TheWiSPY, and UMobix.

How anti-spyware software works

Anti-spyware programs can combat spyware in two ways:

  1. They can provide real-time protection in a manner similar to that of anti-virus protection: all incoming network data is scanned for spyware, and any detected threats are blocked.
  2. Anti-spyware software programs can be used solely for detection and removal of spyware software that has already been installed into the computer. This kind of anti-spyware can often be set to scan on a regular schedule.

Such programs inspect the contents of the Windows registry, operating system files, and installed programs, and remove files and entries which match a list of known spyware. Real-time protection from spyware works identically to real-time anti-virus protection: the software scans disk files at download time, and blocks the activity of components known to represent spyware. In some cases, it may also intercept attempts to install start-up items or to modify browser settings. Earlier versions of anti-spyware programs focused chiefly on detection and removal. Javacool Software's SpywareBlaster, one of the first to offer real-time protection, blocked the installation of ActiveX-based spyware.

Like most anti-virus software, many anti-spyware/adware tools require a frequently updated database of threats. As new spyware programs are released, anti-spyware developers discover and evaluate them, adding to the list of known spyware, which allows the software to detect and remove new spyware. As a result, anti-spyware software is of limited usefulness without regular updates. Updates may be installed automatically or manually.

A popular generic spyware removal tool used by those that requires a certain degree of expertise is HijackThis, which scans certain areas of the Windows OS where spyware often resides and presents a list with items to delete manually. As most of the items are legitimate windows files/registry entries it is advised for those who are less knowledgeable on this subject to post a HijackThis log on the numerous antispyware sites and let the experts decide what to delete.

If a spyware program is not blocked and manages to get itself installed, it may resist attempts to terminate or uninstall it. Some programs work in pairs: when an anti-spyware scanner (or the user) terminates one running process, the other one respawns the killed program. Likewise, some spyware will detect attempts to remove registry keys and immediately add them again. Usually, booting the infected computer in safe mode allows an anti-spyware program a better chance of removing persistent spyware. Killing the process tree may also work.

Security practices

To detect spyware, computer users have found several practices useful in addition to installing anti-spyware programs. Many users have installed a web browser other than Internet Explorer, such as Mozilla Firefox or Google Chrome. Though no browser is completely safe, Internet Explorer was once at a greater risk for spyware infection due to its large user base as well as vulnerabilities such as ActiveX but these three major browsers are now close to equivalent when it comes to security.

Some ISPs—particularly colleges and universities—have taken a different approach to blocking spyware: they use their network firewalls and web proxies to block access to Web sites known to install spyware. On March 31, 2005, Cornell University's Information Technology department released a report detailing the behavior of one particular piece of proxy-based spyware, Marketscore, and the steps the university took to intercept it. Many other educational institutions have taken similar steps.

Individual users can also install firewalls from a variety of companies. These monitor the flow of information going to and from a networked computer and provide protection against spyware and malware. Some users install a large hosts file which prevents the user's computer from connecting to known spyware-related web addresses. Spyware may get installed via certain shareware programs offered for download. Downloading programs only from reputable sources can provide some protection from this source of attack.

Individual users can use cellphone / computer with physical (electric) switch, or isolated electronic switch that disconnects microphone, camera without bypass and keep it in disconnected position where not in use, that limits information that spyware can collect. (Policy recommended by NIST Guidelines for Managing the Security of Mobile Devices, 2013).

Applications

"Stealware" and affiliate fraud

A few spyware vendors, notably 180 Solutions, have written what the New York Times has dubbed "stealware", and what spyware researcher Ben Edelman terms affiliate fraud, a form of click fraud. Stealware diverts the payment of affiliate marketing revenues from the legitimate affiliate to the spyware vendor.

Spyware which attacks affiliate networks places the spyware operator's affiliate tag on the user's activity – replacing any other tag, if there is one. The spyware operator is the only party that gains from this. The user has their choices thwarted, a legitimate affiliate loses revenue, networks' reputations are injured, and vendors are harmed by having to pay out affiliate revenues to an "affiliate" who is not party to a contract. Affiliate fraud is a violation of the terms of service of most affiliate marketing networks. Mobile devices can also be vulnerable to chargeware, which manipulates users into illegitimate mobile charges.

Identity theft and fraud

In one case, spyware has been closely associated with identity theft. In August 2005, researchers from security software firm Sunbelt Software suspected the creators of the common CoolWebSearch spyware had used it to transmit "chat sessions, user names, passwords, bank information, etc."; however it turned out that "it actually (was) its own sophisticated criminal little trojan that's independent of CWS." This case is currently under investigation by the FBI.

The Federal Trade Commission estimates that 27.3 million Americans have been victims of identity theft, and that financial losses from identity theft totaled nearly $48 billion for businesses and financial institutions and at least $5 billion in out-of-pocket expenses for individuals.

Digital rights management

Some copy-protection technologies have borrowed from spyware. In 2005, Sony BMG Music Entertainment was found to be using rootkits in its XCP digital rights management technology Like spyware, not only was it difficult to detect and uninstall, it was so poorly written that most efforts to remove it could have rendered computers unable to function. Texas Attorney General Greg Abbott filed suit, and three separate class-action suits were filed. Sony BMG later provided a workaround on its website to help users remove it.

Beginning on April 25, 2006, Microsoft's Windows Genuine Advantage Notifications application was installed on most Windows PCs as a "critical security update". While the main purpose of this deliberately uninstallable application is to ensure the copy of Windows on the machine was lawfully purchased and installed, it also installs software that has been accused of "phoning home" on a daily basis, like spyware. It can be removed with the RemoveWGA tool.

Personal relationships

Stalkerware is spyware that has been used to monitor electronic activities of partners in intimate relationships. At least one software package, Loverspy, was specifically marketed for this purpose. Depending on local laws regarding communal/marital property, observing a partner's online activity without their consent may be illegal; the author of Loverspy and several users of the product were indicted in California in 2005 on charges of wiretapping and various computer crimes.

Browser cookies

Anti-spyware programs often report Web advertisers' HTTP cookies, the small text files that track browsing activity, as spyware. While they are not always inherently malicious, many users object to third parties using space on their personal computers for their business purposes, and many anti-spyware programs offer to remove them.

Shameware

Shameware or "accountability software" is a type of spyware that is not hidden from the user, but operates with their knowledge, if not necessarily their consent. Parents, religious leaders or other authority figures may require their children or congregation members to install such software, which is intended to detect the viewing of pornography or other content deemed inappropriate, and to report it to the authority figure, who may then confront the user about it.

Spyware programs

These common spyware programs illustrate the diversity of behaviors found in these attacks. Note that as with computer viruses, researchers give names to spyware programs which may not be used by their creators. Programs may be grouped into "families" based not on shared program code, but on common behaviors, or by "following the money" of apparent financial or business connections. For instance, a number of the spyware programs distributed by Claria are collectively known as "Gator". Likewise, programs that are frequently installed together may be described as parts of the same spyware package, even if they function separately.

Spyware vendors

Spyware vendors include NSO Group, which in the 2010s sold spyware to governments for spying on human rights activists and journalists. NSO Group was investigated by Citizen Lab.

Rogue anti-spyware programs

Malicious programmers have released a large number of rogue (fake) anti-spyware programs, and widely distributed Web banner ads can warn users that their computers have been infected with spyware, directing them to purchase programs which do not actually remove spyware—or else, may add more spyware of their own.

The recent proliferation of fake or spoofed antivirus products that bill themselves as antispyware can be troublesome. Users may receive popups prompting them to install them to protect their computer, when it will in fact add spyware. It is recommended that users do not install any freeware claiming to be anti-spyware unless it is verified to be legitimate. Some known offenders include:

Fake antivirus products constitute 15 percent of all malware.

On January 26, 2006, Microsoft and the Washington state attorney general filed suit against Secure Computer for its Spyware Cleaner product.

Legal issues

Criminal law

Unauthorized access to a computer is illegal under computer crime laws, such as the U.S. Computer Fraud and Abuse Act, the U.K.'s Computer Misuse Act, and similar laws in other countries. Since owners of computers infected with spyware generally claim that they never authorized the installation, a prima facie reading would suggest that the promulgation of spyware would count as a criminal act. Law enforcement has often pursued the authors of other malware, particularly viruses. However, few spyware developers have been prosecuted, and many operate openly as strictly legitimate businesses, though some have faced lawsuits.

Spyware producers argue that, contrary to the users' claims, users do in fact give consent to installations. Spyware that comes bundled with shareware applications may be described in the legalese text of an end-user license agreement (EULA). Many users habitually ignore these purported contracts, but spyware companies such as Claria say these demonstrate that users have consented.

Despite the ubiquity of EULAs agreements, under which a single click can be taken as consent to the entire text, relatively little caselaw has resulted from their use. It has been established in most common law jurisdictions that this type of agreement can be a binding contract in certain circumstances. This does not, however, mean that every such agreement is a contract, or that every term in one is enforceable.

Some jurisdictions, including the U.S. states of Iowa and Washington, have passed laws criminalizing some forms of spyware. Such laws make it illegal for anyone other than the owner or operator of a computer to install software that alters Web-browser settings, monitors keystrokes, or disables computer-security software.

In the United States, lawmakers introduced a bill in 2005 entitled the Internet Spyware Prevention Act, which would imprison creators of spyware.

Administrative sanctions

US FTC actions

The US Federal Trade Commission has sued Internet marketing organizations under the "unfairness doctrine" to make them stop infecting consumers' PCs with spyware. In one case, that against Seismic Entertainment Productions, the FTC accused the defendants of developing a program that seized control of PCs nationwide, infected them with spyware and other malicious software, bombarded them with a barrage of pop-up advertising for Seismic's clients, exposed the PCs to security risks, and caused them to malfunction. Seismic then offered to sell the victims an "antispyware" program to fix the computers, and stop the popups and other problems that Seismic had caused. On November 21, 2006, a settlement was entered in federal court under which a $1.75 million judgment was imposed in one case and $1.86 million in another, but the defendants were insolvent

In a second case, brought against CyberSpy Software LLC, the FTC charged that CyberSpy marketed and sold "RemoteSpy" keylogger spyware to clients who would then secretly monitor unsuspecting consumers' computers. According to the FTC, Cyberspy touted RemoteSpy as a "100% undetectable" way to "Spy on Anyone. From Anywhere." The FTC has obtained a temporary order prohibiting the defendants from selling the software and disconnecting from the Internet any of their servers that collect, store, or provide access to information that this software has gathered. The case is still in its preliminary stages. A complaint filed by the Electronic Privacy Information Center (EPIC) brought the RemoteSpy software to the FTC's attention.

Netherlands OPTA

An administrative fine, the first of its kind in Europe, has been issued by the Independent Authority of Posts and Telecommunications (OPTA) from the Netherlands. It applied fines in total value of Euro 1,000,000 for infecting 22 million computers. The spyware concerned is called DollarRevenue. The law articles that have been violated are art. 4.1 of the Decision on universal service providers and on the interests of end users; the fines have been issued based on art. 15.4 taken together with art. 15.10 of the Dutch telecommunications law.

Civil law

Former New York State Attorney General and former Governor of New York Eliot Spitzer has pursued spyware companies for fraudulent installation of software. In a suit brought in 2005 by Spitzer, the California firm Intermix Media, Inc. ended up settling, by agreeing to pay US$7.5 million and to stop distributing spyware.

The hijacking of Web advertisements has also led to litigation. In June 2002, a number of large Web publishers sued Claria for replacing advertisements, but settled out of court.

Courts have not yet had to decide whether advertisers can be held liable for spyware that displays their ads. In many cases, the companies whose advertisements appear in spyware pop-ups do not directly do business with the spyware firm. Rather, they have contracted with an advertising agency, which in turn contracts with an online subcontractor who gets paid by the number of "impressions" or appearances of the advertisement. Some major firms such as Dell Computer and Mercedes-Benz have sacked advertising agencies that have run their ads in spyware.

Libel suits by spyware developers

Litigation has gone both ways. Since "spyware" has become a common pejorative, some makers have filed libel and defamation actions when their products have been so described. In 2003, Gator (now known as Claria) filed suit against the website PC Pitstop for describing its program as "spyware". PC Pitstop settled, agreeing not to use the word "spyware", but continues to describe harm caused by the Gator/Claria software. As a result, other anti-spyware and anti-virus companies have also used other terms such as "potentially unwanted programs" or greyware to denote these products.

WebcamGate

In the 2010 WebcamGate case, plaintiffs charged two suburban Philadelphia high schools secretly spied on students by surreptitiously and remotely activating webcams embedded in school-issued laptops the students were using at home, and therefore infringed on their privacy rights. The school loaded each student's computer with LANrev's remote activation tracking software. This included the now-discontinued "TheftTrack". While TheftTrack was not enabled by default on the software, the program allowed the school district to elect to activate it, and to choose which of the TheftTrack surveillance options the school wanted to enable.

TheftTrack allowed school district employees to secretly remotely activate the webcam embedded in the student's laptop, above the laptop's screen. That allowed school officials to secretly take photos through the webcam, of whatever was in front of it and in its line of sight, and send the photos to the school's server. The LANrev software disabled the webcams for all other uses (e.g., students were unable to use Photo Booth or video chat), so most students mistakenly believed their webcams did not work at all. On top of the webcam surveillance, TheftTrack allowed school officials to take screenshots and send them to the school's server. School officials were also granted the ability to take snapshots of instant messages, web browsing, music playlists, and written compositions. The schools admitted to secretly snapping over 66,000 webshots and screenshots, including webcam shots of students in their bedrooms.

Politics of Europe

From Wikipedia, the free encyclopedia ...