Name: Raid on COVID Whistleblower in Florida Shows the Need to Reform Overbroad Computer Crime Laws and the Risks of Over-Reliance on IP Addresses
Brand: eff.org
SKU: eff-org-365
Availability: OnlineOnly

critic

Raid on COVID Whistleblower in Florida Shows the Need to Reform Overbroad Computer Crime Laws and the Risks of Over-Reliance on IP Addresses

preview

Email updates on news, actions,and events in your area.DEEPLINKS BLOGShare ItThe armed Florida Department of Law Enforcement raid on Monday on the Tallahassee Florida home of data scientist and COVID whistleblower Rebekah Jones was shocking on many levels. This incident smacks of retaliation against someone claiming to provide the public with truthful information about the most pressing issue facing both Florida and our nation: the spread and impact of COVID-19. It was an act of retaliation that depended on two broken systems that EFF has spent decades trying to fix: first, that our computer crime laws are so poorly written and broadly interpreted that they allow for outrageous misuses of police, prosecutorial and judicial resources; and second, that police continue to overstate the reliability of IP addresses as a means of identifying people or locations.On the first point, it seems that the police asked for, the prosecutors sought, (and the Court granted) a warrant for a home raid in response to a text message sent to a group of governmental and nongovernmental people working on tracking COVID, urging members to speak up about government hiding and manipulating information about the COVID outbreak in Florida.This isn’t just a one-off misuse: in other cases, we’ve seen the criminalization of “unauthorized” access used to who investigate the tools we all rely on, , , and prosecute employees who did on company computers. “Unauthorized” access was also used to prosecute our friend , and threaten him with decades in jail for downloading academic articles from the JSTOR database. Facing such threats, he committed suicide.&nbsp; How could a text message urging people to do the right thing ever result in an armed police home raid? Sadly, the answer lies in the vagueness and overbreadth of the Florida Computer Crime law, which closely mirrors the language in the federal (laws in many states across the country are likewise based on the CFAA).&nbsp;Police all too often liken an IP address to a “fingerprint"The law makes it a crime – a serious felony -&nbsp; to have “unauthorized access” to a computer. But it doesn’t define what “unauthorized” means.&nbsp; In cases across the country, and in one currently pending before the U.S. Supreme court , we’ve seen that the lack of a clear definition and boundaries around the word “authorized” causes great harm. Here, based upon the Affidavit in the Rebekah Jones case, the police took the position that sending a single text message to a group that you are not (or are no longer) a part of is “unauthorized” access to a computer and so is a crime that merits an armed home police raid. This, despite the obvious fact that no harm happened as a result of people getting a single message urging them to do the right thing.In fact, if you’ve ever shared a password with a family member or asked someone else to log into a service on your behalf or even lied about your age on a dating website, you’ve likely engaged in “unauthorized” access under some court interpretations. We in the Van Buren case to rule that violations of terms of use (as opposed to overcoming technical blocks) can never be criminal CFAA violations. This won’t entirely fix the law, but it will take away some of the most egregious misuses.&nbsp;Even with the broader definition of “unauthorized,” though, it’s unclear whether the text message in question was criminal. The Affidavit from the police confirms that the text group shared a single user name and password and said that the credentials were publicly available. Either way, it’s hard to see how the text could have been “unauthorized” if there was no technical or other notice to Ms. Jones that sending a message to the list was not allowed. Yet this wafer-thin reed was accepted by a Court as a basis for a search warrant of Ms. Jones’ family home.&nbsp;On the second point, the Affidavit indicates that the police relied heavily on the IP address of the sender of the message to seek a warrant to send armed police to Ms. Jones’ home. The affidavit fails to state how the police were able to connect the IP address with the physical address, simply stating that they used “investigative resources.” Press reports claim that Comcast – the ISP that handled that IP address -&nbsp; did confirm that Ms. Jones home was the customer associated with the IP address, but that isn't stated in the Affidavit. In other cases, the use of notoriously imprecise public reverse IP lookup tools has resulted , sometimes multiple times, so it is important that the police explain to the Court what they did to confirm the address and not just hide behind “investigative sources.”&nbsp; &nbsp;EFF that the overreliance on IP addresses as a basis for either the identity or location of a suspect is dangerous. Police all too often liken an IP address to a “fingerprint,” a misleading comparison that suggests that IP-based identifications are much more reliable than they really are, making the metaphor a dangerous one. The metaphor really falls apart when you consider &nbsp;the reality that a single IP address used by a home network is usually providing Internet connectivity to multiple people with several different digital devices, making it difficult to pinpoint a particular individual. Here, the police did tell the court that that Ms. Jones had recently worked for the Florida Department of Health, so the IP address wasn’t the only fact before the court, but it’s still pretty thin for a home invasion warrant, rather than, say, a simple police request that Ms. Jones come in for questioning.&nbsp;Even if it turns out Florida police were correct in this case – and for now Ms. Jones has denied sending the text – the rest of us should be concerned that IP addresses alone, combined with some undisclosed “investigative resources” can be the basis for a judge allowing armed police into your home. And it shows that judges must scrutinize both IP address evidence and law enforcement claims about their reliability, along with other supporting evidence, before authorizing search warrants.This case confirms our serious, ongoing national failure to protect whistleblowers. And in this case - as with Edward Snowden, Reality Winner, Chelsea Manning and many others - it’s clear that part of protecting whistleblowers means updating our computer crime laws to ensure that they can't be used as &nbsp;ready tools for prosecutorial overreach and misconduct. We also need to continue to educate judges about the unreliability of IP addresses so they require more information than just vague conclusions from police before granting search warrants.All too often, misunderstandings about computers and the digital networks lead to gross miscarriages of justice. But computers and the Internet are here to stay. It’s long past time we ensured that our criminal laws and processes stopped relying on outdated and imprecise words like “authorized” and metaphors like “fingerprints,” &nbsp;and instead apply technical rigor when deliberating about technology.&nbsp;Correction (December 16 2020): An earlier version of this article stated the raid was conducted by the Florida State Police. It was actually the Florida Department of Law Enforcement. Many thanks to the reader who alerted us to this error.Share ItThe (CFAA), the notoriously vague anti-hacking law, is long overdue for major reform. Among many problems, the CFAA has been used to target security researchers whose work uncovering software vulnerabilities frequently irritates corporations (and U.S. Attorneys). The Department of Justice (DOJ) today ...EFF filed a lawsuit today on behalf of prominent Saudi human rights activist Loujain AlHathloul against spying software maker DarkMatter Group and three of its former executives for illegally hacking her iPhone to secretly track her communications and whereabouts.The Secretary of Homeland Security Alejandro Mayorkas will be . Those attending this weekend’s hybrid event will have a with the man who heads the department responsible for surveillance of immigrants, Muslims, Black activists, and other marginalized...Just as a good hacker sees worlds of possibility in plastic, metal, and pixels, we must all envision and work for a future that’s better than what we’re given. This week, EFF is celebrating the Las Vegas computer security conferences virtually and putting our annual mystery-filled DEF CON t-shirt online.EFF and the Internet Archive argued to the Ninth Circuit Court of Appeals that the Supreme Court’s recent decision in Van Buren v. United States shows that the federal computer crime law does not criminalize the common and useful practice of scraping publicly available information on the internet.The Supreme Court’s today overturned a dangerous precedent and clarified the notoriously ambiguous meaning of “exceeding authorized access” in the Computer Fraud and Abuse Act, the federal computer crime law that’s been prosecute beneficial and important online activity. The decision is a victory...EFF has long fought to reform vague, dangerous computer crime laws like . We're gratified that the Supreme Court today acknowledged that risks turning nearly any user of the Internet into a criminal based on arbitrary terms of service. We remember the...The City of Fullerton, California has against two bloggers and a local website. The suit dangerously sought to expand California’s computer crime law in a way that threatened investigative reporting and everyday internet use.The city’s lawsuit against the bloggers and the website ...EFF is excited to in a virtual version of the annual —a day dedicated to celebrating the continuing legacy of activist, programmer, and entrepreneur Aaron Swartz.  Join EFF Senior Researcher Dave Maass and privacy advocate Madison Vialpando as they lead...A legacy of the 2016 U.S. election is the controversy about the role played by paid, targeted political ads, particularly ads that contain disinformation or misinformation. Political scientists and psychologists disagree about how these ads work, and what effect they have. It's a pressing political question, especially on the eve...Share It

Email updates on news, actions,and events in your area.DEEPLINKS BLOGShare ItThe armed Florida Department of Law Enforcement raid on Monday on the Tallahassee Florida home of data scientist and COVID whistleblower Rebekah Jones was shocking on many levels. This incident smacks of retaliation against someone claiming to provide the public with truthful information about the most pressing issue facing both Florida and our nation: the spread and impact of COVID-19. It was an act of retaliation that depended on two broken systems that EFF has spent decades trying to fix: first, that our...

public

Cindy Cohn

We're the Electronic Frontier Foundation. We defend your civil liberties in a digital world.

Raid on COVID Whistleblower in Florida Shows the Need to Reform Overbroad Computer Crime Laws and the Risks of Over-Reliance on IP Addresses

No article scores yet.

CRITIC REVIEWS

PUBLIC REVIEWS