Acting White House Cyberspace Director Melissa Hathaway addresses the cybersecurity issue during the RSA computer security conference on Wednesday.
(Credit: James Martin/CNET)SAN FRANCISCO--The federal official overseeing a 60-day review of the U.S. government's cybersecurity efforts indicated Wednesday that the final report recommends shifting more responsibilities to the White House.
"It provides the president with recommendations for a White House organizational structure that can effectively address cyberspace-related issues," Melissa Hathaway, acting cyberspace director for the White House's National Security and Homeland Security councils, said at the RSA computer security conference here.
At the moment, a division of the U.S. Department of Homeland Security coordinates nonmilitary cybersecurity activities and is responsible for building a national "response system" for online attacks and creating a "risk management program" for critical infrastructure.
Hathaway said her report--which has not yet been made public--was finished on Friday and has been sent to President Obama for his approval.
"This responsibility transcends the jurisdictional purview of individual departments and agencies because, although each agency has a unique contribution to make, no single agency has a broad enough perspective to match the sweep of the challenges," Hathaway said.
The announcement of the review led to speculation that the White House's National Security Council or the National Security Agency would be handed more cybersecurity responsibilities, along with a larger budget to carry them out. Although the 2002 law creating DHS centralized cybersecurity responsibilities, it has been repeatedly criticized by government auditors who concluded that DHS failed to live up to its responsibilities and may be "unprepared" for emergencies.
On Tuesday, NSA Director Keith Alexander downplayed reports of a power grab by his agency, saying, "We do not want to run cybersecurity for the U.S. government." The NSA has cybersecurity responsibilities for the U.S. military.
Alexander's remarks appeared to be a response to Rod Beckstrom, former director of Homeland Security's National Cybersecurity Center, whose resignation letter last month blasted what he described as an NSA power grab that could threaten "our democratic processes." That led some members of Congress--including the Democratic chairman of the House Homeland Security Committee--to object to NSA control, which Clinton-era FBI director Louis Freeh echoed a day later.
The RSA conference was punctuated by news reports of a discovery of $1.9 million infected zombie computers in a botnet and a report that hackers stole some specifications from the $300 billion Joint Strike Fighter project. (The Pentagon and Lockheed Martin, the primary contractor, said Wednesday that the report was incorrect.)
Any effort by the Obama administration to reshuffle cybersecurity responsibilities will face a significant challenge: the protocols and hardware that make up today's Internet are created and maintained by the private sector. Companies like Cisco Systems, Microsoft, Google, AT&T, and Verizon--not Washington bureaucracies--operate today's Internet, and it's not clear that outside help will be useful.
"Protecting cyberspace requires strong vision and leadership and will require changes in policy, technology, education, and perhaps law," Hathaway said. "Achieving this vision requires leadership and commitment from the highest levels of government, industry, and civil society."
Vice President Joe Biden lauded Hollywood at a gala dinner in Washington, D.C. on Tuesday evening, assailed movie piracy, and promised film executives that the Obama administration would pick "the right person" as its copyright czar.
Just days after four Pirate Bay defendants were found guilty in Sweden, Biden warned of the harms of piracy at a private event organized by the Motion Picture Association of America in the sumptuous, newly renovated Great Hall of the National Portrait Gallery in Washington, D.C.
"It's pure theft, stolen from the artists and quite frankly from the American people as consequence of loss of jobs and as a consequence of loss of income," Biden said, according to a White House pool report.
Biden blasted China, saying its intellectual property laws remain "largely ineffective" and will end up "strangling their own creative juices," and compared it to what he described as India's more effective anti-piracy regime. He singled out Canada, a close U.S. ally, as needing stronger laws; it never signed the treaty that led to the Digital Millennium Copyright Act, and a proposal to adopt anti-circumvention restrictions was never adopted.
He also addressed President Obama's forthcoming decision about who will be named the intellectual-property enforcement coordinator, better known as the copyright czar. Copyright industry lobbyists sent a letter Monday to the president asking him to pick someone sympathetic to their concerns, while groups that would curb copyright law sent their own letter urging the opposite approach.
We "will find the right person for intellectual property czar," Biden said.
Under a law approved by the U.S. Congress last October, Obama is required to appoint someone to coordinate the administration's IP enforcement efforts and prepare annual reports.
Senators attending the MPAA gala included Richard Durban (D-Illinois); Sheldon Whitehouse (D-R.I.); Frank Lautenberg (D-N.J.), Judd Gregg (R-N.H.); Amy Klobuchar (D-Minnesota); Patrick Leahy (D-Vermont); Roger Wicker (R-Mississipi); and Ben Nelson (D-Nebraska).
An unspoken reason for the MPAA event--which included a symposium earlier in the day with remarks from top House Democrats and Commerce Secretary Gary Locke--was the loss of $246 million in tax breaks when the Senate revised the economic stimulus bill earlier this year. An MPAA report released Tuesday appears designed to avoid a repeat of that setback, listing the number of movies being filmed in each state.
Earlier in the day, Locke also talked up more government action against peer-to-peer piracy. "The recent revelation that an illegal copy of the upcoming movie "Wolverine" had been posted on the Internet prior to its theatrical release underscores the problem the industry faces...As a former prosecutor, I believe in the full and impartial enforcement of the law," he said.
On copyright, President Obama has signaled a more pro-industry approach than his predecessor, which has alarmed advocates of less restrictive laws.
The president chose as top Justice Department officials the music industry attorney who pulled the plug on Grokster and another longtime Recording Industry Association of America ligitator. The Obama administration recently sided with the RIAA in a file-sharing suit, and Biden was a staunch RIAA and MPAA ally as a U.S. senator.
"I think sometimes you underestimate the impact you have, and not just entertaining but uplifting," Biden told the audience at the MPAA event. "I wish I could inspire the way you do."
(Credit:
CNET/Declan McCullagh)
SAN FRANCISCO--The director of the National Security Agency on Tuesday downplayed reports of the NSA's attempt to wrest control of cybersecurity responsibilities from rival federal agencies.
"We do not want to run cybersecurity for the U.S. government," Lt. Gen. Keith Alexander said at the RSA security conference here.
Instead, Alexander said, the Department of Homeland Security should continue to oversee Internet and computer security for civilian agencies, while the NSA would provide that service for military agencies.
Alexander's remarks come during a 60-day review of the federal government's cybersecurity efforts ordered by President Obama that could end with responsibilities being reshuffled between agencies. Melissa Hathaway, who worked for the director of national intelligence in the Bush administration and is conducting the review, is scheduled to give a public talk on Wednesday.
The announcement of the review led to speculation that the White House's National Security Council or NSA would be handed more cybersecurity responsibilities, along with a larger budget to carry them out. Although the 2002 law creating DHS centralized cybersecurity responsibilities, it has been repeatedly criticized by government auditors who concluded that DHS failed to live up to its responsibilities and may be "unprepared" for emergencies.
On Tuesday, Alexander did note that the NSA "has tremendous technical abilities" and suggested that crisis management might benefit from centralization. "The question is: What happens in a time of crisis? We don't have a way of seeing and sharing networks today in a timely manner."
Much of Alexander's remarks appeared to be a response to Rod Beckstrom, former director of Homeland Security's National Cybersecurity Center, whose resignation letter last month blasted what he described as an NSA power grab that could threaten "our democratic processes." That led some members of Congress -- including the Democratic chairman of the House Homeland Security Committee -- to object to NSA control, which Clinton-era FBI director Louis Freeh echoed a day later.
Other topics of discussion at the RSA conference included cyberattacks by foreign governments--a Wall Street Journal report on Tuesday said some sensitive files related to the Pentagon's Joint Strike Fighter Project had been electronically viewed--and the recent Conficker worm.
On Tuesday, Robert Lentz, chief information assurance officer for the Department of Defense, said the agency is attempting to protect 15,000 networks, 7 million computers, and 1.1 billion Defense Department Internet users worldwide. There are 360 million probes targeted at Defense Department networks each day, compared to the 1 million probes an average major U.S. bank gets per month, he said.
"2009 is the tipping point," Lentz said. "The reality is the bad guys are going to be in our networks," and officials have to figure out how to best detect and contain the threats, he said.
High-level officials understand the seriousness of cyberthreats and understand that "airplanes can't fly if the network is down," he said. "The biggest challenge is turning geek-speak into things they can understand."
The department has a lot of work to do to change the network protection policy from one based on bolting together disparate security tools to one where protective tools are interoperable and integrated, according to Lentz.
Within the next week or so the agency expects to have an identity assurance strategy that will include biometrics for authenticating identity of network users and identification of devices like routers and switches, he said.
Asked after his talk if he believed reports that Chinese cyber spies had infiltrated the department's network, Lentz said "probably."
CNET's Elinor Mills contributed to this report.
The FBI has used a secret form of spyware in a series of investigations designed to nab extortionists, database-deleting hackers, child molesters, and hitmen, according to documents obtained by CNET News.
One suspect used Microsoft's Hotmail to send bomb and anthrax threats to an undercover government investigator; another demanded a payment of $10,000 a month to stop cutting cables; a third was an alleged European hitman who was soliciting for business from a Hushmail.com account.
CNET News obtained the documents -- totaling hundreds of pages, although nearly all of them were heavily redacted -- this week through a Freedom of Information Act request to the FBI.
The FBI spyware, called CIPAV, came to light in July 2007 through court documents that showed how the bureau used it to nab a teenager who was e-mailing bomb threats to a high school near Olympia, Wash. (CIPAV stands for Computer and Internet Protocol Address Verifier.)
A June 2007 memo says that the FBI's Deployment Operations Personnel were instructed to "deploy a CIPAV to geophysically locate the subject issuing bomb threats to the Timberline High School, Lacy, Washington. The CIPAV will be deployed via a Uniform Resource Locator (URL) address posted to the subject's private chat room on MySpace.com."
An affidavit written by FBI Special Agent Norman Sanders at the time said that CIPAV is able to send "network-level messages" containing the target computer's IP address, Ethernet MAC address, environment variables, the last-visited Web site, and other registry-type information including the name of the registered owner of the computer and the operating system's serial number.
The FOIA documents indicate that the FBI turns to CIPAV when a suspect is communicating with police or a crime victim through e-mail and is using an anonymizing service to conceal his computer's Internet protocol address. If an anonymizing service had not been used, then a subpoena to the e-mail provider would normally be sufficient.
CIPAV lets the FBI trick a suspect's computer into identifying itself to police, much as an exploding dye packet might identify a bank robber.
One document from March 2007 indicates that the FBI originally used a simple technique known as a "Web bug." Written by the Justice Department's Computer Crime and Intellectual Property Section, it says "some investigators have begun to use an investigative technique referred to as an 'Internet Protocol Address Verifier' (IPAV), a/k/a a 'Web bug.'"
Then the bureau appears to have shifted to actual software, once known as Magic Lantern (possibly a Trojan Horse) and then CIPAV.
One example of CIPAV's use came in a March 2006 request to the FBI's Cryptologic and Electronic Analysis Unit. It said a victim's Hotmail account is controlled by a suspect who "is extorting the victim because the account had personal info in it. Subject wants victim to set up an e-gold.com account and transfer $10,000 there and then email the userid/pwd to the subject."
Another was an August 2005 request saying a hacker deleted a company's database and "is extorting the victim company for payment to restore it."
If CIPAV could be detected before being installed by antivirus software, a criminal suspect may be able to avoid having his Internet address divulged to the police. A 2007 CNET News survey of the major antispyware vendors found that that not one company acknowledged cooperating unofficially with government agencies.
The National Security Agency tried to wiretap a member of the U.S. Congress without a warrant, and has engaged in "significant and systemic" illegal surveillance activities in the last few months including e-mail and telephone call interceptions, according to a report this week.
The article in Wednesday's New York Times said the Obama administration acknowledged there had been abuses but said they had been resolved. The attempted eavesdropping on a congressman came about because he or she was part of a delegation to the Middle East in 2005 or 2006, and was ultimately blocked.
The NSA said in a statement on Wednesday that "intelligence operations, including programs for collection and analysis, are in strict accordance with U.S. laws and regulations."
The Times reported, without giving details, that the "overcollection" problems were discovered as part of a twice-a-year certification that the Justice Department and the director of national intelligence are required to give to the Foreign Intelligence Surveillance Court.
Salon.com columnist Glenn Greenwald wrote on Thursday that it was "inevitable" that more NSA surveillance abuses would happen after the Democratic-controlled Congress approved legislation in 2008 that eliminated safeguards and blessed surveillance activities that would otherwise have been illegal.
Greenwald wrote: "That was the purpose of the law: to gut the safeguards in place since the 1978 passage of FISA, destroy the crux of the oversight regime over executive surveillance of Americans, and enable and empower unchecked government spying activities." (FISA is the Foreign Intelligence Surveillance Act.)
At the time, in June 2008, the ACLU highlighted a long list of concerns including "loopholes" in the bill to rewrite FISA. Presidential candidate Barack Obama supported the FISA bill--which also granted retroactive immunity to telecommunications companies that illegally opened their networks to the NSA--saying it has "appropriate safeguards."
Tax protester at San Francisco "tea party" gathering on April 15 holds up sign saying "IRS: We take $$$$$$ from working people to pay for big government."
(Credit: Declan McCullagh/CNET)If a little-known but influential alliance of state politicians, large retailers, and tax collectors have their way, the days of tax-free Internet shopping may be nearly over.
A bill expected to be introduced in the U.S. Congress as early as Monday would rewrite the ground rules for mail order and Internet sales by eliminating what its supporters view as a "loophole" that, in many cases, allows Americans to shop over the Internet without paying sales taxes.
Currently, Americans who shop over the Internet from out-of-state vendors aren't always required to pay sales taxes at the time of purchase. Californians buying books from Amazon.com or cameras from Manhattan's B&H Photo, for example, won't pay sales taxes at checkout time that they would if shopping at a local mall.
"We will have the bill ready for introduction by next Monday," said Neal Osten of the National Conference of State Legislatures. "We finalized the language and now we're working out the remaining issues and adding some new provisions at the request of various stakeholders."
This is hardly a new debate: pro-tax officials and state governments have been pressing Congress to enact such a law for at least seven years. They argue that reduced sales tax revenue threatens budgets for schools and police, and say that, as a matter of fairness, online retailers should be forced to collect the same taxes that brick-and-mortar retailers do.
Even though those arguments have been unsuccessful so far, the National Conference of State Legislatures and its allies believe the recession has sliced into sales tax revenue so much that Congress will have to act. A report this week from the Rockefeller Institute says that sales taxes have declined by 6.1 percent, the largest decline in half a century.
"One of the big things the states have learned in the recession is they have declining revenues," said Scott Peterson, executive director of the Streamlined Sales Tax Project, which counts state politicians and tax collectors on its governing board. "We're very optimistic about Congress this year. We think we are within a day or two of finalizing the legislation."
The final legislation is expected to be introduced by Sen. Mike Enzi, a Wyoming Republican, and Rep. Bill Delahunt, a Massachusetts Democrat, who have championed similar proposals in the past. Delahunt's office on Wednesday confirmed he was interested; Enzi's did not respond.
On the other side are the Direct Marketing Association, the Electronic Retailing Association, and companies including eBay, L.L. Bean, and Overstock.com. One of their biggest objections to the idea of collecting sales taxes on out-of-state shipments is the dizzying complexity of state laws.
Take candy, which would seem to be a straightforward item to tax. It isn't. During a 2003 discussion of tax policy, a representative of Indiana, James Turner, noted that a proposed definition of candy would have taxed the Milky Way Midnight candy bar but not the original Milky Way bar.
But further investigation showed that Turner's counter-proposal would have treated "certain flavors of Pop Tarts" and Cookies and Twix Crunchy Cookie Bars as candy--but not Cookies and Snickers Crunchy Cookie Bars. Peanut butter Girl Scout cookies would be candy, but Thin Mints or Caramel deLites would be classified as food.
Bizarre distinctions like this, coupled with the existence of more than 7,000 different tax agencies, are why the U.S. Supreme Court ruled that out-of-state retailers generally couldn't be obligated to collect sales taxes unless Congress changes the law. The justices noted in a 1992 case called Quill v. North Dakota: "Congress is now free to decide whether, when, and to what extent the States may burden interstate mail order concerns with a duty to collect use taxes."
One exception to that rule is a legal concept called "nexus," which means a company can be forced to collect sales taxes if it has a sufficient business presence. If Amazon had an office in California, it already would be collecting sales tax for Golden State residents. (Another exception is the sale of cigarettes, which is covered by the Jenkins Act.)
In response to complexity concerns, the pro-tax forces have offered a proposal that they hope Congress can be persuaded to adopt. The concept is called the Streamlined Sales Tax Agreement, invented in 2002 by state tax officials hoping to straighten out some of sales tax laws' most notorious convolutions.
Since 2003, more than 20 states have signed on, either wholly or partially, to the agreement, meaning they agree to simplify their tax codes and make them uniform. If enough states participate, proponents believe it will be easier to convince Congress to make sales collection mandatory for out-of-state retailers.
"You'll see governors from states who are active participants pushing the Hill to move the issue forward--Kansas has been a long-standing leader. North Dakota, Iowa, Oklahoma, those are some with members on the governing board," said David Quam, director of the office of federal regulations at the National Governors Association. "The states have done the heavy lifting of coming up with a voluntary system that makes sense. Now it's Congress' turn to grant states the authority to collect this."
Representatives of the Streamlined Sales Tax Project are gathering in Washington, D.C. next month for a three-day governing board meeting, including a "lobbying day" that's scheduled for May 13.
Under existing law, the caveat is that online purchases from sites like Amazon and eBay only seem to arrive tax-free. Legally, however, purchasers are required to pay their own state's sales tax rate--the concept is called a "use tax"--and then voluntarily report the amount owed at tax time.
California residents, for instance, are now burdened with a sales and use tax of at least 8.25 percent. State law is strict: if Californians travel to a state with a 5 percent tax and shop there, the law requires them to cough up the 3.25 percent difference when they return. Online purchases are taxed as well.
But compliance is spotty at best. California's Board of Equalization estimates the state lost $1.34 billion in 2003 because residents aren't paying use taxes--and attributes $208 million of that to online purchases.
"There's no member of NRF that does not support" the forthcoming legislation, said Maureen Riehl, vice president of government relations at the National Retail Federation. "The sooner we can get it done the better, as far as retailers are concerned."
Online retailers tend to disagree. If the Streamlined Sales Tax Project (SSTP) were actually simple and easy for a shipper to work with, they might be more willing to compromise, but that may not be the case.
"The states are desperate for new revenue and I think they realize they're straying far from the simplification they originally promised," said Steve DelBianco, executive director of NetChoice, which counts as members AOL, eBay, NewsCorp, Oracle, Verisign, and Yahoo. "That creates an urgency on their part--to get the federal mandate before it becomes clear they have no intention to simplify."
"They have no real intention of simplifying or compensating sellers for the burdens of collecting," DelBianco said. "It's a shell game."
Among his complaints: That states are unwilling to compensate sellers for the burden of sales tax collection; that small businesses with minimal sales should be exempt; that only one state (as opposed to all states) should be able to audit a business; that participating states are not paying attention to the idea of simplification and are actually making definitions more complex.
"There has to be some oversight," DelBianco said. "These guys have demonstrated--the streamlined states have demonstrated -- an inability to stick to the streamlined promise. Only the U.S. Congress is going to be able to protect sellers from unreasonable burdens."
CNET's Stephanie Condon contributed to this report.
Fans of legalizing marijuana pushed their questions to the top of a WhiteHouse.gov voting system. (Click to enlarge.)
(Credit: Declan McCullagh/CNET)As any major Web site can attest, any online voting begs to be influenced by special interests. CNBC yanked a 2007 presidential poll after enthusiastic Ron Paul supporters boosted their candidate to 75 percent, and the FreeRepublic.com crowd recently flooded a Web vote about stem cell funding.
On Thursday, WhiteHouse.gov became the latest Web site to experience this kind of deluge as part of an online town hall--and this time, it was marijuana legalization advocates who voted to push their questions to the top of the charts.
By the time President Obama's town hall began, questions about legalizing marijuana ranked at the top of the "green jobs," "financial stability," "jobs," and "budget" sections (and came in a close second place in the health care section too). Sample question: "What are your plans for the failing, 'War on Drugs', that's sucking money from tax payers and putting non-violent people in prison longer than the violent criminals?"
White House aides didn't choose any of those questions to present to the president on the nearby screens, but Obama did acknowledge that the topic was a popular one.
He said online voters wanted to know "whether legalizing marijuana would improve the economy and job creation," and joked that "I don't know what this says about the online audience."
But the president--whose administration has indicated that it would effectively end raids on distributors of medical marijuana in California--said he would not support changing federal drug law that makes even possession of pot a crime. "No, I don't think this is a good strategy to grow our economy," Obama said, to applause from the audience.
The White House said that 92,927 people submitted 104,126 questions and cast a total of 3,606,824 votes.
Earlier in the week, some drug-related blogs had encouraged supporters to flood the virtual polls and vote for the marijuana-related questions through the version of Google Moderator that the White House chose for the town hall project. (Google uses the application internally, including for companywide meetings.)
A Marijuana.com discussion thread says: "Vote for the top marijuana related questions." NORML, the National Organization for the Reform of Marijuana Laws, said: "Please take a moment right now to log on the WhiteHouse.gov/OpenForQuestions and vote for the questions above, as well as others pertaining to the need to regulate cannabis. Let the President know that millions of American voters believe that the time has come to tax and regulate marijuana."
Obama's brief remarks on the topic demonstrated a weakness of the online town hall format: it doesn't allow followup questions, which journalists used during the president's press conference earlier this week to good effect. If that were possible, drug war foes would likely have had something else to say.
Oh, and during Thursday's online town hall, the president did address topics other than marijuana and federal drug laws, including unemployment and job creation.
The Obama administration has sided with the recording industry in a copyright lawsuit against an alleged peer-to-peer pirate, a move that echoes arguments previously made by the Bush administration.
A legal brief filed Sunday in a case that the Recording Industry Association of America is pursuing in Massachusetts argues that federal copyright law is not so overly broad and its penalties not so unduly severe that they count as "punitive." Current law allows a copyright holder to receive up to $150,000 in damages per violation.
The brief says "the harms caused by copyright infringement" on the Internet include limiting "a copyright owner's ability to distribute legal copies of copyrighted works. The public in turn suffers from lost jobs and wages, lost tax revenue, and higher prices for honest purchasers of copyrighted works."
The Obama administration's choice to intervene in the Massachusetts lawsuit comes after the Bush administration joined the RIAA's lawsuit against Jammie Thomas. It, too, defended the constitutionality of the statute--one of the Justice Department's duties--that a jury decided Thomas had violated. (Thomas has been awarded a new trial.)
The Massachusetts case could prove to be an important one. A group of Harvard law school students, with the help of Harvard law Professor Charles Nesson, is providing defendant Joel Tenenbaum with an aggressive legal defense. They aim to convince the courts that the law the RIAA relies on is so Draconian it amounts to "essentially a criminal statute" and is therefore unconstitutional; that it grants too much authority to copyright holders; and that it violates due process rights guaranteed by the U.S. Constitution.
Those are the arguments that the Justice Department is attempting to refute. Its brief says that while the administration "does not address" the nonconstitutional arguments, "if the court finds it necessary to reach the constitutional questions at this time, then it should reject each of defendant's constitutional claims."
It adds: "The remedy of statutory damages for copyright infringement has been a cornerstone of our federal copyright law since 1790, and Congress acted reasonably in crafting the current incarnation of the statutory damages provision. Congress sought to account for both the difficulty of quantifying damages in the context of copyright infringement and the need to deter millions of users of new technology from infringing copyrighted works in an environment where many violators believe that their activities will go unnoticed."
Until recently, a top Justice Department official was representing the RIAA in the Massachusetts case. In early January, Barack Obama picked Tom Perrelli for associate attorney general; he was listed as a "lead attorney" for the RIAA in the case and had filed a formal notice of withdrawal less than two weeks earlier.
On February 4, Obama picked as associate deputy attorney general Donald Verrilli, who represented the RIAA in the Jammie Thomas case. Verrilli didn't file a motion to withdraw from the case until last week.
File photo: EPIC director Marc Rotenberg at Stanford University talking about Google and privacy in 2007.
(Credit: Declan McCullagh/CNET)A privacy advocacy group has asked the Federal Trade Commission to pull the plug on Gmail, Google Docs, Google Calendar, and the company's other Web apps until government-approved "safeguards are verifiably established."
If the FTC grants the request, hundreds of millions of Internet users would be unable to access their e-mail or documents until the agency's formidable collection of lawyers in Washington, D.C., became satisfied with the revised applications. The outage would extend to businesses that pay for access to Google Apps.
The Electronic Privacy Information Center submitted the far-reaching request to the FTC in a letter from its director, Marc Rotenberg, on Tuesday. It argues that a formal legal injunction halting all Google cloud-computing services pending formal government approval is necessary to "adequately safeguard the confidential information" of users.
"If we were talking about a child safety seat that could not be securely attached to a car passenger seat, the commission in that instance would say to the company, 'Look, you've got to fix that problem,'" Rotenberg, a lawyer and adjunct law professor, said in a telephone interview on Tuesday. "Consumers are at risk when that product is in the marketplace. We have a similar view of cloud computing at this point: people are at risk."
EPIC sent the letter a week after a bug in Google Docs exposed a small fraction of word-processing and presentation documents. Google said the problem affected only 0.05 percent of documents stored at the site, that affected Google Docs users had been notified, and it affected only people with whom users had already shared documents.
As an additional punishment, EPIC wants Google to be forced to pay $5 million into a "public fund" that it and like-minded advocacy groups could financially benefit from.
For its part, Google said it was reviewing EPIC's letter and provided CNET with this statement: "Many providers of cloud computing services, including Google, have extensive policies, procedures and technologies in place to ensure the highest levels of data protection. Indeed, cloud computing can be more secure than storing information on your own hard drive. We are highly aware of how important our users' data is to them and take our responsibility very seriously."
Paragraph 57 of EPIC's letter asks the FTC to "enjoin Google from offering cloud computing services until safeguards are verifiably established."
Microsoft and Yahoo declined to comment on Tuesday.
EPIC regularly sends letters to the FTC asking for action against technology companies. It sent one last year targeting Ask.com, which had already discontinued the practice in question. In 2000, the group targeted DoubleClick; it also questioned Microsoft's Passport authentication system, which yielded a settlement in August 2002.
The complaints invoke the FTC's legal authority to file civil lawsuits against "unfair or deceptive acts or practices." In this case, EPIC claims that Google is violating that law because of its "inadequate security practices."
"One of the powers of the FTC is to say if you can't provide a safe product, we can take it from the marketplace," Rotenberg said. He acknowledged having the FTC attempt to pull the plug on Google Apps until privacy fixes were done was a long shot, but said the broader goal was to raise awareness of the privacy and security risks of cloud computing. (EPIC previously claimed Gmail was illegal and attempted to have it shut down.)
Jim Harper, director of information policy studies at the free-market Cato Institute, said that nothing Google has done is unfair or deceptive.
"EPIC is unable to persuade the public of a problem, so it goes to a very willing government agency that has nothing else to do but machinate about these kinds of issues," Harper said. He added, referring to the $5 million fund EPIC wants Google to set up: "This is a new fundraising tool."
CNET's Stephanie Condon contributed to this report
(Disclosure: Declan McCullagh is married to a Google employee.)
Police Blotter is a regular CNET report on the intersection of technology and the law.
What: Facebook photograph shows part-time teaching aide at Ohio high school with three cheerleaders holding Smirnoff bottles.
When: The Court of Appeals of Ohio, Twelfth District, rules on February 9.
Outcome: Conviction for allowing minors to possess alcohol upheld.
What happened, according to court documents and other sources:
Most people are merely embarrassed by photos a friend tosses onto Facebook. Mary Ellen Hause went to jail because of them.
Hause, who worked as a part-time teaching aide at Springboro High School, near Dayton, Ohio, was photographed in her basement posing with three cheerleaders holding Smirnoff bottles. The cheerleaders were friends with her son.
That photo, of course, ended up on Facebook. And Springboro High School Resource Officer Sgt. Don Wilson, who regularly poked around students' Facebook accounts, discovered it and turned it over to the local police.
Hause was charged with three counts of violating Ohio code 4301.69, which says no person "shall knowingly allow any underage person to remain in or on the place while possessing or consuming beer or intoxicating liquor," unless a parent or legal guardian is present and approves. (Underage person is defined as someone under 21 years old.)
State prosecutors alleged that Hause allowed the cheerleaders to consume Smirnoff, Sparks, and beer at her home and presented testimony from two of the minors who claimed that Hause participated in drinking games with them.
A second Facebook photo from the same gathering showed another minor holding a can of Sparks, a caffeinated alcoholic beverage.
For her part, Hause said that she didn't know at first that the cheerleaders were drinking, and when she found out, she kicked them out.
"I went downstairs and I saw the kids down there," she said, according to a report by the local ABC affiliate. "I sat on the couch and the girls -- they know me because of working at the school --they all jumped in my lap. And I did take the picture and I didn't notice anything right away."
Her testimony proved to be less than convincing: a jury convicted her and she was sentenced to 30 days in jail, a $500 fine, 10 days of trash pickup, and three years of probation that prohibits her from drinking alcohol or having it in her house.
"What should have happened when you discovered that these kids were drinking is that immediate action should have taken place... that all of these parents should have been notified and that your actions should have been very, very different," trial judge Judge Donald Oda II said, according to the transcript.
Hause appealed, saying the no-alcohol-on-probation rule was an abuse of the judge's discretion, that there should have been one charge instead of three, and the law is unconstitutionally overbroad. On February 9, an appeals court upheld her conviction and sentence.
The Dayton Daily News reported last year that the school decided not to punish the cheerleaders.
Excerpts from the recent opinion from the Court of Appeals of Ohio, Twelfth District, Warren County:
Appellant argues the trial court abused its discretion in imposing as conditions of community control that she not consume or possess alcohol and that she not have alcohol in her household. Appellant argues these conditions do not relate to the crimes for which she was found guilty.
The trial court has broad discretion in imposing conditions of community control pursuant to R.C. 2929.25(A)(1), which governs the authority of the trial court to impose one or more community control sanctions in misdemeanor violations, including residential, nonresidential, and financial sanctions, and any other conditions the court considers appropriate. We will not reverse such conditions imposed absent an abuse of the trial court's discretion.
A trial court's discretion in imposing community control conditions is not limitless, however. In determining whether a condition reasonably relates to the three probationary goals -- doing justice, rehabilitating the offender, and insuring good behavior -- a court "should consider whether the condition (1) is reasonably related to rehabilitating the offender, (2) has some relationship to the crime convicted, and (3) relates to conduct which is criminal or reasonably related to future criminality and serves the statutory ends of probation." In addition, the community control conditions "cannot be overly broad so as to unnecessarily impinge upon the probationer's liberty."
After reviewing the entire record, we find the trial court acted within its discretion by concluding the restrictions on alcohol use and possession as conditions of appellant's community control, as applied to appellant only, are reasonably related to rehabilitating the offender, have a reasonable relationship to the crime charged, are reasonably related to future criminality and serve the statutory ends of probation. Appellant was convicted of an alcohol-related offense-allowing juveniles to consume alcohol in her home. If she is not allowed to possess or consume alcohol or have alcohol in her home, it is less likely that juveniles will consume alcohol in her home...
Judgment affirmed.





