text: On Wednesday, the St. Louis Post-Dispatch ran a story about how its staff discovered and reported a security vulnerability in a Missouri state education website that exposed the Social Security numbers of 100,000 elementary and secondary teachers. In a press conference this morning, Missouri Gov. Mike Parson (R) said fixing the flaw could cost the state $50 million, and vowed his administration would seek to prosecute and investigate the “hackers” and anyone who aided the publication in its “attempt to embarrass the state and sell headlines for their news outlet.”
  A Little Sunshine
  Aaron Mackey eff Electronic Frontier Foundation Joe Martineau Missouri Department of Elementary and Secondary Education Missouri Gov. Mike Parson St. Louis Post-Dispatch
  Who Owns Your Wireless Service? Crooks Do.
  August 7, 2019
  99 Comments
  Incessantly annoying and fraudulent robocalls. Corrupt wireless company employees taking hundreds of thousands of dollars in bribes to unlock and hijack mobile phone service. Wireless providers selling real-time customer location data, despite repeated promises to the contrary. A noticeable uptick in SIM-swapping attacks that lead to multi-million dollar cyberheists.
  If you are somehow under the impression that you — the customer — are in control over the security, privacy and integrity of your mobile phone service, think again. And you’d be forgiven if you assumed the major wireless carriers or federal regulators had their hands firmly on the wheel.
  A Little Sunshine SIM Swapping The Coming Storm
  Aaron Mackey Andy Greenberg AT&T eff Electronic Frontier Foundation Federal Communications Commission Gigi Sohn Google Voice Nicholas Truglia robocalls SIM swapping wired
  Supreme Court: Police Need Warrant for Mobile Location Data
  June 22, 2018
  24 Comments
  The U.S. Supreme Court today ruled that the government needs to obtain a court-ordered warrant to gather location data on mobile device users. The decision is a major development for privacy rights, but experts say it may have limited bearing on the selling of real-time customer location data by the wireless carriers to third-party companies.
  A Little Sunshine The Coming Storm
  3Cinteractive 4th Amendment Amy Howe AT&T Carpenter v. United States Electronic Frontier Foundation Jennifer Lynch LocationSmart SCOTUSblog.com Securus Technologies Sprint T-Mobile The New York Times U.S. Supreme Court Verizon
  New EU Privacy Law May Weaken Security
  February 15, 2018
  68 Comments
  Companies around the globe are scrambling to comply with new European privacy regulations that take effect a little more than three months from now. But many security experts are worried that the changes being ushered in by the rush to adhere to the law may make it more difficult to track down cybercriminals and less likely that organizations will be willing to share data about new online threats.
  On May 25, 2018, the General Data Protection Regulation (GDPR) takes effect. The law, enacted by the European Parliament, requires technology companies to get affirmative consent for any information they collect on people within the European Union. Organizations that violate the GDPR could face fines of up to four percent of global annual revenues.
  A Little Sunshine The Coming Storm
  Andrew Sullivan eff Electronic Frontier Foundation GDPR General Data Protection Regulation GoDaddy Göran Marby ICANN internet of things IoT Jeremy Malcolm WHOIS privacy
  Is it Time to Can the CAN-SPAM Act?
  July 2, 2017
  72 Comments
  Regulators at the U.S. Federal Trade Commission (FTC) are asking for public comment on the effectiveness of the CAN-SPAM Act, a 14-year-old federal law that seeks to crack down on unsolicited commercial email. Judging from an unscientific survey by this author, the FTC is bound to get an earful.
  Other
  CAN-SPAM Dan Balsam eff Electronic Frontier Foundation FTC Joe Jerome Ron Guilmette
  Dual-Use Software Criminal Case Not So Novel
  April 4, 2017
  75 Comments
  “He built a piece of software. That tool was pirated and abused by hackers. Now the feds want him to pay for the computer crooks’ crimes.”
  The above snippet is the subhead of a story published last month by the Daily Beast titled “FBI Arrests Hacker Who Hacked No One.” The subject of that piece — a 26-year-old American named Taylor Huddleston — faces felony hacking charges connected to two computer programs he authored and sold: An anti-piracy product called Net Seal, and a Remote Administration Tool (RAT) called NanoCore that he says was a benign program designed to help users remotely administer their computers.
  The author of the Daily Beast story, former black hat hacker and Wired.com editor Kevin Poulsen, argues that Huddelston’s case “raises a novel question: When is a programmer criminally responsible for the actions of his users? Some experts say [the case] could have far reaching implications for developers, particularly those working on new technologies that criminals might adopt in unforeseeable ways.”
  But a closer look at the government’s side of the story — as well as public postings left behind by the accused and his alleged accomplices — paints a more complex and nuanced picture that suggests this may not be the case to raise that legal question in a meaningful way.
  Other
  Aeonhack Allison Nixon Blackshades RAT Blackshades trojan Electronic Frontier Foundation fbi Flashpoint Hackforums justice department Kevin Poulsen Limitless Keylogger Mark Rumold Mephobia NanoCore Net Seal RAT remote access trojan remote administration tool Taylor Huddleston TeamViewer and VNC The Daily Beast wired Zachary Shames
  Post-FCC Privacy Rules, Should You VPN?
  March 30, 2017
  198 Comments
  Many readers are understandably concerned about recent moves by the U.S. Congress that would roll back privacy rules barring broadband Internet service providers (ISPs) from sharing or selling customer browsing history, among other personal data. Some are concerned enough by this development that they’re looking at obfuscating all of their online browsing by paying for a subscription to a virtual private networking (VPN) service. This piece is intended to serve as a guidepost for those contemplating such a move.
  Other
  DNS leak eff Electronic Frontier Foundation IPv6 leak President Trump searchinternethistory.com Tor virtual private network vpn
  House Passes Long-Sought Email Privacy Bill
  February 7, 2017
  33 Comments
  The U.S. House of Representatives on Monday approved a bill that would update the nation’s email surveillance laws so that federal investigators are required to obtain a court-ordered warrant for access to older stored emails. Under the current law, U.S. authorities can legally obtain stored emails older than 180 days using only a subpoena issued by a prosecutor or FBI agent without the approval of a judge.
  Other
  CalECPA ECPA eff Electronic Communications Privacy Act Electronic Frontier Foundation Email Privacy Act HR 387 Kevin Yoder Lee Tien pen register trap and trace
  Location Privacy: The Purview of the Rich and Indigent
  September 5, 2016
  89 Comments
  I’d just finished parking my car in the covered garage at Reagan National Airport just across the river from Washington, D.C. when I noticed a dark green minivan slowly creeping through the row behind me. The vehicle caught my attention because its driver didn’t appear to be looking for an open spot. What’s more, the van had what looked like two cameras perched atop its roof — one of each side, both pointed down and slightly off to the side.
  I had a few hours before my flight boarded, so I delayed my walk to the terminal and cut through several rows of cars to snag a video of the guy moving haltingly through another line of cars. I approached the driver and asked what he was doing. He smiled and tilted the lid on his bolted-down laptop so that I could see the pictures he was taking with the mounted cameras: He was photographing every license plate in the garage (for the record, his plate was a Virginia tag number 36-646L).
  I had a few hours before my flight boarded, so I delayed my walk to the terminal and cut through several rows of cars to snag a video of the guy moving haltingly through another line of cars. I approached the driver and asked what he was doing. He smiled and tilted the lid on his bolted-down laptop so I could see the pictures he was taking with the mounted cameras: He was photographing every license plate in the garage (for the record, his plate was a Virginia tag number 36-646L).
  Other
  ALPR automated license plate reader Electronic Frontier Foundation HUB Parking Ilaria Riva Kimberly Gibbs Metropolitan Washington Airports Authority Reagan National Airport Vigilant Solutions
  Help Bring Privacy Laws Into 21st Century
  December 11, 2013
  35 Comments
  Lost in the ongoing media firestorm over the National Security Agency’s domestic surveillance activities is the discussion about concrete steps to bring the nation’s communications privacy laws into the 21st Century. Under current laws that were drafted before the advent of the commercial Internet, federal and local authorities can gain access to mobile phone and many email records without a court-issued warrant. In this post, I’ll explain what federal lawmakers and readers can do to help change the status quo.
  A Little Sunshine Security Tools The Coming Storm
  CDT Center for Democracy & Technology & Technology ECPA eff Electronic Communications Privacy Act Electronic Frontier Foundation mark rasch Mark Stanley Rep. Bob Goodlatte Sen. Patrick Leahy Senator Edward J. Markey