I hang around people who talk about
security and privacy and activists
quite a bit. When talking security
beyond the typical attackers —
people committing identity theft,
simple vandals, spammers, etc.
— there’s the topic of
government surveillance and legal
attacks, and privacy as a way to
defend political activists against
the powers-that-be. I want to talk
about this security question in
particular.
(Nothing I say here relates to China
or Iran or other places with overtly
oppressive political systems and
without basic legal rights. I
don’t think worth trying to
generalize that far.)
I’m not sure we are getting
this stuff right. I don’t
think the political attacks that are
imagined are serious risks, and the
attacks that are taking place are
far less sophisticated than we
imagine.
Background
I’m taking these lessons
primarily from the experiences
of my sister, who
along with 7 others
is currently facing felony
conspiracy charges in Minnesota
(felony conspiracy to riot with
a dangerous weapon and to commit
property damage). These charges
are specifically for organizing
protests in the lead up to the
2008 RNC convention
in St. Paul. It’s only one
data point, but in these matters
there’s only a handful of
cases that inform the
discussion.
The city of St. Paul and other
local governments received over
$50 million for security for the
RNC, and some of that money was
quickly put into hiring
informants to infiltrate
organizations,
anarchist
organizations in particular. My
sister among others were part of
an organization known as the
RNC Welcoming Committee. In total three informants
were highly involved in the
organization, each of them
attending literally hundreds of
hours of meetings. The Committee
primarily worked on things like
promoting the protests against
the RNC, acquiring meeting space
and internet access for people,
finding housing and food for
people visiting for the
protests, and distributing
logistical information like
where protests would occur.
"Anarchism" means
"without rulers": in
line with their anarchist
principles they didn’t try
to prescribe how people would
protest, they felt people should
make their own choices about how
to protest. The choices people
made were widespread, ranging
from staying in a "free
speech zone" to a few
permitted marches, some
unpermitted marches, some civil
disobedience, some blockading,
and in a very small number of
cases some people committed
property damage. The Welcoming
Committee did not advocate any
particular kind of protest, they
would not be their
brother’s keeper, nor did
they want to disparage any kind
of protest as too timid. Each
person should act on their own
conscience.
Immediately before the RNC
started the 8 were arrested and
held for the duration of the
convention before being charged
and released on bail. Their
houses and cars were searched.
Nothing interesting was found,
though at the time the Sheriff
misrepresented things like bike
inner tubes as possible
slingshot material, or that
having paint thinner in the
basement, rags in the laundry,
and empty bottles in the pantry
constituted Molotov cocktail
ingredients.
The Evidence
The case has progressed very
slowly, but with
recent
hearings
more of the prosecution’s
case has been coming out.
It’s been over a year and
a half and only now are we
getting any indication of what
the real claims are
against the defendants, though
the prosecution continues to
avoid presenting any real case
or plausible complaint.
From the hearings we’re
also learning something about
the form of the investigation.
The FBI was closely involved
with the case and recruited the
most active informant, and the
primary investigator was
previously with the Secret
Service (which
somewhat oddly has a
computer-related duties), and at the time there was a
great deal of national attention
on the convention. So presumably
they had the resources to
investigate seriously if they
wished to do so.
From the perspective of online
security the case is very
boring. The defendants have been
given all the evidence collected
during the investigation
(including benign or even
helpful evidence). It’s a
huge amount of evidence, and
hard for them to understand or
sort through, but some kinds of
investigation aren’t
there. No email accounts were
subpoenaed. Their computers were
all confiscated, and will no
doubt be kept until after the
trial, but there’s nothing
high-tech about that. Some of
them had whole-disk encryption,
and there is no indication it
was broken nor were they even
asked to provide passwords.
There’s also no evidence
of sniffing internet
connections, tapping phones,
breaking into email…
nothing fancy was done.
From what we can tell the
evidence against them will be
primarily from informants’
testimony about open meetings,
widely distributed literature,
a video posted on
YouTube, a password-protected but
essentially open wiki (the wiki
provider was not subpoenaed,
despite things like edit history
being potentially interesting).
If they had been any more
security-conscious it would have
worked against them — it
would have been out of line with
their ideals and would have made
them less effective and
transparent in their organizing
efforts. The biggest danger now
is that they’ll be
demonized, that they’ll be
judged based on caricatures of
their actual beliefs, privacy
only makes this worse.
Credit Where Credit Is Due
Perhaps one reason the
surveillance was low-tech and
subpoenaed evidence is not
playing a large part in the case
is that it’s
just too hard. They
used
Riseup
for many services, which is a
set of online services for
activists, who take privacy very
seriously, log as little as
possible, and try to host
everything outside of the
country so regardless of an
activists locality it will be a
bureaucratic challenge to get
access to the servers.
Outside of the core group most
people acted anonymously, so the
prosecution would not be able to
follow up on most of what they
found anyway. Even if they got
all the logs and email from
everything the Welcoming
Committee touched, I’m not
sure they could make use of it.
If they could somehow relate all
that anonymous information,
they’d still have to
explain those
techniques and convince a jury.
Data mining and other
data-driven techniques could be
useful if they were trying to
attach people
who had done anything
wrong. You can use surveillance to
find the smoking gun, and once
you’ve found it you
don’t have to justify the
techniques you used in the
process. But only if
there’s a smoking gun.
It’s a peculiar situation
where the prosecution
doesn’t appear to actually
believe they did anything
demonstrably wrong; I fear they
plan a case where they redefine
"wrong".
Privacy
Besides the security issue
there’s the privacy issue,
and privacy is big on the
internet these last few months.
One of the oft-claimed benefits
of privacy is to allow political
dissent. And maybe that makes
sense in China, but I
don’t know how it relates
to the things in the U.S. or
Europe.
Political beliefs held in
private don’t much matter.
Complaining about politics in
private situations is fine,
because it just
doesn’t matter. So sure, you are safe from
political persecution if your
privacy is maintained… but
it’s because you are
impotent not because
privacy is some part of a
political struggle.
This reminds me of a playground
sense of privacy. On the
playground you might say you
like They Might Be Giants and
the playground bully says
that’s so gay,
and you think
I shouldn’t have said
anything. But it doesn’t really
matter how much you reveal in
that situation, it doesn’t
matter what you say you like
— the bully isn’t
making a pointed critique on
your preferences, they are just
trying to hurt you. The only way
privacy will help you is if you
are so quiet that the
bully doesn’t notice you
at all and picks on someone else
instead. That’s a pathetic
stance.
Ramsey County (where the RNC 8
are being charged) is a bully.
They decided before the
Welcoming Committee even existed
that people were going to be
arrested, charges were going to
be made. The Welcoming Committee
stuck their necks out further
than anyone else. The problem
isn’t that they made
themselves vulnerable, the
problem is that the
Sheriff Fletcher
is a bully and
County Attorney Gaertner
is some kind of automaton who
doesn’t give a shit about
justice.
And Lastly A Personal Plea
So… while there are
general lessons, this case also
specifically really
sucks for my sister Monica, her
significant other Eryn (another
member of the Welcoming
Committee) and the other six,
all of whom I know and are
really nice people who
don’t deserve any of this
shit. They have to spend their
evenings reading through
evidence or listening to the
tapes of their meetings (which
were boring enough to listen to
the first time around).
There’s a certain stigma
to having pending felony
charges, I know at least my
sister has lost a job because of
it. And they each have to have
their own lawyer, and even
though the lawyers aren’t
charging them what would be the
full rate it’s still a lot
of money (like a quarter of a
million dollars). Depressingly,
in some sense this is all the
government has to do; the trial
is punishment enough to deter
people from being activist
organizers.
So I wish a
donation
was equivalent to Sticking It To
The Man, but really it’s
just adding some balance because
The Man Is Already Sticking It
To Them On Your Behalf.
Still,
your support would be
really helpful.
If it gives you any satisfaction
County Attorney Susan
Gaertner’s run for the
Democratic gubernatorial
nomination never went anywhere,
I suspect in large part because
she wasn’t brave enough to
show her face at public events
in the Twin Cities because she
was consistently protested over
this case. I doubt this has
influenced the prosecution (at
least in any positive way), but
it’s satisfying.