Experian’s Data Breach Preparedness Study: Increased Investments in Security Aren’t Stopping Breaches Security Magazine
“data breach” – read more
Another lawsuit has arisen from the Office of Legal Counsel’s ongoing refusal to allow the general public to see its legal memos. The OLC claims these are categorically exempt from FOIA law because they constitute “deliberative” documents and/or are protected by attorney-client privilege.
But they’re not “deliberative.” In some cases — if not many cases — the OLC’s guidance tells government agencies what they can and can’t do legally, providing justification for warrantless searches, extrajudicial drone strikes, and lots of domestic surveillance.
In essence, the OLC is creating secret laws. Stupid amateurs (meaning the citizens who pay for the office that refuses to speak with them on an FOIA basis) apparently have no business knowing what the government has decided its okay for it to do.
Once in a long while, a FOIA lawsuit forces a legal memo out of the office’s hands. But for the most part, an unknown number of legal opinions remain locked up out of the reach of the citizens the government is supposed to be accountable to.
The Knight First Amendment Institute is hoping a lawsuit will finally trigger a document dump from the opacity-prone OLC. FOIA law has changed in recent years, but the OLC has apparently chosen to ignore this.
In 2016… Congress amended the Freedom of Information Act to prohibit agencies from withholding as “deliberative” records more than 25 years old.
[…]
On February 15, 2019, the Knight Institute submitted a request to the OLC for all of its formal written opinions issued prior to February 15, 1994. To date, the government has failed to comply with the request.
Since Congress has said older opinions can’t be considered “deliberative” any longer, it’s assumed the OLC will now claim these documents are protected by attorney-client privilege. The problem for litigants is the OLC’s unending relationship with the government agencies it advises. These attorneys and clients are eternally inseparable.
The OLC can’t even be bothered with half-assed compliance. This goes hand-in-hand with its barely-there transparency efforts over the past few decades.
As the lawsuit [PDF] points out, the OLC has been (very selectively) releasing decades-old legal opinions. But even with 40+ years lead time, the OLC still can’t bring itself to release more than a small percentage of its secret law stuff.
In 1977, the OLC began to publish a volume of selected opinions given “their value as precedents and as a body of executive law on important matters.” According to the foreword to the first volume, however, approximately 75 percent of the 1977 opinions were excluded from publication.
After 1977, the OLC stopped revealing how many opinions were excluded from its volumes. Some OLC volumes note that a “significant” number were excluded. These statements are consistent with the views of at least one former OLC official, who has stated that the “published opinions are only the tip of the iceberg.” For example, the same OLC official noted that the office “gave 625 opinions to outside agencies in 1991.” But the 1991 volume of OLC opinions published only 13 opinions, or about 2%.
More recently, the Sunlight Foundation obtained the OLC’s internal list of OLC opinions issued between 1998 and 2012. Comparing the list with the OLC opinions that the office had made public either through its volumes or through FOIA productions, the Sunlight Foundation found that the OLC kept almost 40 percent of the office’s opinions secret over that period.
Hopefully, this litigation will force the agency to take a bright line approach to its legal opinions. They’re given the full weight of the law by the agencies that comply with them, and yet the OLC continues to claim these are just suggestions and attorney-client conversations. But they’re far more than that. They’re laws the public can’t read, can’t comply with, and can’t seek to have changed if they disagree with them.
Permalink | Comments | Email This Story
Techdirt.
Cyber attacks are rewriting the ‘rules’ of modern warfare—and we aren’t prepared for the consequences Phys.Org
Governments are becoming ever more reliant on digital technology, making them more vulnerable to cyber attacks. In 2007, Estonia was attacked by …
With all the news about the ongoing government shutdown and the big messes it has caused, it’s creating lots of little messes with potentially big impact as well. For example, scammers and robocallers have upped their game during the shutdown, knowing that (1) there’s no one investigating these scams right now, and (2) as I discovered when I tried to report one, the FTC has literally shut down the web portal where you used to be able to submit complaints.
Another one, however, pointed out last week by Netcraft, is the fact that government website security certificates are expiring… and there’s no one around to renew them:
Dozens of U.S. government websites have been rendered either insecure or inaccessible during the ongoing U.S. federal shutdown. These sites include sensitive government payment portals and remote access services, affecting the likes of NASA, the U.S. Department of Justice, and the Court of Appeals.
With around 400,000 federal employees currently furloughed, more than 80 TLS certificates used by .gov websites have so far expired without being renewed. To compound the situation, some of these abandoned websites can no longer be accessed due to strict security measures that were implemented long before the shutdown started.
As Netcraft notes, some of those sites you can’t even get around the security warning, such as certain DOJ sites:
There are some government websites that you can click through on, but as Netcraft notes, this could allow for man-in-the-middle attacks or other security risks:
This introduces some realistic security concerns, as task-oriented users are more likely to ignore these security warnings, and will therefore render themselves vulnerable to man-in-the-middle attacks.
If the shutdown continues for a while, this problem could get significantly worse. I know that Wall Street put pressure on the government to make certain IRS employees suddenly deemed “essential” to help Wall Street keep functioning smoothly, perhaps someone might want to deem the people renewing security certs similarly essential? Or, you know what, maybe just re-open the damn government.
Permalink | Comments | Email This Story
Techdirt.