Security quotes of the week

In an ideal world, schools should be actively preparing pupils to be empowered citizens in a digital world that is increasingly riddled with exploitative and coercive systems. Instead, the [UK] government is forcing schools to collect data that are then sold or given to firms that exploit it, with no meaningful consent. There is not even the normal right to request subject access [so] you can check whether the information about you is right and have it corrected if it's wrong.

Securus Technologies markets a product to law enforcement that taps into realtime cell-tower data from mobile carriers to produce fine-grained location tracking of anyone carrying a phone; it is nominally marketed to find parolees and wandering Alzheimer's patients, but because it has no checks or balances, cops can query it willy-nilly to find anyone's location.

That's what, Cory Hutcheson, ex-Sheriff of Mississippi County, MO, is accused of doing; prosecutors say that for three years, Hutcheson abused Securus's system to track all kinds of people -- even a local judge -- without a warrant.

Securus claims that it restricts the use of its system to legally permitted surveillance, requiring users to upload warrants or court orders prior to use; but it does not vet or review those orders before granting access. Securus also does not make the alleged court orders visible to carriers before it queries their databases, meaning that the phone companies have to take Securus's word for it.

The carriers, meanwhile, are exploiting a loophole in privacy laws that nominally prohibit selling this kind of data: by burying "consent" to the sale of your location data in their lengthy, never-read agreements, the carriers are able to circumvent the law; primarily to sell your data to marketers, but also to surveillance companies like Securus.

A hacker has broken into the servers of Securus, a company that allows law enforcement to easily track nearly any phone across the country, and which a US Senator has exhorted federal authorities to investigate. The hacker has provided some of the stolen data to Motherboard, including usernames and poorly secured passwords for thousands of Securus' law enforcement customers.

Although it's not clear how many of these customers are using Securus's phone geolocation service, the news still signals the incredibly lax security of a company that is granting law enforcement exceptional power to surveill individuals.

Security is never something we actually want. Security is something we need in order to avoid what we don't want. It's also more abstract, concerned with hypothetical future possibilities. Of course it's lower on the priorities list than fundraising and press coverage. They're more tangible, and they're more immediate.

This is all to the attackers' advantage.