Fifth Circuit Says Man Can’t Sue Federal Agencies For Allegedly Targeting and Tormenting Him After He Refused To Be An FBI Informant

The secrecy surrounding all things national security-related continues to thwart lawsuits alleging rights violations. The Fifth Circuit Court of Appeals has just dumped a complaint brought by Abdulaziz Ghedi, a naturalized American citizen who takes frequent trips to Somalia, the country he was born in. According to Ghedi’s complaint, rejecting the advances of one federal agency has subjected him to continuous hassling by a number of other federal agencies.

The Appeals Court decision [PDF] opens with a paragraph that telegraphs the futility of Ghedi’s effort, as well as the ongoing string of indignities the government has decided to inflict on people who just want to travel.

Abdulaziz Ghedi is an international businessman who regularly jets across the globe. Frequent travelers, however, are not always trusted travelers. In recent years, Ghedi has had repeated run-ins with one of America’s most beloved institutions: modern airport security.

The general indignities were replaced with seemingly more personal indignities when Ghedi decided he wasn’t interested in working part-time for the feds.

Ghedi complains that ever since he refused to be an informant for the Federal Bureau of Investigation a decade ago, he has been placed on a watchlist, leading to “extreme burdens and hardship while traveling.”

This isn’t a novel complaint. This has happened to plenty of immigrants and US citizens who visit countries the federal government finds interesting. Many, many Muslims have been approached by the FBI to work as informants. And many have reported their traveling experiences got noticeably worse when they refused to do so.

Without moving past a motion to dismiss, there can be no discovery. And national security concerns means there isn’t going to be much to discover, even if a plaintiff survives a first round of filings.

Unsurprisingly, the Government refuses to confirm or deny anything.

That put Ghedi in the crosshairs of “a byzantine structure featuring an alphabet soup of federal agencies,” as the court puts it. The DHS oversees everything. Day-to-day hassling is handled by the TSA (domestic travelers) and the CBP (international travelers). Ghedi saw more of one (CBP) than the other, but the TSA still handles screening of passengers and luggage, so he saw plenty of both.

The refusal to join the FBI as a paid informant apparently led to all of the following:

• an inability to print a boarding pass at home, requiring him to interact with ticketing agents “for an average of at least one hour, when government officials often appear and question” him;

• an SSSS designation on his boarding passes;

• TSA searches of his belongings, “with the searches usually lasting at least an hour”;

• TSA pat downs when departing the U.S. and CBP pat downs when returning to the U.S.;

• encounters with federal officers when boarding and deboarding planes;

• questioning and searches by CBP officers “for an average of two to three hours” after returning from international travel;

• CBP confiscation of his laptop and cellphone “for up to three weeks”;

• being taken off an airplane two times after boarding; and

• being detained for seven hours by DHS and CBP officials in Buffalo, New York in May 2012 and being detained in Dubai for two hours in March 2019.

Ghedi approached the DHS through its court-mandated redress program to inquire about his status twice — once in 2012 and again in 2019. In both cases, the DHS refused to confirm or deny anything about his travel status or his placement on any watchlists that might result in enhanced screening and extended conversations with federal agents every time he flew.

Ghedi sued the heads of all the agencies involved, alleging rights violations stemming from his refusal to become an informant and his apparent placement on some watchlist operated by these agencies.

Ghedi brings two Fourth Amendment claims. The first alleges that the heads of the DHS, TSA, and CBP violated his Fourth Amendment rights through “prolonged detentions,” and “numerous invasive, warrantless patdown searches” lacking probable cause. The second alleges that the heads of the DHS, TSA, and CBP also violated his Fourth Amendment rights through their agents conducting “warrantless searches of his cell phones without probable cause.” The Fourth Amendment protects “[t]he right of the people to be secure in their persons . . . and effects, against unreasonable searches and seizures.”

The district court said he had no standing to sue. The Fifth Circuit says he does. But standing to sue doesn’t matter if you sue the wrong people. The Appeals Court says there’s a plausible injury alleged here, but it wasn’t perpetrated by the named defendants.

Even though we hold that Ghedi has plausibly alleged an injury in fact, he still must satisfy standing’s second prong—that his injury is fairly traceable to these Defendants. Here Ghedi’s Fourth Amendment claims falter. That is because Ghedi bases his Fourth Amendment claims on TSA and CBP agents’ searching him and seizing his electronics. He argues these searches and seizures are atypical actions, even for people on the Selectee List. Yet instead of suing these agents directly, Ghedi has brought his Fourth Amendment claims against the heads of DHS, TSA, and CBP. Ghedi does not allege that any of these officials personally conducted or directed the searches or seizures he has experienced. And his allegations that his experiences are atypical cut against an inference that these agents are following official policy.

Not only that, but the court says Ghedi has never been prevented from traveling. At worst, traveling has become a constant hassle, marked by hours-long delays, unexplained device seizures, and plenty of unwanted conversations with federal agents. But ultimately Ghedi got where he was going and I guess that’s good enough.

Ghedi never alleges that he was prevented from ultimately getting to his final destination. At most, these allegations lead to a reasonable inference that the Government has inconvenienced Ghedi. But they do not plausibly allege a deprivation of Ghedi’s right to travel.

There are some rights the court will recognize but this isn’t one of them.

In short, Ghedi has no right to hassle-free travel. In the Supreme Court’s view, international travel is a “freedom” subject to “reasonable governmental regulation.” And when it comes to reasonable governmental regulation, our sister circuits have held that Government-caused inconveniences during international travel do not deprive a traveler’s right to travel.

And, putting the final nail in Ghedi’s litigation coffin, the Appeals Court says the government’s secrets may harm individuals but they can’t harm their reputation… because they’re secret.

As we noted at the outset, Ghedi’s status on the Selectee List is a Government secret. Simply put, secrets are not stigmas. The very harm that a stigma inflicts comes from its public nature. Ghedi pleaded no facts to support that the Government has ever published his status—one way or the other—on the Selectee List. His assertions that the Government has attached the “stigmatizing label of ‘suspected terrorist’” and “harm[ed] . . . his reputation” are legal conclusions, not factual allegations.

That’s how it goes for litigants trying to sue over rights violations perpetrated by agencies engaged in the business of national security. Allegations are tough to verify because the government refuses to confirm, deny, or even discuss a great deal of its national security work in court. Ghedi could always try this lawsuit again, perhaps armed with FOIA’ed documents pertaining to his travels and the many agencies that make it difficult for him. But that’s as unlikely to result in clarifying information for the same reason: national security.

[…]

Source: Fifth Circuit Says Man Can’t Sue Federal Agencies For Allegedly Targeting Him After He Refused To Be An FBI Informant | Techdirt

EU Plans to Ban Trading Practice That Helps Fuel GameStop Value Surge – or retail traders actually trade

The European Commission is planning to ban payment for order flow, paralleling potential U.S. moves to stem a practice that hit the headlines during the meme-stock mania.

A forthcoming review of the Markets in Financial Instruments Directive will include a ban amid other measures to increase transparency, such as a consolidated tape of information about transactions, people familiar with the matter said.

The U.S. Securities and Exchange Commission is separately weighing a ban on payment for order flow, in which trading firms pay retail brokerages to execute their trades. Regulators are concerned that video-game like prompts have encouraged excessive trading on app-based brokerages that fueled a explosive surge in value for GameStop Corp. and other stocks this year.

relates to EU Set to Ban Trading Practice Helping Power Meme-Stock Mania

While the day-trading frenzy is far more muted in Europe than the U.S., the practice of zero-commission trading is starting to cross the Atlantic. That prompted the bloc’s markets watchdog to warn firms and investors in July of the risks arising from payment for order flow.

EXPLAINER: How Payment for Order Flow Works 

A spokesperson for the European Commission declined to comment.

Mairead McGuinness, the EU’s financial services commissioner, said this month regulators were “closely monitoring” payment for order flow. It was difficult to assess how problematic the practice is “because there is no consolidated view of all liquidity and prices of financial instruments traded across execution venues in the European markets.”

McGuinness said the payment for order flow “may lead to retail orders not being executed on terms most favorable to the client but instead on the terms most profitable to brokers,” according to a written response to a question from a European Union lawmaker.

“This would not be in line with the second Markets in Financial Instruments Directive,” she said. It’s also why regulators are “considering proposing legislation to facilitate a consolidated tape that provides all brokers and their clients with such a holistic view” of all liquidity and prices of financial instruments traded across execution venues in the European markets.

Consolidated Tape

The EU is planning to set a separate tape for each asset class, according to the people familiar. Details on delivery, specifications and speed would be set out later. There may be a tender process to choose the provider of a consolidated tape for an asset class.

The current draft notes a 15-minute delay to consolidate the data will remain acceptable, echoing current rules where exchanges should provide their data for free after 15 minutes. Those contributing data to the tape would share its revenue if the tape consolidates data in less than 15 minutes.

Source: EU Plans to Ban Trading Practice That Helps Fuel GameStop Value Surge – Bloomberg

So trying to restrict people from trading is somehow good for “the market”?

Researchers develop program to read any genome sequence and decipher its genetic code – shows underlying evolutionary forces

Yekaterina “Kate” Shulgina was a first year student in the Graduate School of Arts and Sciences, looking for a short computational biology project so she could check the requirement off her program in systems biology. She wondered how genetic code, once thought to be universal, could evolve and change.

That was 2016 and today Shulgina has come out the other end of that short-term project with a way to decipher this genetic mystery. She describes it in a new paper in the journal eLife with Harvard biologist Sean Eddy.

The report details a new computer program that can read the of any organism and then determine its genetic code. The program, called Codetta, has the potential to help scientists expand their understanding of how the genetic code evolves and correctly interpret the genetic code of newly sequenced .

“This in it of itself is a very fundamental biology question,” said Shulgina, who does her graduate research in Eddy’s Lab.

The genetic code is the set of rules that tells the cells how to interpret the three-letter combinations of nucleotides into proteins, often referred to as the building blocks of life. Almost every organism, from E. coli to humans, uses the same genetic code. It’s why the code was once thought to be set in stone. But scientists have discovered a handful of outliers—organisms that use alternative genetic codes—exist where the set of instructions are different.

This is where Codetta can shine. The program can help to identify more organisms that use these alternative genetic codes, helping shed new light on how genetic codes can even change in the first place.

“Understanding how this happened would help us reconcile why we originally thought this was impossible… and how these really fundamental processes actually work,” Shulgina said.

Already, Codetta has analyzed the genome sequences of over 250,000 bacteria and other called archaea for alternative genetic codes, and has identified five that have never been seen. In all five cases, the code for the amino acid arginine was reassigned to a different amino acid. It’s believed to mark the first-time scientists have seen this swap in bacteria and could hint at evolutionary forces that go into altering the genetic code.

[…]

Source: Researchers develop program to read any genome sequence and decipher its genetic code

How to Stop Chrome From Sharing Your Motion Data on Android

[…] Mysk, a duo of app developers and security researchers, recently exposed Chrome’s shadiness on Twitter. In the tweet, Mysk brings to light that, by default, Chrome is sharing your phone’s motion data with the websites you visit. This is not cool.

Why you don’t want third parties accessing your motion data

To start with, this is—as I have pointed out—creepy af. The data comes from your phone’s accelerometer, the sensor responsible for tracking the device’s orientation and position. That sensor makes it possible to switch from portrait to landscape mode, as well as track you and your phone’s motion. For example, it empowers fitness apps to know how many steps you took, so long as you had your phone on you.

Since most of us keep our phones in our pocket or on our person, there is a lot of motion data generated on the device throughout the day. Google Chrome, by design, allows any website you click on to request that motion data, and hands it over with gusto. Researchers have found that these sites use accelerometer data to monitor ad interactions, check ad impressions, and to track your device (well, duh). Those first two, however, are infuriatingly sketchy; websites don’t just want to know if you’ll click on an ad or not, they want to know how you physically interact with these popups. Hey, why stop there? Why not tap into my camera and see what color shirt I’m wearing?

How to stop Chrome from sharing motion data with sites

Delete the app from your phone. Kidding. I know the vast majority of people on Android aren’t going to want to switch from Chrome to another mobile browser. That said, privacy-minded users might want to jump ship to something more reputable—like Firefox—and, if so, good for you.

But there are plenty of benefits to sticking with Chrome, especially on Android (considering the platform is also designed and operated by Google). If you don’t want to take the most drastic step, you can simply toggle a setting to block Google from sharing this data. As Mysk points out in their tweet, you can disable motion-data-sharing from Chrome’s settings.

Here’s how: Open the app, tap the three dots in the top-right corner, then choose “Settings.” Next, scroll down, tap “Site settings,” then “Motion sensors.” Turn off the toggle here to make sure no more third-party sites can ask for your motion data from here on out.

Source: How to Stop Chrome From Sharing Your Motion Data on Android

Got Anything To Talk About? These Dutch Hackers Want You To Say It To Them

As we head into another Northern Hemisphere pandemic winter and hope that things won’t be quite as bad this year, next summer seems an extremely long time away in the future. But it will be upon us sooner than we might think, and along with it will we hope come a resumption of full-scale hacker camps. One of the biggest will be in the Netherlands, where MCH 2022 will take lace at the end of July, and if you’re up to casting your minds ahead far enough for that then they’re inviting submissions to their Call for Participation. Their events are always a memorable and relaxed opportunity to spend a few days in the sun alongside several thousand other like-minded individuals, so we’d urge you to give it some consideration.

If you’ve never delivered a conference talk before then it can be a daunting prospect, but in fact a hacker camp can be an ideal place to give it a first try. Unlike a more traditional technology conference where most of the attendees file into the auditorium, at hacker camps there is so much else on offer that many talks are delivered to only that sub group of attendees for whom the subject is of real interest. So there is less of the huge auditorium of anonymous crowds about it, and more of the small and friendly crowd of fellow enthusiasts. The great thing about our community is that there are as many different interests within it as there are individuals, so whatever your product, specialism, or favourite hobby horse might be, you’ll find people at a hacker camp who’d like to hear what you have to say.

If you’re still seeking inspiration, of course you might find it by looking at the schedule from SHA, the last Dutch camp.

Source: Got Anything To Talk About? These Dutch Hackers Want You To Say It To Them | Hackaday

Microsoft will now snitch on you at work like never before

[…]

this news again comes courtesy of Microsoft’s roadmap service, where Redmond prepares you for the joys to come.

This time, there are a couple of joys.

The first is headlined: “Microsoft 365 compliance center: Insider risk management — Increased visibility on browsers.”

It all sounded wonderful until you those last four words, didn’t it? For this is the roadmap for administrators. And when you give a kindly administrator “increased visibility on browsers,” you can feel sure this means an elevated level of surveillance of what employees are typing into those browsers.

In this case, Microsoft is targeting “risky activity.” Which, presumably, has some sort of definition. It offers a link to its compliance center, where the very first sentence has whistleblower built in: “Web browsers are often used by users to access both sensitive and non-sensitive files within an organization.”

And what is the compliance center monitoring? Why, “files copied to personal cloud storage, files printed to local or network devices, files transferred or copied to a network share, files copied to USB devices.”

You always assumed this was the case? Perhaps. But now there will be mysteriously increased visibility.

“How might this visibility be increased?,” I hear you shudder. Well, there’s another little roadmap update that may, just may, offer a clue.

This one proclaims: “Microsoft 365 compliance center: Insider risk management — New ML detectors.”

Yes, your company will soon have extra-special robots to crawl along after you and observe your every “risky” action. It’s not enough to have increased visibility on browsers. You must also have Machine Learning constantly alert for someone revealing your lunch schedule.

Microsoft offers a link to its Insider Risk Management page. This enjoys some delicious phrasing: “Customers acknowledge insights related to the individual user’s behavior, character, or performance materially related to employment can be calculated by the administrator and made available to others in the organization.”

Yes, even your character is being examined here.

[…]

Source: Microsoft will now snitch on you at work like never before | ZDNet

Robinhood Hack Compromises Millions of Customer Email Addresses

Someone recently hacked and attempted to extort Robinhood, the popular investment and trading platform, gaining access to millions of customers’ email addresses and full names in the process.

The platform revealed the security incident in a blog post published Monday, assuring users that nobody had lost any money as a result of the incident.

“An unauthorized third party obtained access to a limited amount of personal information for a portion of our customers,” the company revealed, while emphasizing that the breach had since been contained and that there had been “no financial loss to any customers.”

The incident, which took place on Nov. 3, was apparently the result of a social engineering scheme that targeted a customer support employee. The hacker convinced the employee that they were cleared to access “certain customer support systems,” and subsequently gained access to the email addresses of approximately 5 million customers and the full names of approximately 2 million customers, the company said.

For a much smaller subset of customers, the data breach was substantially more invasive: “We also believe that for a more limited number of people—approximately 310 in total—additional personal information, including name, date of birth, and zip code, was exposed, with a subset of approximately 10 customers having more extensive account details revealed,” the company’s blog post says.

Afterward, the criminal attempted to extort the company with the information it had stolen.

[…]

Source: Robinhood Hack Compromises Millions of Customer Email Addresses