Tuesday, September 10, 2013

Johns Hopkins forces cryptography professor to take NSA-critical blog post down

A Johns Hopkins crytography professor was asked to remove a blog post of his, one which discussed in detail the recent revelations about the NSA and its ability to sidestep encryption. Although the post was authored last week, the revelation of its removal didn't appear until Monday (via Ars).

Matthew Green is that well-known cryptography professor, and he currently teaches in the computer science department of Johns Hopkins University in Baltimore, Md. Last week, he wrote a blog post about last week’s revelations that the NSA had successfully defeated encryption standards. The post had linked to leaked government documents published by ProPublica, the Guardian, and the New York Times.

The post was critical of the NSA, saying that:
The TL;DR ["too long; didn't read" version] is that the NSA has been doing some very bad things.
Green continued, speculating at some length just what the NSA's "bad things" were.

Green said the proper term was speculation, as he never had access to the original documents that sources the stories. He said:
And since I never got a chance to see the documents that sourced the NYT/ProPublica story -- and I would give my right arm to see them -- I'm determined to make up for this deficit with sheer speculation.
On Monday, Green's academic dean contacted him to ask that "all copies" of the blog post be removed from university servers. It was perhaps a silly request, as Green mirrors his blog on Google's Blogger service. In addition, it seems that common sense would say that traffic would only increase as the news of the takedown got out.

Appareently, though, the university objected as the blog post contained links to what it called classified material -- and also used the NSA logo. Possibly, the NSA logo could have been obtained from Wikimedia Commons, but that is unclear.

At any rate, Green pulled it down.

After questioning by Ars, though, the university relented:
The university received information this morning that Matthew Green’s blog contained a link or links to classified material and also used the NSA logo. For that reason, we asked Professor Green to remove the Johns Hopkins-hosted mirror site for his blog.

Upon further review, we note that the NSA logo has been removed and that he appears to link to material that has been published in the news media. Interim Dean Andrew Douglas will inform Professor Green that the mirror site may be restored.
Green tweeted about the issue (in several posts, merged below):
So listen, I'm trying not to talk about this much because anything I say will make it worse. What I've been told is that someone on the APL [Johns Hopkins' Applied Physics Laboratory—motto: "Enhancing national security through science and technology"] side of JHU discovered my blog post and determined that it was hosting/linking to classified documents. This requires a human since I don't believe there's any automated scanner for this process. It's not clear to me whether this request originated at APL or if it came from elsewhere. All I know is that I received an e-mail this morning from the Interim Dean of the Engineering school asking me to take down the post and to desist from using the NSA logo. He also suggested I should seek counsel if I continued. In any case I made it clear that I would not shut down my non-JHU blog, but I did shut down a JHU-hosted mirror. I also removed the NSA logo. I did not remove any links or photos of NOW PUBLIC formerly classified material, because that would just be stupid.

I'm baffled by this entire thing. I hope to never receive an e-mail like that again and I certainly believe JHU (APL) is on the wrong side of common sense and academic freedom, regardless of their obligations under the law. That said, I have no desire to cause trouble for any of the very good people at JHU so I'll keep my posts off JHU property. I have no idea if this was serious or a tempest in a teapot.

What I have learned: Twitter is really a terrible way to give this explanation. Ow, my thumbs...
From what Green tweeted, and what he was told, Johns Hopkins did not receive a request from an outside agency (meaning, the NSA) to have the post removed. They also confirmed this in a statement, in which the university said:
We did not receive any inquiry from the federal government about the blog or any request from the government to take down the mirror site. (Or of course, the personal site, though that never was taken down and we never asked that it be taken down). As to where the information came from, we are still tracing the path of this event, which all exploded into our notice over the past couple of hours.
Conspiracy theorists will note that Johns Hopkins is a short drive from the NSA’s headquarters at Fort Meade, Md., and works closely with the agency. In fact, the university’s Applied Physics Laboratory, which employs about 5,000 people, participates in many projects with the NSA.

No comments: