Miro Haller

Miro Haller

PhD Student at UCSD doing cryptanalysis, system security, and privacy. CTF player.

An Empirical Analysis on the Use and Reporting of National Security Letters

1 minute read

Published:

We collect and analyze public information on National Security Letters.

This is a paper outside of my normal research area. We publish the first unified data set, consolidating data reported by the government (e.g., FISA and ASTR reports), companies (transparency reports), and published NSLs themselves. We analyze the collected data and draw conclusions about how the use of NSLs by government agencies developed over time.

Abstract

National Security Letters (NSLs) are similar to administrative subpoenas and can be issued directly by elements of the executive branch without requiring prior approval from a court or grand jury. Importantly, NSLs authorize the imposition of nondisclosure orders (aka “gag orders”) on the receiving party. Controversy about potential abuses of this authority has driven a range of legal and policy discussions. To address these concerns, both the public sector and the private sector have sought to document the usage of NSLs in aggregated form. However, each data source is limited in scope, time, and kind. In this paper, we consolidate the available data around NSLs and answer two questions: (1) what can the public effectively learn from the reported data and does this information suffice to assess the NSL usage? (2) how accessible is this data collection? We show that longitudinal trends in the usage of NSLs can be observed. For instance, we find a significant increase in NSL requests for non-US persons and that the policy reforms to decrease the mandated nondisclosure period appear to be effective. The observed trends suggest that the current transparency mechanisms are viable safeguards against the excessive use of NSLs. However, aggregating and normalizing the data requires manual reviewing, parsing, and validating. We even find inconsistencies within and across official data sources. Overall, the laborious data collection process hinders external and internal auditing efforts and demonstrates the need for a unified and more usable dataset for NSLs.

Full paper

Data Set

Our data set and processing scripts are available on GitHub.

You May Also Enjoy

End-to-End Encrypted Cloud Storage

less than 1 minute read

Published:

Copyright notice. This article is accepted to IEEE Security and Privacy. DOI: 10.1109/MSEC.2024.3352788. Personal use of this material is permitted. Permission from IEEE must be obtained for all other uses, in any current or future media, including reprinting/republishing this material for advertising or promotional purposes, creating new collective works, for resale or redistribution to servers or lists, or reuse of any copyrighted component of this work in other works.

Cloud Storage Systems: From Bad Practice to Practical Attacks

4 minute read

Published:

We show that the cryptographic design of the cloud storage system MEGA does not protect its users against a malicious server and present five distinct attacks, which together allow for a full compromise of the confidentiality of user files.

ECSC Prague 2021

less than 1 minute read

Published:

The European Cyber Security Challenge 2021 in Prague is over! This is a yearly reoccuring event with around 20 (mostly) European countries. Every year, a different state hosts the onsite CTF competition. This year, we had two competition days with over 50 challenges in the categories crypto, reversing, web, forensics, misc, and hardware. Furthermore, there was an escape room and international team challenges.