Sally Yates Doth Protest Too Much

Some months ago Ninth Circuit Judge Alex Kozinski wrote an important piece talking about the many way criminal prosecutions are not fair. A lot of it focused on the imperfect process behind key ingredients of prosecutions — eye witness testimony, fingerprint analysis, plea deals. But he also reprised his argument that we’ve seen an epidemic of Brady violations in recent years.

The Supreme Court has told us in no uncertain terms that a prosecutor’s duty is to do justice, not merely to obtain a conviction.38 It has also laid down some specific rules about how prosecutors, and the people who work for them, must behave—principal among them that the prosecution turn over to the defense exculpatory evidence in the possession of the prosecution and the police.39 There is reason to doubt that prosecutors comply with these obligations fully. The U.S. Justice Department, for example, takes the position that exculpatory evidence must be produced only if it is material.40 This puts prosecutors in the position of deciding whether tidbits that could be helpful to the defense are significant enough that a reviewing court will find it to be material, which runs contrary to the philosophy of the Brady/Giglio line of cases and increases the risk that highly exculpatory evidence will be suppressed. Beyond that, we have what I have described elsewhere as an “epidemic of Brady violations abroad in the land,”41 a phrase that has caused much controversy but brought about little change in the way prosecutors operate in the United States.

As Zoe Tillman writes, the DOJ is rolling out an effort to tell itself that the mean things said by a top Appellate judge aren’t true. Deputy Attorney General Sally Yates is going to give a speech telling prosecutors not to listen to that mean bully.

Deputy Attorney General Sally Yates on Tuesday is expected to deliver a rallying speech to a meeting of prosecutors that is a further response—albeit indirect—to Kozinski’s article.

Yates will say that the “overwhelming majority” of prosecutors honor their legal and ethical obligations, including the requirement that they turn over potentially favorable information to defense lawyers, according to a copy of her prepared remarks.

Yates’ planned remarks criticize defense lawyers who make allegations of prosecutorial misconduct “a standard litigation strategy,” and others who “irresponsibly” make misconduct allegations.

“Prosecutors are in these jobs because we care about our solemn obligation to seek justice, and when someone unfairly impugns that commitment, it strikes at the core of who we are,” Yates, who will speak at the National Prosecution Summit in Washington, is expected to say.

And the Associate Deputy Attorney General Andrew Goldsmith and U.S. Attorney John Walsh of Colorado wrote this letter, attempting to rebut that mean bully.

On its face, the entire effort is farcical. In recent years, DOJ has rewarded lawyers who helped it get away with misconduct. It failed, for years to give proper notice of Section 702 surveillance to defendants, and still hasn’t corrected the record with the Supreme Court about its false claim that it had been doing so. And until this summer, David Margolis served as an unwavering shield against DOJ actually disciplining its own.

But the funniest part of DOJ’s pushback is this paragraph from Goldsmith and Walsh’s letter.

On several occasions, Judge Kozinski referenced the prosecution of former senator Ted Stevens. The Stevens case, as others have noted, involved significant discovery failures and deserves to be held up as an object lesson to prosecutors. But the Department’s efforts in the aftermath of that case also deserve discussion. One of Eric Holder’s first acts after his swearing in as Attorney General was to seek dismissal of the conviction. In the months that followed, the Department undertook a sweeping review of its discovery-related procedures and instituted a string of new policies. All federal prosecutors, regardless of experience level, are now required to attend annual discovery trainings, while new prosecutors must attend rigorous, multi-day “discovery boot camps.” The Department developed a series of new policies governing the collection and disclosure of electronically stored information. And the Department established an extensive infrastructure of experienced prosecutors to focus on discovery issues, including a full-time national criminal discovery coordinator (who reports directly to the Deputy Attorney General, second only to the Attorney General herself at the Department of Justice) and discovery coordinators at each of the 93 U.S. Attorney’s Offices across the country.

That mean bully Alex Kozinski was wrong to bring up the time DOJ engaged in willful prosecutorial misconduct even of one of the most powerful men in the country, they say, because when caught doing so DOJ rolled out a system to try to prevent that from happening again.

Except that’s not all DOJ did. First, it went to great lengths to hide the independent review of its actions — a review which showed fairly rampant abuse. Then, when it conducted its own discipline of those who engaged in that abuse, it not only focused on the lower level prosecutors, but it also did nothing more than slap their wrists.

A Justice Department internal investigation of the botched prosecution of Ted Stevens concluded two prosecutors committed reckless professional misconduct and should be sanctioned through forced time off without pay.

DOJ officials recommended Joseph Bottini be suspended without pay for 40 days and James Goeke be suspended for 15 days without pay. DOJ did not find that either prosecutor acted intentionally to violate ethics rules, a finding that is contrary to a parallel criminal investigation.

Again, the Stevens case is a picture of what happens when prosecutorial misconduct is wielded against a very powerful white man — someone far more protected from abuse than the average federal defendant — and this is how things ended up, with a wrist-slap.

Maybe under her tenure, Yates plans to change this. Or maybe she just wants prosecutors not to worry too much about that bully in the Ninth.

But she needs to prove her intent through actions, not words, and thus far there’s little sign of those actions.

Update: Patrick Toomey also reminds me that DOJ the National Association of Criminal Defense Lawyers has been trying to get DOJ to share its guidelines on Brady, but thus far they’ve refused to give it over. NACDL has now appealed that to the DC Circuit.

Tweet about this on TwitterShare on RedditShare on FacebookGoogle+Email to someone

Author of Story Based on Leaks about Surveillance Parrots Brennan Condemning Leaks about Surveillance

Josh Rogin is among many journalists who covered John Brennan’s complaints about how “a number of unauthorized disclosures”and hand-wringing about our surveillance capabilities this morning (which was a response to Rogin asking “what went wrong” in Paris in questions).

But Brennan also said that there had been a significant increase in the operational security of terrorists and terrorist networks, who have used new commercially available encryption technologies and also studied leaked intelligence documents to evade detection.

“They have gone to school on what they need to do in order to keep their activities concealed from the authorities,” he said. “I do think this is a time for particularly Europe as well as the U.S. for us to take a look and see whether or not there have been some inadvertent or intentional gaps that have been created in the ability of intelligence services to protect the people that they are asked to serve.”

The FBI has said that Internet “dark spaces” hinder monitoring of terrorism suspects. That fuels the debate over whether the government should have access to commercial applications that facilitate secure communications.

Brennan pointed to “a number of unauthorized disclosures” over the past several years that have made tracking suspected terrorists even more difficult. He said there has been “hand wringing” over the government’s role in tracking suspects, leading to policies and legal action that make finding terrorists more challenging, an indirect reference to the domestic surveillance programs that were restricted after leaks by Edward Snowden revealed their existence.

I find it interesting that Rogin, of all people, is so certain that this is an “indirect reference to the domestic surveillance programs that were restricted after leaks by Edward Snowden revealed their existence.” It’s a non-sensical claim on its face, because no surveillance program has yet been restricted in the US, though FBI has been prevented from using NSLs and Pen Registers to bulk collection communications. The phone dragnet, however, is still going strong for another 2 weeks.

That reference — as I hope to show by end of day — probably refers to tech companies efforts to stop the NSA and GCHQ from hacking them anymore, as well as European governments and the EU trying to distance themselves from the US dragnet. That’s probably true, especially, given that Brennan emphasized international cooperation in his response.

I’m also confused by Rogin’s claim Jim Comey said Tor was thwarting FBI, given that the FBI Director said it wasn’t in September.

Even more curious is that Rogin is certain this is about Snowden and only Snowden. After all, while Snowden’s leaks would give terrorists a general sense of what might not be safe (though not one they tracked very closely, given the Belgian Minister of Home Affair’s claim that they’re using Playstation 4 to communicate, given that one of Snowden’s leaks said NSA and CIA were going after targets use of gaming consoles to communicate at least as early as 2008).

But a different leak would have alerted terrorists that their specific communications techniques had been compromised. The leak behind this story (which was a follow-up on leaks to the NYT, McClatchy, and WaPo).

It wasn’t just any terrorist message that triggered U.S. terror alerts and embassy closures—but a conference call of more than 20 far-flung al Qaeda operatives, Eli Lake and Josh Rogin report.
The crucial intercept that prompted the U.S. government to close embassies in 22 countries was a conference call between al Qaeda’s senior leaders and representatives of several of the group’s affiliates throughout the region.

The intercept provided the U.S. intelligence community with a rare glimpse into how al Qaeda’s leader, Ayman al-Zawahiri, manages a global organization that includes affiliates in Africa, the Middle East, and southwest and southeast Asia.

Several news outlets reported Monday on an intercepted communication last week between Zawahiri and Nasser al-Wuhayshi, the leader of al Qaeda’s affiliate based in Yemen. But The Daily Beast has learned that the discussion between the two al Qaeda leaders happened in a conference call that included the leaders or representatives of the top leadership of al Qaeda and its affiliates calling in from different locations, according to three U.S. officials familiar with the intelligence. All told, said one U.S. intelligence official, more than 20 al Qaeda operatives were on the call.


Al Qaeda leaders had assumed the conference calls, which give Zawahiri the ability to manage his organization from a remote location, were secure. But leaks about the original intercepts have likely exposed the operation that allowed the U.S. intelligence community to listen in on the al Qaeda board meetings.

That story — by Josh Rogin himself! (though again, this was a follow-up on earlier leaks) — gave Al Qaeda, though maybe not ISIS, specific notice that one of their most sensitive communication techniques was compromised.

It’s really easy for journalists who want to parrot John Brennan and don’t know what the current status of surveillance is to blame Snowden. But those who were involved in the leak exposing the Legion of Doom conference call (which, to be sure, originated in Yemen, as many leaks that blow US counterterrorism efforts there do) might want to think twice before they blame other journalism.

Tweet about this on TwitterShare on RedditShare on FacebookGoogle+Email to someone

DOJ Still Gets a Failing Grade on Strong Authentication

In DOJ’s Inspector General’s annual report on challenges facing the department, Michael Horowitz revealed how well DOJ is complying with the Office of Management and Budget’s directive in the wake of the OPM hack that agencies improve their own cybersecurity, including by adopting strong authentication for both privileged and unprivileged users.

DOJ’s still getting a failing grade on that front — just 64% of users are in compliance with requirements they use strong authentication.

Following OMB’s directive, the White House reported that federal civilian agencies increased their use of strong authentication (such as smartcards) for privileged and unprivileged users from 42 percent to 72 percent. The Justice Department, however, had among the worst overall compliance records for the percentage of employees using smartcards during the third quarter of FY 2015 – though it has since made significant improvements, increasing to 64 percent of privileged and unprivileged users in compliance by the fourth quarter. Given both the very sensitive nature of the information that it controls, and its role at the forefront of the effort to combat cyber threats, the Department must continue to make progress to be a leader in these critical areas.

Ho hum. These are only the databases protecting FBI’s investigations into mobs, terrorists, and hackers. No reason to keep those safe.

In any case, it may be too late, as the Crackas with Attitude already broke into the portal for some of those databases.

Ah well, we’ll just dump more information into those databases under CISA and see if that prevents hackers.

Tweet about this on TwitterShare on RedditShare on FacebookGoogle+Email to someone

Surveillance Hawk Stewart Baker Confirms Dragnet Didn’t Work as Designed

The French authorities are just a day into investigating the horrid events in Paris on Friday. We’ll know, over time, who did this and how they pulled it off. For that reason, I’m of the mind to avoid any grand claims that surveillance failed to find the perpetrators (thus far, French authorities say they know one of the attackers, who is a French guy they had IDed as an extremist, but did not know of people identified by passports found at the Stade — though predictably those have now been confirmed to be fake [update: now authorities say the Syrian one is genuine, though it’s not yet clear it belonged to the attacker], so authorities may turn out to know their real identity). In any case, Glenn Greenwald takes care of that here. I think it’s possible the terrorists did manage to avoid detection via countersurveillance — though the key ways they might have done so were available and known before Edward Snowden’s leaks (as Glenn points out).

But there is one claim by a surveillance hawk that deserves a response. That’s former DHS and NSA official Stewart Baker’s claim that because of this attack we shouldn’t stop the bulk collection of US persons’ phone metadata.

Screen Shot 2015-11-15 at 7.41.03 AM

The problem with this claim is that the NSA has a far more extensive dragnet covering the Middle East and Europe than it does on Americans. It can and does bulk collect metadata overseas without the restrictions that existed for the Section 215 dragnet. In addition to the metadata of phone calls and Internet communications, it can collect GPS location, financial information, and other metadata scraped from the content of communications.

The dragnet covering these terrorists is the kind of dragnet the NSA would love to have on Americans, if Americans lost all concern for their privacy.

And that’s just what the NSA (and GCHQ) have. The French have their own dragnet. They already had permission to hold onto metadata, but after the Charlie Hebdo attacks, they expanded their ability to wiretap without court approval. So the key ingredients to a successful use of the metadata were there: the ability to collect the metadata and awareness that one of the people was someone of concern.

The terrorists may have used encryption and therefore made it more difficult for authorities to get to the content of their Internet communications (though at this point, any iPhone encryption would only now be stalling investigators).

But their metadata should still have been available. There’s no good way to hide metadata, which is why authorities find metadata dragnets so useful.

French authorities knew of at least one of these guys, and therefore would have been able to track his communication metadata, and both the Five Eyes and France have metadata dragnets restricted only by technology, and therefore might have been able to ID the network that carried out this attack.

Stewart Baker claims that Section 215 was designed to detect a plot like this. But the metadata dragnet covering France and the Middle East is even more comprehensive than Section 215 ever was. And it didn’t detect the attack (it also didn’t detect the Mumbai plot, even though — or likely because — one of our own informants was a key player in it). So rather than be a great argument for why we need to keep a dragnet that has never once prevented an attack in the US, Baker’s quip is actually proof that the dragnets don’t work as promised.


Tweet about this on TwitterShare on RedditShare on FacebookGoogle+Email to someone

Je Suis Paris Trash Talk

It is a little hard to get too excited about this weekend’s games with all of what is going on across the pond in Paris. My daughter had been scheduled to be in Paris yesterday and for the weekend until a last minute change in one of her classes left her still in England. You cannot imagine how relieved we were that she was not there. But there are friends of this blog that do live in Paris and/or have significant family there, and our thoughts go out to them.

With that said, we’ll take a brief look at the sporting festivities this weekend, even if the realities of the world have brutally reminded us that games are just that. In fact, there was a rather large soccer match in Paris between France and Germany that got that reminder up close and personal yesterday.

In the college ranks, by far the biggest matchup is in the Big-12 where Oklahoma travels to Baylor. The Bears are a home favorite by 3, but Oklahoma is more than capable of pulling off a win. Baylor was once in the top four in rankings, but now is not. If they want a spot in the playoff, the push starts today. The Ducks are at the Tree in the Pac-12 in another make or break game. The Ducks are having a really down year for them, but they are getting healthier and they can really wound the standings by felling the Tree tonight. I look for an upset here, though will be rooting for the Trees. Alabama is a Mississippi State, where the Bulldogs are tough, but there is no reason to believe the Tide won’t keep rolling.

In the NFL, the game of the week is obviously the Lions at the Pack on the Tundra. Naw, just kidding, the Kittehs haven’t won on the Pack’s home turf in 24 years, and they are not going to start now. The real game of the week is the Cards at Seattle, which is the Sunday Night game on NBC. Unlike last year, the Cards are pretty healthy for their trip to the Northwest. But so are the Squawks, and both teams are coming off a bye week. I am going to go with Seattle here simply because they are at home, if it was in Phoenix, the edge would go the other direction. The other big game is the Patriots at the Gents. Eli has always been Good Eli against Bel, Brady and the boys, and the Giants as a whole sure don’t fear them. But New York’s defense is not what it once was and Brady is on a mission. Take the Pats here, but it will be interesting to see how it plays out.

The Brazilian Grand Prix is this weekend. Practice has been fairly predictable, and qualifying has not gone off yet, so no grid to report. But the racing is almost always good at Autódromo José Carlos Pace in Interlagos. Personally, I am hoping for a big race from Felipe Massa in his home country. And Massa usually does race well at Interlagos.

Lastly, the second Democratic debate is, for some idiotic reason, Saturday night. Are the Dems trying to be irrelevant, or just stupid? One thing is sure, the Paris attacks will loom large over the affair. Hard to see how this doesn’t favor Clinton, as Bernie and O’Malley have nowhere near the chops to hang with her on this kind of subject. Sanders, distressingly, still has little to no meaningful foreign policy in his stump speeches. That was always going to catch up to him sooner or later, methinks it is sooner now.

The music today is the French national anthem. La Marseillaise is a gorgeous anthem. I had not heard it in many years, and had forgotten how beautiful it is. I usually hear national anthems from other nations in relation to Formula One, but there have been no winners from France in a while.

Tweet about this on TwitterShare on RedditShare on FacebookGoogle+Email to someone

It’s Harder for FBI to Get Location Data from Phone Companies Under FISA than Other Ways

I was looking for something else on Ron Wyden’s website yesterday and noticed this exchange between Wyden and Jim Comey from January 29, 2014 (see my transcription below). At first it seemed to be another of Wyden’s persistent questions about how the government collects location data — which we generally assume to be via telephone provider or Stingray — but then realized he was asking something somewhat different. After asking about Cell Site Location Information from phone companies, Wyden then asked whether the FBI uses the same (order, presumably a Pen Register) standard when collecting location from a smart phone app.

Oh yeah! The government can collect location information via apps (and thereby from Google or WhatsApp other providers) as well.

Here’s the FBI’s response, which hasn’t been published before.

The response is interesting for several reasons, some of which may explain why the government hasn’t been getting all the information from cell phones that it wanted under the Section 215 phone dragnet.

First, when the FBI is getting prospective CSLI, it gets a full FISA order, based on a showing of probable cause (it can get historical data using just an order). The response to Wyden notes that while some jurisdictions permit obtaining location data with just an order, because others require warrants, “the FBI elects to seek prospective CSLI pursuant to a full content FISA order, thus matching the higher standard imposed in some U.S. districts.”

Some of this FISA discussed in 2006 in response to some magistrates’ rulings that you needed more than an order to get location, though there are obviously more recent precedents that are stricter about needing a warrant.

This means it is actually harder right now to get prospective CSLI under FISA than it is under Title III in some states. (The letter also notes sometimes the FBI “will use criminal legal authorities in national security investigations,” which probably means FBI will do so in those states with a lower standard).

The FBI’s answer about smart phone apps was far squirrelier. It did say that when obtaining information from the phone itself, it gets a full-content FISA order, absent any exception to the Fourth Amendment (such as the border exception, which is one of many reasons FBI loves to search phones at the border and therefore hates Apple’s encryption); note this March 6, 2014 response was before the June 24, 2014 Riley v. CA decision that required a warrant to search a cell phone, which says FISA was on a higher standard there, too, until SCOTUS caught up.

But as to getting information from smartphone apps itself, here’s what FBI answered.

Which legal authority we would use is very much dependent upon the type of information we are seeking and how we intend to obtain that information. Questions considered include whether or not the information sought would target an individual in an area in which that person has a reasonable expectation of privacy, what type of data we intend to obtain (GPS or other similarly precise location information), and how we intend to obtain the data (via a request for records from the service provider or from the mobile device itself).

In other words, after having thought about how to answer Wyden for five weeks rather than the one they had promised, they didn’t entirely answer the question, which was what it would take for the FBI to get information from apps, rather than cell phone providers, though I think that may be the same standard as a CSLI from a cell phone company.

But this seems to say that, in the FISA context, it may well be easier — and a lower standard of evidence — for the FBI to get location data from a Stingray.

This explains why Wyden’s location bill — which he was pushing just the other day, after the Supreme Court refused to take Quartavious Davis’ appeal — talks about location collection generally, rather than using (for example) a Stingray.

Wyden: I’d like to ask you about the government’s authority to track individuals using things like cell site location information and smart phone applications. Last fall the NSA Director testified that “we–the NSA–identify a number we can give that to the FBI. When they get their probable cause then they can get the locational information they need.”

I’ve been asking the NSA to publicly clarify these remarks but it hasn’t happened yet. So, is the FBI required to have probable cause in order to acquire Americans’ cell site location information for intelligence purposes?

Comey: I don’t believe so Senator. We — in almost all circumstances — we have to obtain a court order but the showing is “a reasonable basis to believe it’s relevant to the investigation.”

Wyden: So, you don’t have to show probable cause. You have cited another standard. Is that standard different if the government is collecting the location information from a smart phone app rather than a cell phone tower?

Comey: I don’t think I know, I probably ought to ask someone who’s a little smarter what the standard is that governs those. I don’t know the answer sitting here.

Wyden: My time is up. Can I have an answer to that within a week?

Comey: You sure can.

Tweet about this on TwitterShare on RedditShare on FacebookGoogle+Email to someone

Weeks after Missing Claimed Russian Bomb Plot, US and UK Take Out Jihadi John

Politico has a big piece tied to a Showtime documentary on the living CIA Directors. As should be expected of a collection of paid liars, there are a lot of myths and score settling, most notably with expanded George Tenet claims about the strength of the warnings he gave about 9/11.

But I’m most interested in this insight, which seems very apt given recent intelligence failures and successes.

What’s the CIA’s mission? Is it a spy agency? Or a secret army? “Sometimes I think we get ourselves into a frenzy—into believing that killing is the only answer to a problem,” says Tenet. “And the truth is, it’s not. That’s not what our reason for existence is.” When Petraeus became CIA director, his predecessor, Hayden took him aside. Never before, Hayden warned him, had the agency become so focused on covert military operations at the expense of intelligence gathering. “An awful lot of what we now call analysis in the American intelligence community is really targeting,” Hayden says. “Frankly, that has been at the expense of the broader, more global view. We’re safer because of it, but it has not been cost-free. Some of the things we do to keep us safe for the close fight—for instance, targeted killings—can make it more difficult to resolve the deep fight, the ideological fight. We feed the jihadi recruitment video that these Americans are heartless killers.”

This is, of course, the counterpoint to Hayden’s claim that “we kill people based on metadata.” But it says much more: it describes how we’re viewing the world in terms of targets to kill rather than people to influence or views to understand. Hayden argues that prevents us from seeing the broader view, which may include both theaters where we’re not actively killing people but also wider trends.

Which is why I’m so interested in the big festival the US and UK — David Cameron, especially (of course, he’s in the middle of an effort to get Parliament to rubber stamp the existing British dragnet) — are engaging in with the presumed drone-killing of Mohammed Emwazi, nicknamed Jihadi John by the press.

Given that ISIS has plenty of other fighters capable of executing prisoners, some even that speak British accented English, this drone-killing seems to be more about show, the vanquishing of a public figure rather than a functional leader — contrary to what David Cameron says. As WaPo notes,

“If this strike was successful, and we still await confirmation of that, it will be a strike at the heart of ISIL,” Cameron said, using an acronym for the Islamic State.

Cameron alternated between speaking about Emwazi in the past and the present tenses, describing him as a “barbaric murderer” who was the Islamic State’s “lead executioner.”

“This was an act of self defense. It was the right thing to do,” he said.


But it is not clear that Emwazi had a meaningful role in Islamic State’s leadership structure. Analysts said the impact of his possible death could be limited.

“Implications? None beyond the symbolism,” said a Twitter message from Shiraz Maher, an expert on extremism at King’s College London.

It also might be a way to permanently silence questions about the role that British targeting of Emwazi had in further radicalizing him.

And all this comes just a few weeks after ISIS affiliates in Egypt claim to have brought down a Russian plane — depending on how you count, the largest terrorist attack since 9/11. Clearly, the combined British and US dragnet did not manage to prevent the attack, but there are even indications GCHQ, at least, wasn’t the agency that first picked up chatter about it.

Information from the intelligence agency of another country, rather than Britain’s own, led the Government to conclude that a bomb probably brought down the Russian airliner that crashed in the Sinai.

It was reports from an undisclosed “third party” agency, rather than Britain’s own GCHQ, that revealed the so-called “chatter” among extremists after the disaster that killed all 224 passengers and crew – and ended with the suspension of all British flights to Sharm el-Sheikh, according to authoritative sources.

British officials are said to have asked whether the same information had also been passed to Egypt, and were told that it had.


Sources declined to say which friendly country passed the information. The US and Israel – whose own borders have been threatened by Isis in Sinai – as well as Arab nations in the region all have an interest in monitoring activity in the area.

So while it’s all good that the Americans and Brits took out an ISIS executioner in Syria — thereby avenging the deaths of their country men — it’s not like this great dragnet is doing what it always promises to do: prevent attacks, or even understand them quickly.

Perhaps that’s because, while we approach ever closer to “collect[ing] it all,” we’re targeting rather than analyzing the data?

Tweet about this on TwitterShare on RedditShare on FacebookGoogle+Email to someone

The Proliferation-as-Terrorism Rule

Last week, Chairman of the House Homeland Security Committee tried to get Assistant Secretary of State Anne Patterson to list the Iran Republican Guard as a terrorist organization.

Rep. Michael McCaul (R., Texas) pressed Anne Patterson, assistant secretary of state in the bureau of near eastern affairs, during a hearing last week on Iran’s rogue activities.

Since the nuclear deal, “Iran has taken several provocative actions, including ballistic missile tests, the jailing of Americans on frivolous charges, and support for terrorist activities via the IRGC, the Iranian Revolutionary Guard Corps,” McCaul said.

The corps has been linked to terrorist operations across the Middle East and beyond, including arming terror proxy groups fighting against the United States and Israel.

“I sent a letter to the president of the United States requesting that the IRGC be placed on the Foreign Terrorist Organization list because they are the terror arm of Iran,” McCaul said. “This would not lift the sanctions. It would keep the sanctions in place on the very terrorist activities that Iran wants to take the $100 billion and ship them toward these activities. What is your response to whether or not designating the IRGC as an FTO [foreign terrorist organization], whether that is a good decision?”

Patterson sidestepped the question, but said that the State Department does not think the group can legally be categorized as a terrorist organization.

“I can’t answer that question, Mr. McCaul,” Patterson said. “I’ll have to get back to you. I would not think they would meet the legal criteria, but I don’t really know.”

Now, I’m not actually interested in getting the IRGC listed as a terrorist organization, particularly not for arming militias, because I think that would be a very bad precedent for the world’s biggest arms proliferator. Moreover, I’m sure Patterson sees this effort as another attempt to squelch efforts for peace with Iran.

But I am interested in her squirming given that for some years — we don’t know how many, but there was a new group approved in June 2007 and another approved in July 2009, so probably at least 6 years — the NSA has targeted Iran using the counterterrorism phone dragnet. So the government has convinced a FISC judge that IRGC (or Iran more generally) is a terrorist group. But now the State Department is telling us they’re not.

Up until USA F-ReDux passed this year, when Congress extended the proliferation-related definition of a foreign power under FISA to include those aiding or conspiring with those actually doing the proliferation, the government seems to have always pushed whom could be spied on well beyond the definitions in the law (there appears to have been a non-NSA certificate for it under Protect America Act, for example). That extends to the phone dragnet, and does so in such a way that probably includes a lot of American businesses.

And, Patterson’s dodges notwithstanding, the government hasn’t been above calling Iran a terrorist organization to do it.


Tweet about this on TwitterShare on RedditShare on FacebookGoogle+Email to someone

Government (and Its Expensive Contractors) Really Need to Secure Their Data Collections

Given two recent high profile hacks, the government needs to either do a better job of securing its data collection and sharing process, or presume people will get hurt because of it.

After the hackers Crackas With Attitude hacked John Brennan, they went onto hack FBI’s Deputy Director Mark Giuliano as well as a law enforcement portal run by the FBI. The hack of the latter hasn’t gotten as much attention — thus far, WikiLeaks has not claimed to have the data, but upon closer examination of the data obtained, it appears it might provide clues and contact information about people working undercover for the FBI.

Then, the hackers showed Wired’s Kim Vetter what the portal they had accessed included. Here’s a partial list:

Enterprise File Transfer Service—a web interface to securely share and transmit files.

Cyber Shield Alliance—an FBI Cybersecurity partnership initiative “developed by Law Enforcement for Law Enforcement to proactively defend and counter cyber threats against LE networks and critical technologies,” the portal reads. “The FBI stewards an array of cybersecurity resources and intelligence, much of which is now accessible to LEA’s through the Cyber Shield Alliance.”

IC3—“a vehicle to receive, develop, and refer criminal complaints regarding the rapidly expanding arena of cyber crime.”

Intelink—a “secure portal for integrated intelligence dissemination and collaboration efforts”

National Gang Intelligence Center—a “multi-agency effort that integrates gang information from local, state, and federal law enforcement entities to serve as a centralized intelligence resource for gang information and analytical support.”

RISSNET—which provides “timely access to a variety of law enforcement sensitive, officer safety, and public safety resources”

Malware Investigator—an automated tool that “analyzes suspected malware samples and quickly returns technical information about the samples to its users so they can understand the samples’ functionality.”

eGuardian—a “system that allows Law Enforcement, Law Enforcement support and force protection personnel the ability to report, track and share threats, events and suspicious activities with a potential nexus to terrorism, cyber or other criminal activity.”

While the hackers haven’t said whether they’ve gotten into these information sharing sites, they clearly got as far as the portal to the tools that let investigators share information on large networked investigations, targeting things like gangs, other organized crime, terrorists, and hackers. If hackers were to access those information sharing networks, they might be able to both monitor investigations into such networked crime groups, but also (using credentials they already hacked) to make false entries. And all that’s before CISA will vastly expand this info sharing.

Meanwhile, the Intercept reported receiving 2.5 years of recorded phone calls — amounting to 70 million recorded calls — from one of the nation’s largest jail phone providers, Securus. Its report focuses on proving that Securus is not defeat-listing calls to attorneys, meaning it has breached attorney-client privilege. As Scott Greenfield notes, that’s horrible but not at all surprising.

But on top of that, the Intercept’s source reportedly obtained these recorded calls by hacking Securus. While we don’t have details of how that happened, that does mean all those calls were accessible to be stolen. If Intercept’s civil liberties-motivated hacker can obtain the calls, so can a hacker employed by organized crime.

The Intercept notes that even calls to prosecutors were online (which might include discussions from informants). But it would seem just calls to friends and associates would prove of interest to certain criminal organizations, especially if they could pinpoint the calls (which is, after all, the point). As Greenfield notes, defendants don’t usually listen to their lawyers’ warnings — or those of the signs by the phones saying all calls will be recorded — and so they say stupid stuff to everyone.

So we tell our clients that they cannot talk about anything on the phone. We tell our clients, “all calls are recorded, including this one.”  So don’t say anything on the phone that you don’t want your prosecutor to hear.

Some listen to our advice. Most don’t. They just can’t stop themselves from talking.  And if it’s not about talking to us, it’s about talking to their spouses, their friends, their co-conspirators. And they say the most remarkable things, in the sense of “remarkable” meaning “really damaging.”  Lawyers only know the stupid stuff they say to us. We learn the stupid stuff they say to others at trial. Fun times.

Again, such calls might be of acute interest to rival gangs (for example) or co-conspirators who have figured out someone has flipped.

It’s bad enough the government left OPM’s databases insecure, and with it sensitive data on 21 million clearance holders.

But it looks like key law enforcement data collections are not much more secure.

Tweet about this on TwitterShare on RedditShare on FacebookGoogle+Email to someone

How to Make Peaceful Protestors of America’s Torture School Look Like Terrorists

In 2001, it was uncorroborated reports that anarchists would be joining peace activists.
Screen Shot 2015-11-12 at 8.21.46 AM

In 2003, Anti-Free Trade of Americas protests were dubiously invoked (they were also invoked to investigate peace protestors in Pittsburgh that year).

Screen Shot 2015-11-12 at 8.30.54 AM

In 2007, the FBI tied the event with four other open cases, including two government trespass ones, a bank robbery, and a corruption case.

Screen Shot 2015-11-12 at 8.50.00 AM

In 2009, it was the expected presence of peace activists under investigation (among other things) for ties to Palestinians and Colombia’s FARC.

Screen Shot 2015-11-12 at 8.06.34 AM

The two undercover officers who long tracked this group, “Karen Sullivan” and “Daniela Cardenas” attended that year to spy on the event.

Year after year, however — from 2000 until 2009, when consultation with the FBI’s own domestic investigations guide finally led the FBI to shut the long-running investigation down — the FBI found an excuse to track the annual protest of the School of the Americas in the name of counterterrorism preparedness, as FOIAed documents released today reveal in detail.

In other words, year after year, even while recording how peaceful the event was, the FBI still tracked and coordinated with the Columbus, GA police in the guise of counterterrorism preparedness because a bunch of people use their First Amendment rights to protest the murder and torture propagated by the SOA.

Update: I originally got the year this investigation started wrong: it was opened in 2000.

Tweet about this on TwitterShare on RedditShare on FacebookGoogle+Email to someone

Emptywheel Twitterverse

emptywheel @SierraCynic Think I was okay w/o much Barbie (in part bc my bros abused her as boys are apt to do). I wanted Baby Alive & Lego @laRosalind
emptywheel @laRosalind I had a Barbie, tho not much gear (we made clothes for it). Also had a head for makeup. Both didn't stick, obviously.
emptywheel @jsundmanus I of course proceeded to neglect it, left it in my Aunt's basement. So mom was prolly right after all.
emptywheel @jsundmanus My bro got it for me, to shut me up. He got me an African-American one, bc all the white ones were sold out (which was fine).
emptywheel @jsundmanus LOL! As I said, after 25 years (& after once getting a windup penguin instead) I finally got one.
emptywheel @joanneleon Yup. Mom wouldn't get me it for fear the food would rot inside the doll. I asked for it 3 birthday/Christmases in a row, age 4-6
emptywheel RT @kevinjonheller: What a surprise: Niall Ferguson butchers the 5th century in service of his right-wing agenda. #…
emptywheel @jsundmanus How so? Not that I disagree but am curious why you saw that...
emptywheel (I really hate that I'm beating up on Hello Barbie bc for years I wanted nothing but Baby Alive but didn't get it for 25 years)
emptywheel Toymakers getting hacked and kids ID's stolen. Are you SURE your kids need Hello Barbie for Christmas?
emptywheel NYT Should Explain How It Selects Which Articles Get Translated into Mandarin
emptywheel @stephanie_a517 Are these translated into mandarin? @Sulliview
November 2015
« Oct