Posts

The Irony of Booz Vice Chair Mike McConnell’s Timing

/1 Comment/in , , /by

Please support this kind of weedy journalism. 

I’m in the process of going really deep in the weeds on this Section 215 stuff, just adjusting my earlier timelines.

Several of us have noted the curious timing of the discovery of the problems with Section 215 dragnet. November 2, 2008 was the stated high number of identifiers which the NSA could contact chain, at 27,090 (though when NSA started cleaning this stuff up they only audited back through November 1, 2008).

On December 10, 2008, two analysts (whom I wildarseguess suspect were actually FBI Agents) start doing searches on unapproved identifiers, doing 280 over the next month and a half.

On December 11 and 12, 2008, Reggie Walton wrote the first systematic opinion on this program and approved a new Primary Order.

On December 15, 2008, the NSA stopped one of its abusive alert system processes.

On January 9, 2009, NSA told folks at DOJ’s National Security Division about them.

By January 15, 2009, NSA had seemingly purged thousands of identifiers from its alert list, because on that day (five days before the inauguration) it had only 17,835, down from 27,090 two days before Obama was elected.

January 20, 2009: Obama took the oath as President, replacing George Bush.

That, of course, led to change at key positions. One which I find remarkably interesting, however was that of Mike McConnell, who had spent two years as Director of National Intelligence (just long enough to get immunity for those who did all this illegally under Cheney’s program). McConnell left on January 27, 2009, leading to a delay on (reported) DNI involvement in this until his replacement Dennis Blair came in on January 29. Blair was briefed on this on his second day in office, January 30, 2009.

I don’t know — because the documents don’t say (see, especially, Keith Alexander’s chart on page 25 of his declaration that is totally non-responsive about anyone in DNI who would have known about these problems)– how much the revolving Intelligence Contractor Exec McConnell knew about NSA’s extension of the illegal Cheney program, illegally, under the FISC sanctioned Section 215 order.

But remember: as Vice Chair of Booz, Mike McConnell was (sort of) Edward Snowden’s boss until the latter absconded with proof of these gross violations under McConnell’s tenure at DNI.

Among other things, this rough outline suggests this wasn’t so much a “discovery” of violations, it was an attempt to hide what at least some people knew were systematic and gross violations of the Section 215 program, just before Obama came in and replaced some of the top players.

But I do find it ironic that McConnell’s company, Booz, played its small part in making all this clear.

NSA’s Corruption of Cryptography and Its Methods of Coercion

/9 Comments/in , /by

Just one more day to give as part of Emptywheel’s fundraising week.

I want to return to last week’s Edward Snowden related scoop (Guardian, ProPublica/NYT) that the NSA has corrupted cryptography. Remember, there are several reasons the story was important:

  • NSA lost the battle for the Clipper Chip and turned instead to achieve the same goals via means with less legal sanction
  • NSA broke some companies’ encryption by “surreptitiously stealing their encryption keys or altering their software or hardware”
  • NSA also worked to “deliberately weaken[] the international encryption standards adopted by developers”

One key result of this — as Rayne and Julian Sanchez have emphasized — is to make everyone more exposed to hackers.

This is a bit like publishing faulty medical research just to prevent a particular foreign dictator from being cured. It makes everyone on the Internet more vulnerable, increasing the chances that dissidents will be uncovered by despotic regimes and that corporations will fall victim to cybercriminals.

[snip]

Bear this in mind the next time you see people on Capitol Hill wringing their hands about the threat of a possible “Digital Pearl Harbor”—especially if they think the solution is to give more data and authority to the NSA. Because the agency is apparently perfectly happy to hand weapons to criminals and hostile governments, as long as it gets to keep spying too.

And since then, the NSA has responded to rampant cyberattacks and threats of them against targets it cares about by demanding yet more access to those targets’ data, as explained by Shane Harris in a Keith Alexander profile.

Under the Defense Industrial Base initiative, also known as the DIB, the NSA provides the companies with intelligence about the cyberthreats it’s tracking. In return, the companies report back about what they see on their networks and share intelligence with each other.

Pentagon officials say the program has helped stop some cyber-espionage. But many corporate participants say Alexander’s primary motive has not been to share what the NSA knows about hackers. It’s to get intelligence from the companies — to make them the NSA’s digital scouts. What is billed as an information-sharing arrangement has sometimes seemed more like a one-way street, leading straight to the NSA’s headquarters at Fort Meade.

“We wanted companies to be able to share information with each other,” says the former administration official, “to create a picture about the threats against them. The NSA wanted the picture.”

After the DIB was up and running, Alexander proposed going further. “He wanted to create a wall around other sensitive institutions in America, to include financial institutions, and to install equipment to monitor their networks,” says the former administration official. “He wanted this to be running in every Wall Street bank.”

That aspect of the plan has never been fully implemented, largely due to legal concerns. If a company allowed the government to install monitoring equipment on its systems, a court could decide that the company was acting as an agent of the government. And if surveillance were conducted without a warrant or legitimate connection to an investigation, the company could be accused of violating the Fourth Amendment. Warrantless surveillance can be unconstitutional regardless of whether the NSA or Google or Goldman Sachs is doing it.

“That’s a subtle point, and that subtlety was often lost on NSA,” says the former administration official. “Alexander has ignored that Fourth Amendment concern.”

With all that as background, I want to return to a post I did months ago, laying out the methods the Presidential Policy Directive on Cyberwar envisioned for getting cooperation from private companies. It defines four kinds of access to private computer networks:

  • Network defense, which is what network owners do or USG (or contractors) do at their behest to protect key networks. I assume this like anti-virus software on steroids.
  • Cyber collection that, regardless of where it occurs, is done in secret. This is basically intelligence gathering about networks.
  • Nonintrusive Defensive Countermeausres, which is more active defensive attacks, but ones that can or are done with the permission of the network owners. This appears to be the subset of Defensive Cybereffects Operations that, because they don’t require non-consensual network access, present fewer concerns about blowback and legality.
  • Defensive Cybereffects Operations, which are the entire category of more active defensive attacks, though the use of the acronym DCEO appears to be limited to those defensive attacks that require non-consensual access to networks and therefore might cause problems. The implication is they’re generally targeted outside of the US, but if there is an imminent threat (that phrase again!) they can be targeted in the US.

In the area of cyberdefense or offense (remember, this is an overlapping part of NSA’s mission with cryptography) the government envisions collecting information (because cryptography overlaps with this mission, this might be included in that secret data collection) without a network owner’s consent, conducting defensive measures with a network owner’s consent, or conducting defensive measures without a network owner’s consent (the latter is only supposed to happen in the US with the President’s authorization).

Read more →

Information Sharing with Israel Raises Questions about Efficacy of NSA’s Minimization Procedures

/24 Comments/in , /by

Pulling weeds is hard work! Please support my hard work by making a donation. 

The Guardian’s latest Edward Snowden story yesterday reported that an information sharing Memorandum of Understanding written sometime after March 2009 laid out the sharing of unminimized US collections with Israel. The agreement appears to newly share such unminimized content based on unenforceable assurances from Israel that it will minimize US person data and destroy any communication involving a US government official.

Whatever else this story may do, it casts serious questions on the efficacy of the minimization procedures that lie at the core of FISA Court oversight over the government’s spying program.

NSA’s minimization procedures in place (per a date stamp) on July 29, 2009 only allow the government distribution of unminimized data to foreign governments for cyrptoanalysis or translation. And it requires the foreign government to return the data once it has provided assistance.

Dissemination to foreign governments will be solely for translation or analysis of such information or communications, and assisting foreign governments will make no use of any information or communication of or concerning any person except to provide technical and linguistic assistance to NSA.

[snip]

Upon the conclusion of such technical or linguistic assistance to NSA, computer disks, tape recordings, transcripts, or other items or information disseminated to foreign governments will either be returned to NSA or be destroyed with an accounting of such destruction made to NSA.

But the information sharing agreement with Israel not only envisions it keeping this data (with the requirement that it “strictly limit access … to properly cleared ISNU personnel and properly cleared members of Israeli intelligence services”) but also circulating it, so long as it complies with an unenforceable promise to minimize US person data.

Disseminate foreign intelligence information concerning U.S. persons derived from raw SIGINT provided by NSA — to include any release outside ISNU in the form of reports, transcripts, gists, memoranda, or any other form of written oral document or transmission — on in a manner that does not identify the U.S. person.

The only data that the US requires Israel destroy is that involving US government personnel.

Destroy upon recognition any communication contained in raw SIGINT provided by NSA that is either to or from an official of the U.S. Government. “U.S. Government officials” include officials of the Executive Branch (including the White House, Cabinet Departments, and independent agencies); the U.S. House of Representatives and Senate (members and staff); and the U.S. Federal Court system (including, but not limited to the Supreme Court).

So unless the government canceled this agreement just 4 months after it reached it, it means the NSA misrepresented to the FISA Court the legal and privacy implications of the collection the court approved based on those minimization procedures. The court approved broad collections based on the understanding minimization would be strictly enforced, but here we learn it has been outsourced to a foreign government in terms that don’t seem to abide by the minimization procedures themselves.

Read more →

NSA, GCHQ, Declare Civil War on Their Own People

/37 Comments/in /by

The Guardian, NYT, and ProPublica have the first of the co-reported stories we’ve been promised, reporting that after the government failed to get Congress to require back doors into encrypted communication, it just went ahead and took it.

I’ll come back to these stories, but for the moment, want to just point to the various names it has given this effort, from ProPublica.

The full extent of the N.S.A.’s decoding capabilities is known only to a limited group of top analysts from the so-called Five Eyes: the N.S.A. and its counterparts in Britain, Canada, Australia and New Zealand. Only they are cleared for the Bullrun program, the successor to one called Manassas — both names of American Civil War battles. A parallel GCHQ counterencryption program is called Edgehill, named for the first battle of the English Civil War of the 17th century.

Unlike some classified information that can be parceled out on a strict “need to know” basis, one document makes clear that with Bullrun, “there will be NO ‘need to know.’ ”

Only a small cadre of trusted contractors were allowed to join Bullrun. It does not appear that Mr. Snowden was among them, but he nonetheless managed to obtain dozens of classified documents referring to the program’s capabilities, methods and sources.

Manassas, Bullrun, and Edgehill.

All civil war battles.

Even rhetorically, our governments have declared civil war on us and our privacy.

Update: In related news, Obama’s Insider-Independent Non-Tech Tech Review Committee is seeking public comment on the dragnet.

Go let Cass Sunstein know what you think of this.

Update on Lavabit

/19 Comments/in /by

I’ve been trying to keep an eye on the public information about the government’s demand on Lavabit. And in a new interview with Ars Technica, Ladar Levison basically gives us a multiple choice guess on what the request was: either altering the source code or turning over the private key securing his HTTPS certificate.

Levison said he has always known Lavabit safeguards could be bypassed if government agents took drastic measures, or as he put it, “if the government was willing to sacrifice the privacy of many to conduct surveillance on the few.” For instance, if he was forced to change the code used when a user logs in, his system could capture the plain-text password needed to decrypt stored e-mails. Similarly, if he was ever forced to turn over the private encryption key securing his site’s HTTPS certificate, government agents tapping a connection could observe the password as a user was entering it. But it was only in the past few weeks that he became convinced those risks were realistic.

“I don’t know if I’m off my rocker, but 10 years ago, I think it would have been unheard of for the government to demand source code or to make a change to your source code or to demand your SSL key,” Levison told Ars. “What I’ve learned recently makes me think that’s not as crazy an assumption as I thought.”

I and others have suggested this (whichever of these options this demand took) is basically CALEA II — FBI’s repeated demands that it have a back door into anything — before its time.

But Congress has not yet authorized CALEA II. So why did the (presumably) FISA Court approve this demand?

As with Manning Leak, Snowden Leak Reveals DOD Doesn’t Protect Security

/16 Comments/in , /by

MSNBC has an update to the continuing saga of “Omigod the NSA has inadequate security.” It explains why the “thin client” system the NSA had (one source calls it 2003 technology) made it so easy for Edward Snowden to take what he wanted.

In a “thin client” system, each remote computer is essentially a glorified monitor, with most of the computing power in the central server. The individual computers tend to be assigned to specific individuals, and access for most users can be limited to specific types of files based on a user profile.

But Snowden was not most users.

[snip]

As a system administrator, Snowden was allowed to look at any file he wanted, and his actions were largely unaudited. “At certain levels, you are the audit,” said an intelligence official.

He was also able to access NSAnet, the agency’s intranet, without leaving any signature, said a person briefed on the postmortem of Snowden’s theft. He was essentially a “ghost user,” said the source, making it difficult to trace when he signed on or what files he accessed.

If he wanted, he would even have been able to pose as any other user with access to NSAnet, said the source.

The story goes on to note that being in Hawaii would have allowed Snowden to access Fort Meade’s computers well after most users were gone.

I’m particularly interested in the assertion that Snowden could pose as any other user with access to NSAnet.

Any other user. Presumably, that includes at least Cybercommander Keith Alexander’s aides.

In a world in which the NSA is increasingly an offensive organization, certain figures within NSA would be engaged in some very interesting communications and compartments, I’d imagine.

Ah well. The US won’t learn. They’ll continue to neglect these holes until someone publicly demonstrates their negligence, all the while leaving them open for whatever paid agents of foreign governments choose to exploit them.

How to Get the Government to Ease Up: Involve Scott Shane

/14 Comments/in /by

This is fairly extraordinary. BuzzFeed reports that in an effort to alleviate some of the pressure from the UK it is bringing in the NYT — but just one reporter from the NYT — to report on the Snowden stories.

“In a climate of intense pressure from the UK government, The Guardian decided to bring in a US partner to work on the GCHQ documents provided by Edward Snowden,” Guardian spokeswoman Jennifer Lindenauer said in an email. “We are continuing to work in partnership with the NYT and others to report these stories.”

That reporter is not James Risen — who of course broke the original NSA story with Eric Lichtblau. It is not Charlie Savage — who had an important story based on the Snowden leaks already.

It is Scott Shane.

The Times’s Charlie Savage and other reporters have chased the NSA story aggressively, despite Snowden’s choice to go to fillmmaker Laura Poitras, theGuardian’s Glenn Greenwald, and Barton Gellman, who has written about the documents for the Washington Post. Snowden said he did not go to the Timesbecause the paper bowed to Bush Administration demands to delay a story on warrantless wiretapping in the interest of national security; he was afraid, he said, the paper would do the same with his revelations.

Now, Times reporter Scott Shane is at work on a series of stories expected to be published next month jointly with the Guardian, a source familiar with the plans said. The source said the internal arrangement has also been the cause of some tension in the newsroom, as other national security reporters working on the NSA story — Savage and James Risen, among others — are not centrally involved in stories based on the Guardian’s documents.

Scott Shane has an increasingly consistent ability to tell grand tales that serve the interests of The Powers that Be. And somehow his stories about extremely sensitive subjects like drones don’t get chased for leaks.

Was the alleviation of pressure tied to Scott Shane in particular, a journalist who hasn’t followed this story as closely as some of his colleagues?

Both These Things Cannot Be True

/18 Comments/in , , /by

Last Friday, NSA’s Compliance Director John DeLong assured journalists the violations NSA reported in 2012 were “miniscule.” (I noted that the report showed some of the most sensitive violations primarily get found through audits and therefore their discovery depend in part on how many people are auditing.)

Today, as part of a story describing that NSA still doesn’t know what Edward Snowden took from NSA, MSNBC quotes a source saying NSA has stinky audit capabilities.

Another said that the NSA has a poor audit capability, which is frustrating efforts to complete a damage assessment.

(We’ve long known this about NSA’s financial auditing function, and there have long been signs they couldn’t audit data either, but apparently MSNBC’s source agree.)

For the past several months, various Intelligence officials have assured Congress and the public that it keeps US person data very carefully guarded, so only authorized people can access it.

Today, MSNBC reports NSA had (has?) poor data compartmentalization.

NSA had poor data compartmentalization, said the sources, allowing Snowden, who was a system administrator, to roam freely across wide areas.

Again, there have long been signs that non-analysts had untracked access to very sensitive data. Multiple sources agree — and possibly not just non-analysts.

While I’m really sympathetic for the people who are reportedly “overwhelmed” trying to figure out what Snowden took, we’re seeing precisely the same thing we saw with Bradley Manning: that it takes a giant black eye for intelligence agencies to even admit to gaping holes in their security and oversight.

And in NSA’s case, it proves most of their reassurances to be false.

The Importance of Being Earnest

/29 Comments/in , , /by

Q Why was the United States given a heads-up by the British government on this detention?

MR. EARNEST: Again, that heads-up was provided by the British government, so you can direct that question to them.

Q Right. But was this heads-up given before he was detained or before it went public that he was detained?

MR. EARNEST: Probably wouldn’t be a heads-up if they would have told us about it after they detained him.

Q So it’s fair to say they told you they were going to do this when they saw that he was on a manifest?

MR. EARNEST: I think that is an accurate interpretation of what a heads-up is.

Q Is this gentleman on some sort of watch list for the United States? Can you look that up?

MR. EARNEST: You’d have to check with the TSA because they maintain the watch list. And I don’t know if they’d tell you or not, but you can ask them.

Q If he’s on a watch list for the U.K., would it be safe to assume then that he’s been put on a watch list in the United States?

MR. EARNEST: The level of coordination between counterterrorism and law enforcement officials in the U.K. and counterterrorism and law enforcement officials in the United States is very good. But in terms of who is on different watch lists and how our actions and their actions are coordinated is not something I’m in a position to talk about from here.

Q Did the United States government — when given the heads-up, did the United States government express any hesitancy about the U.K. doing it — about the U.K. government doing this?

MR. EARNEST: Well, again, this is the British government making a decision based on British law, on British soil, about a British law enforcement action.

Q Did the United States, when given the heads-up, just said okay?

MR. EARNEST: They gave us a heads-up, and this is something that they did not do at our direction and it’s not something that we were involved with. This is a decision that they made on their own.

Q Did the United States discourage the action?

White House Deputy Spokesperson Josh Earnest wants you to know that the decision to detain Glenn Greenwald’s partner David Miranda was done by the British on their own.

Q Josh, you’ve talked about the Mubarak detention as being a Egyptian legal matter. You’ve talked about Morsi’s politically motivated detention. And then with regard to Mr. Greenwald’s partner, you called it a “mere law enforcement action.” Given that the White House has never been shy about criticizing detention policies overseas, do you have any concerns at all about the U.K.’s law enforcement actions in this case?

MR. EARNEST: Well, what I can say is I don’t have a specific reaction other than to observe to you that this is a decision that was made by the British government and not one that was made at the request or with the involvement of the United States government.

But he’s not going to tell you anything about the secret conversations the US have with the British.

MR. EARNEST: To be honest with you, Steve, I don’t have a way to characterize for you any of the conversations between the British government and the U.S. government on this matter other than to say that this is a decision that they made on their own and not at the request of the United States. But in terms of the kinds of classified, confidential conversations that are ongoing between the U.S. and our allies in Britain, I’m not able to characterize that for you.

Q But there are consultations on this matter taking place?

MR. EARNEST: I’m telling you I’m not able to provide any insight into those conversations at all.

Ah well, perhaps this “US security official,” rather bizarrely given anonymity to pass on this British thuggish comment, offers better insight into those conversations.

One U.S. security official told Reuters that one of the main purposes of the British government’s detention and questioning of Miranda was to send a message to recipients of Snowden’s materials, including the Guardian, that the British government was serious about trying to shut down the leaks.

Josh Earnest may not want to admit to the close collaboration here, but American security officials sure seem privy to the message being sent.

 

America’s Closest Ally Declares Glenn Greenwald’s Partner a Terrorist

/47 Comments/in , /by

Glenn Greenwald’s partner, David Miranda, got detained at Heathrow for 9 hours and had his electronic devices confiscated.

David Miranda, who lives with Glenn Greenwald, was returning from a trip to Berlin when he was stopped by officers at 8.30am and informed that he was to be questioned under schedule 7 of the Terrorism Act 2000. The controversial law, which applies only at airports, ports and border areas, allows officers to stop, search, question and detain individuals.

The 28-year-old was held for nine hours, the maximum the law allows before officers must release or formally arrest the individual. According to official figures, most examinations under schedule 7 – over 97% – last under an hour, and only one in 2,000 people detained are kept for more than six hours.

Miranda was then released without charge, but officials confiscated electronics equipment including his mobile phone, laptop, camera, memory sticks, DVDs and games consoles.

Aside from the outrage over the treatment of a partner of a British newspaper’s employee, consider what it means that the UK used their terrorism law to detain Miranda (had he been transiting the US, they wouldn’t have needed to use the transparently false claim of terrorism — they can and do subject people to this treatment for no reason all the time).

Does this mean the US and UK are both treating the investigation into the leak of classified information as terrorism now? If so, does that mean the US is using its counterterrorism authorities to investigate Greenwald and Snowden? Have they used the dragnet database to find their contacts?

That might explain why they apparently used the FISA Court — not an Title III warrant — to go after Lavabit.

But it significantly discredits both their effort to counter Greenwald and their counterterrorism efforts. If they’ll use terrorism to prevent further embarrassment, it’s really just a tool to go after dissidents.

Two more thoughts. First, remember that someone already stole a laptop from Greenwald’s home in Rio. I thought it unlikely then that the US or an ally did so. I think the chances are slightly higher now.

Also, I wonder how Dilma Rousseff will respond to this, especially with growing actions in Brazil against US spying. She had been moving away from the sphere of the Bolivarists in Latin America (and has a US state visit planned for this fall). But the British just treated a Brazilian citizen with the same kind of egregious treatment Europe gave to Evo Morales. Will she respond?

Update: In Glenn’s piece on this, he makes it clear that fairly high level Brazilian officials were involved in this, and none too happy about it.

I immediately contacted the Guardian, which sent lawyers to the airport, as well various Brazilian officials I know. Within the hour, several senior Brazilian officials were engaged and expressing indignation over what was being done. The Guardian has the full story here.

Despite all that, five more hours went by and neither the Guardian’s lawyers nor Brazilian officials, including the Ambassador to the UK in London, were able to obtain any information about David.

Update: Here’s the statement the Brazilian government has released.

The Brazilian government expresses grave concern about the episode that happened today in London, where a Brazilian citizen was held without communication at Heathrow airport for 9 hours, in an action based in the British anti-terrorism legislation. This measure is without justification since it involves an individual against whom there are no charges that can legitimate the use of that legislation. The Brazilian Government expects that incidents such as the one that happened to the Brazilian citizen today do not repeat.