Posts

Telecoms Versus the Toobz: The Source of the Legal Troubles

In this important piece on overbroad surveillance programs under Presidents Bush and Obama, the WaPo reveals that the program James Comey almost resigned over in 2004 involved sucking Internet metadata off telecom switches owned by the telecoms.

Telephone metadata was not the issue that sparked a rebellion at the Justice Department, first by Jack Goldsmith of the Office of Legal Counsel and then by Comey, who was acting attorney general because John D. Ashcroft was in intensive care with acute gallstone pancreatitis. It was Internet metadata.

At Bush’s direction, in orders prepared by David Addington, the counsel to Vice President Richard B. Cheney, the NSA had been siphoning e-mail metadata and technical records of Skype calls from data links owned by AT&T, Sprint and MCI, which later merged with Verizon.

For reasons unspecified in the report, Goldsmith and Comey became convinced that Bush had no lawful authority to do that.

This leads me to wonder whether legal leverage from the Internet providers — rather than any squeamishness about the law itself — caused the conflict.

Remember, in the fight over retroactive immunity in 2008, the industry group for the Internet providers — including Microsoft, Yahoo, and Google — argued against retroactive immunity.

The Computer & Communications Industry Association (CCIA) strongly opposes S. 2248, the “FISA Amendments Act of 2007,” as passed by the Senate on February 12, 2008. CCIA believes that this bill should not provide retroactive immunity to corporations that may have participated in violations of federal law. CCIA represents an industry that is called upon for cooperation and assistance in law enforcement. To act with speed in times of crisis, our industry needs clear rules, not vague promises that the U.S. Government can be relied upon to paper over Constitutional transgressions after the fact.

Given the WaPo’s report, this amounts to a demand that Congress allow the Internet companies to hold the telecoms accountable for helping the government seize their data.

As well they should have been able to. To a degree, these companies compete, and in the name of helping the government, the telecoms were helping themselves to Internet suppliers crown jewels.

Microsoft and Google versus AT&T and Verizon. Now that would have been an amusing lawsuit to watch. And probably a lot bigger worry for the people who use all of them to spy on us peons than we peons actually are.

Truck-sized Holes: Journalists Challenged by Technology Blindness

[photo: liebeslakritze via Flickr]

[photo: liebeslakritze via Flickr]

Note: The following piece was written just before news broke about Booz Allen Hamilton employee Edward Snowden. With this in mind, let’s look at the reporting we’ve see up to this point; problems with reporting to date may remain even with the new disclosures.

ZDNet bemoaned the failure of journalism in the wake of disclosures this past week regarding the National Security Administration’s surveillance program; they took issue in particular with the Washington Post’s June 7 report. The challenge to journalists at WaPo and other outlets, particularly those who do not have a strong grasp of information technology, can be seen in the reporting around access to social media systems.

Some outlets focused on “direct access.” Others reported on “access,” but were not clear about direct or indirect access.

Yet more reporting focused on awareness of the program and authorization or lack thereof on the part of the largest social media firms cited on the leaked NSA slides.

Journalists are not asking what “access” means in order to clarify what each corporation understands direct and indirect access to mean with regard to their systems.

Does “direct access” mean someone physically camped out on site within reach of the data center?

Does “direct access” mean someone with global administrative rights and capability offsite of the data center? Some might call this remote access, but without clarification, what is the truth?

I don’t know about you but I can drive a Mack truck through the gap between these two questions.

So which “direct access” have the social media firms not permitted? Which “direct access” has been taken without authorization of corporate management? ZDNet focuses carefully on authorization, noting the changes in Washington Post’s story with regard to “knowingly participated,” changed later to read “whose cooperation is essential PRISM operations.”

This begs the same questions with regard to any other form of access which is not direct. Note carefully that a key NSA slide is entitled, “Dates when PRISM Collection Began For Each Provider.” It doesn’t actually say “gained access,” direct or otherwise. Read more

Once Upon a Time the PRISM Companies Fought Retroactive Immunity

Screen shot 2013-06-09 at 8.30.08 AMSince the disclosure of the PRISM program, I have thought about a letter the industry group for some of the biggest and earliest PRISM participants — Google, Microsoft, and Yahoo — wrote to then House Judiciary Chair John Conyers during the 2008 debate on FISA Amendments Act. (The screen capture reflects a partial list of members from 2009.)

Remarkably, the letter strongly condemned the effort to grant companies that had broke the law under Bush’s illegal wiretap program immunity.

The Computer & Communications Industry Association (CCIA) strongly opposes S. 2248, the “FISA Amendments Act of 2007,” as passed by the Senate on February 12, 2008. CCIA believes that this bill should not provide retroactive immunity to corporations that may have participated in violations of federal law. CCIA represents an industry that is called upon for cooperation and assistance in law enforcement. To act with speed in times of crisis, our industry needs clear rules, not vague promises that the U.S. Government can be relied upon to paper over Constitutional transgressions after the fact.

CCIA dismisses with contempt the manufactured hysteria that industry will not aid the United States Government when the law is clear. As a representative of industry, I find that suggestion insulting. To imply that our industry would refuse assistance under established law is an affront to the civic integrity of businesses that have consistently cooperated unquestioningly with legal requests for information. This also conflates the separate questions of blanket retroactive immunity for violations of law, and prospective immunity, the latter of which we strongly support.

Therefore, CCIA urges you to reject S. 2248. America will be safer if the lines are bright. The perpetual promise of bestowing amnesty for any and all misdeeds committed in the name of security will condemn us to the uncertainty and dubious legalities of the past. Let that not be our future as well. [my emphasis]

Microsoft, Yahoo, and Google all joined PRISM within a year of the date of the February 29, 2008 letter (Microsoft had joined almost six months before, Google would join in January 2009).

Screen shot 2013-06-07 at 11.08.29 AMClearly, the demand that the companies that broke the law not receive retroactive immunity suggests none of the members had done so. It further suggests that those companies that did break the law — the telecoms, at a minimum — had done something the email providers wanted them held accountable for. This suggests, though doesn’t prove, that before PRISM, the government may have accessed emails from these providers by taking packets from telecom switches, rather than obtaining the data from the providers themselves.

Google had also fought a DOJ subpoena in 2006 for a million URLs and search terms, purportedly in the name of hunting child pornographers.

And those of us who follow this subject have always speculated (with some support from sources) that the plaintiff in a 2007 FISA Court challenge to a Protect America Act (the precursor to FISA Amendments Act) was an email provider.

All of those details suggest, at the very least, that email providers (unlike telecoms, which we know were voluntarily giving over data shortly after 9/11) fought government efforts to access their data.

But it also suggests that the email providers may have treated PRISM as a less worse alternative than the government accessing their data via other means (which is a threat the government used to get banks to turn over SWIFT data, too).

It seems likely the way the government “negotiates” getting data companies to willingly turn over their data is to steal it first.

Side by Side: Timeline of NSA’s Communications Collection and Cyber Attacks

In all the reporting and subsequent hubbub about the National Security Administration’s ongoing collection of communications, two things stood out as worthy of additional attention:

— Collection may have been focused on corporate metadata;

— Timing of NSA’s access to communications/software/social media firms occurred alongside major cyber assault events, particularly the release of Stuxnet, Flame, and Duqu.

Let’s compare timelines; keep in mind these are not complete.

Date

NSA/Business

Cyber Attacks

11-SEP-2007

Access to MSFT servers acquired

15-NOV-2007

Stuxnet 0.5 discovered in wild

XX-DEC-2007

File name of Flame’s main component observed

12-MAR-2008

Access to Yahoo servers acquired

All 2008 (into 2009)

Adobe applications suffer from 6+ challenges throughout the year, including attacks on Tibetan Government in Exile via Adobe products.

11-JAN-2009

Stuxnet 0.5 “ends” calls home

14-JAN-2009

Access to Google servers acquired

Mid-2009

Operation Aurora attacks begin; dozens of large corporations confirming they were targets.

03-JUN-2009

Access to Facebook servers acquired

22-JUN-2009

Date Stuxnet version 1.001 compiled

04-JUL-2009

Stuxnet 0.5 terminates infection process

07-DEC-2009

Access to PalTalk servers acquired

XX-DEC-2009

Operation Aurora attacks continue through Dec 2009

12-JAN-2010

Google discloses existence of Operation Aurora, said attacks began in mid-December 2009

13-JAN-2010

Iranian physicist killed by motorcycle bomb

XX-FEB-2010

Flame operating in wild

10-MAR-2010

Date Stuxnet version 1.100 compiled

14-APR-2010

Date Stuxnet version 1.101 compiled

15-JUL-2010

Langner first heard about Stuxnet

19-SEP-2010

DHS, INL, US congressperson informed about threat posed by “Stuxnet-inspired malware”

24-SEP-2010

Access to YouTube servers acquired

29-NOV-2010

Iranian scientist killed by car bomb

06-FEB-2011

Access to Skype servers acquired

07-FEB-2011

AOL announces agreement to buy HuffingtonPost

31-MAR-2011

Access to AOL servers acquired

01-SEP-2011

Duqu worm discovered

XX-MAY-2012

Flame identified

08-JUN-2012

Date on/about “suicide” command issued to Flame-infected machines

24-JUN-2012

Stuxnet versions 1.X terminate infection processes

XX-OCT-2012

Access to Apple servers acquired (date NA)

Again, this is not everything that could be added about Stuxnet, Flame, and Duqu, nor is it everything related to the NSA’s communications collection processes. Feel free to share in comments any observations or additional data points that might be of interest.

Please also note the two deaths in 2010; Stuxnet and its sibling applications were not the only efforts made to halt nuclear proliferation in Iran. These two events cast a different light on the surrounding cyber attacks.

Lastly, file this under “dog not barking”:

Why aren’t any large corporations making a substantive case to their customers that they are offended by the NSA’s breach of their private communications through their communications providers?

James Clapper’s Tip for Avoiding Lies: Don’t Do Talking Points

[youtube]QwiUVUJmGjs[/youtube]

For a guy who warned for years about an abuse of the FISA Amendments Act and Section 215 of the PATRIOT Act, I have to admit Ron Wyden was pretty circumspect  yesterday. He issued a statement, partly to reiterate his call to make this public, partly to suggest the program isn’t worth much.

The administration has an obligation to give a substantive and timely response to the American people and I hope this story will force a real debate about the government’s domestic surveillance authorities. The American people have a right to know whether their government thinks that the sweeping, dragnet surveillance that has been alleged in this story is allowed under the law and whether it is actually being conducted. Furthermore, they have a right to know whether the program that has been described is actually of value in preventing attacks. Based on several years of oversight, I believe that its value and effectiveness remain unclear.

And he sent out three tweets:

Of course, it’s the second tweet — showing the Director of National Intelligence lying in testimony to Congress about whether the NSA collects “any data at all on millions or hundreds of millions of Americans” — I found most interesting.

Wyden always has had a knack for exposing people as liars.

By the end of the day the National Journal had contacted Clapper to provide him an opportunity to explain why this lie to Congress wasn’t a lie. He offered a nonsensical explanation.

Director of National Intelligence James Clapper said Thursday that he stood by what he told Sen. Ron Wyden, D-Ore., in March when he said that the National Security Agency does not “wittingly” collect data on millions of Americans.

What I said was, the NSA does not voyeuristically pore through U.S. citizens’ e-mails. I stand by that,” Clapper told National Journal in a telephone interview.

On March 12, at a hearing of the Senate Intelligence Committee, Wyden asked Clapper: “Does the NSA collect any type of data at all on millions or hundreds of millions of Americans?” Clapper responded: “No, sir.” When Wyden followed up by asking, “It does not?” Clapper said: “Not wittingly. There are cases where they could, inadvertently perhaps, collect—but not wittingly.” Clapper did not specify at the time that he was referring to e-mail. [my emphasis]

Clapper’s lie — that he took Wyden’s “collected any type of data at all” to mean “voyeuristically pore through emails” — is all the worse for how bad a non-sequitur it is. Caught in a lie, the head of our Intelligence Community responded with word salad.

Given that abysmal attempt to explain away his lie, I find it all the more curious the Administration decided Clapper, newly exposed as a liar, would be the guy to head pushback to the revelations of the last few days. Late in the day Clapper issued first one, then another “statement” on the revelations.

Both, of course, issued stern condemnations of leaks revealing that he had lied (and that Americans have no privacy).

The unauthorized disclosure of a top secret U.S. court document threatens potentially long-lasting and irreversible harm to our ability to identify and respond to the many threats facing our nation.

[snip]

The unauthorized disclosure of information about this important and entirely legal program is reprehensible and risks important protections for the security of Americans.

Those are hollow warnings, of course, for the reasons I laid out here.

Clapper then goes on to claim that both stories misrepresent the programs.

The article omits key information regarding how a classified intelligence collection program is used to prevent terrorist attacks and the numerous safeguards that protect privacy and civil liberties.

[snip]

The Guardian and The Washington Post articles refer to collection of communications pursuant to Section 702 of the Foreign Intelligence Surveillance Act.  They contain numerous inaccuracies.

Worlds tiniest violin! After refusing urgent requests from members of Congress who had been briefed on this to be transparent for years, the Intelligence Community has lost its ability to spin this!

Perhaps the most interesting part of Clapper’s two statements, however, is the way Clapper purportedly clarified a detail about the WaPo/Guardian stories on PRISM.

Clapper — and an anonymous statement from a Senior Administration Official issued minutes before Clapper’s — made explicitly clear PRISM operates under Section 702 of the FISA Amendments Act.

Section 702 is a provision of FISA that is designed to facilitate the acquisition of foreign intelligence information concerning non-U.S. persons located outside the United States. It cannot be used to intentionally target any U.S. citizen, any other U.S. person, or anyone located within the United States.

Activities authorized by Section 702 are subject to oversight by the Foreign Intelligence Surveillance Court, the Executive Branch, and Congress. They involve extensive procedures, specifically approved by the court, to ensure that only non-U.S. persons outside the U.S. are targeted, and that minimize the acquisition, retention and dissemination of incidentally acquired information about U.S. persons.

Section 702 was recently reauthorized by Congress after extensive hearings and debate.

Section 702, Section 702, Section 702.

This claim had only been implicit in the reporting in the WaPo and Guardian.

Read more

An IP Tax, before It’s Too Late

[youtube]N-Pfl6_DlF8[/youtube]

While I was at Netroots Nation, I thought a lot about how the US could tax Intellectual Property. When I saw Honeywell’s CEO claim he should pay no taxes I thought about how much his tech relied on protecting patents. Of course, I was prepping for my panel on tax cheat Apple, which is in a big fight with Samsung. And Microsoft’s earnings last year largely stemmed from tax arbitrage, yet it has no product if people can just copy its software for free.

America’s companies don’t want to pay their fair share to America anymore. And yet most of our most successful international firms–particularly the software and film and ag and drug companies–rely on us to police their intellectual property rights. Having the global bully backing these companies’ intellectual property rights is a cornerstone to their business.

Case in point:

China has overhauled parts of its intellectual property laws to allow its drug makers to make cheap copies of medicines still under patent protection in an initiative likely to unnerve foreign pharmaceutical companies.

The Chinese move, outlined in documents posted on its patent law office website, comes within months of a similar move by India to effectively end the monopoly on an expensive cancer drug made by Bayer AG by issuing its first so-called “compulsory license”.

The action by China will ring alarm bells in Big Pharma, since the country is a vital growth market at a time when sales in Western countries are flagging.

As Yves notes, this is all totally legal, and probably a way for China to start challenging our IP on drugs more generally.

The intriguing part of this is that this Chinese initiative is completely kosher under WTO rules when life-saving medicines are too costly. Given the high prices put on certain AIDS and cancer drugs in dollar terms, they’re the perfect targets for an action like this. India gave a compulsory license for the manufacture of Nexavar which is used to treat kidney and liver cancers. China appears to be using the compulsory license threat to improve its bargaining leverage for some of the newer HIV drugs, such at Gilead’s tenofovir. China was excluded from a deal with a group of nations to buy tenofovir by paying cost plus a small royalty. Gilead has offered more concessions after the media leaked that China was considering implementing compulsory licensing.

Given that China has repeatedly shown it does not have a lot of respect for intellectual property, and it already makes many active pharmaceutical ingredients, one also has to wonder whether this program will serve, intentionally or by accident, to embolden companies that already make the ingredients to start selling bootleg drugs on the side.

It may already be too late–in spite of Obama’s announced “pivot” to Asia, we’ve kept our resources in the Middle East losing another decade long war there. China knows we’re not going to push on IP too aggressively (even ignoring the shaky dollar).

Nevertheless all these wars and all this bullying is really serving the purposes of the IP holders, not the average American. And yet, those IP holders don’t want to pay their fair share–or anything, really–to support all this global bullying.

Shouldn’t we tax those companies relying on us to enforce their IP?

Hints That the FISCR Plaintiff Is an Email Provider

I’ve said in the last two threads on the FISCR opinion that the plaintiff is an email provider. Here’s why I believe that to be true.

On February 29, 2008, the Computer & Communications Industry Association wrote the Members of the House (which was then considering its own amendments to FISA, distinct from those that had been already passed in the Senate), lobbying against retroactive immunity. CCIA, recall, is the trade group for a bunch of tech companies, including email providers Yahoo, Microsoft, and Google. That letter reads:

The Computer & Communications Industry Association (CCIA) strongly opposes S. 2248, the “FISA Amendments Act of 2007,” as passed by the Senate on February 12, 2008. CCIA believes that this bill should not provide retroactive immunity to corporations that may have participated in violations of federal law. CCIA represents an industry that is called upon for cooperation and assistance in law enforcement. To act with speed in times of crisis, our industry needs clear rules, not vague promises that the U.S. Government can be relied upon to paper over Constitutional transgressions after the fact. !!

CCIA dismisses with contempt the manufactured hysteria that industry will not aid the United States Government when the law is clear. As a representative of industry, I find that suggestion insulting. To imply that our industry would refuse assistance under established law is an affront to the civic integrity of businesses that have consistently cooperated unquestioningly with legal requests for information. This also conflates the separate questions of blanket retroactive immunity for violations of law, and prospective immunity, the latter of which we strongly support.

Therefore, CCIA urges you to reject S. 2248. America will be safer if the lines are bright. The perpetual promise of bestowing amnesty for any and all misdeeds committed in the name of security will condemn us to the uncertainty and dubious legalities of the past. Let that not be our future as well. [my emphasis]

On February 29, 2008, at a time when the plaintiff in this case was almost certainly actively pursuing the case (I’ll do a review of timing in a later post), the trade association for the country’s biggest free email providers was lobbying:

  • Against retroactive immunity for those companies participated in violations of federal law, suggesting that the trade organization believed earlier cooperation was clearly illegal Read more