Posts

What Was the Relationship Between FSB and GRU in the DNC Hack, Redux?

I want to return to last week’s House Intelligence Hearing on Russia (because that fecker Devin Nunes canceled my birthday hearing with James Clapper and John Brennan today), to revisit a question I’ve asked a number of times (in most detail here): what was the relationship between Russia’s FSB and GRU intelligence services in the DNC hack?

The public narrative (laid out in this post) goes like this: Sometime in summer 2015, APT (Advanced Persistent Threat) 29 (associated with FSB, Russia’s top intelligence agency) hacked the DNC along with 1,000 other targets and because DNC ignored FBI’s repeated warnings, remained in their network unnoticed. Then, in March 2016, APT 28 (generally though not universally associated with GRU, Russia’s military intelligence) hacked DNC and John Podesta. According to the public story, GRU oversaw the release (via DC Leaks and Guccifer 2.0) and leaking (to Wikileaks via as-yet unidentified cut-outs) of the stolen documents.

Under the public story, then, FSB did the same kind of thing the US does (for example, with Enrique Peña Nieto in 2012), collecting intelligence on a political campaign, whereas GRU did something new (though under FBI-directed Sabu, we did something similar to Bashar al-Assad in 2012), leaking documents to Wikileaks.

Obama’s sanctions to retaliate for the hack primarily focused on GRU, but did target FSB as well, though without sanctioning any FSB officers by name. And in its initial report on the Russian hack, the government conflated the two separate groups, renaming attack tools previously dubbed Cozy and Fancy Bear the “Grizzly Steppe,” making any detailed discussion of how they worked together more confusing. As I noted, however, the report may have offered more detail about what APT 29 did than what APT 28 did.

Last week’s hearing might have been an opportunity to clarify this relationship had both sides not been interested in partisan posturing. Will Hurd even asked questions that might have elicited more details on how this worked, but Admiral Mike Rogers refused to discuss even the most basic details  of the hacks.

HURD: Thank you, Chairman.

And gentlemen, thank you all for being here. And thank you for your continued service to your country. I’ve learned recently the value of sitting in one place for a long period of time and listening and today I’m has added to that understanding and I’m going to try to ask questions that y’all can answer in this format and are within your areas of expertise. And Director Rogers, my first question to you — the exploit that was used by the Russian’s to penetrate the DNC, was it sophisticated? Was it a zero day exploit? A zero day being some type of — for those that are watching, an exploit that has never been used before?

ROGERS: In an open unclassified forum, I am not going to talk about Russian tactics, techniques or procedures about how they executed their hacks.

HURD: If members of the DNC had not — let me rephrase this, can we talk about spear fishing?

ROGERS: Sure, in general terms, yes sir.

HURD: Spear fishing is when somebody sends an email and they — somebody clicks on something in that email…

ROGERS: Right, the user of things (inaudible) they’re receiving an email either of interest or from a legitimate user, they open it up and they’ll often click if you will on a link — an attachment.

HURD: Was that type of tactic used in the…

ROGERS: Again, I’m not in an unclassified forum just not going to be…

The refusal to discuss the most basic details of this hack — even after the government listed 31 reports describing APT 28 and 29 (and distinguishing between the two) in its updated report on the hacks — is weird, particularly given the level of detail DOJ released on the FSB-related hack of Yahoo. Given that the tactics themselves are not secret (and have been confirmed by FBI, regardless of what information NSA provided), it seems possible that the government is being so skittish about these details because they don’t actually match what we publicly know. Indeed, at least one detail I’ve learned about the documents Guccifer 2.0 leaked undermines the neat GRU-FSB narrative.

Comey did confirm something I’ve been told about the GRU side of the hack: they wanted to be found (whereas the FSB side of the hack had remained undiscovered for months, even in spite of FBI’s repeated efforts to warn DNC).

COMEY: The only thing I’d add is they were unusually loud in their intervention. It’s almost as if they didn’t care that we knew what they were doing or that they wanted us to see what they were doing. It was very noisy, their intrusions in different institutions.

There is mounting evidence that Guccifer 2.0 went to great lengths to implicate Russia in the hack. Confirmation GRU also went out of its way to make noise during the DNC hack may suggest both within and outside of the DNC the second hack wanted to be discovered.

I have previously pointed to a conflict between what Crowdstrike claimed in its report on the DNC hack and what the FBI told FireEye. Crowdstrike basically said the two hacking groups didn’t coordinate at all (which Crowdstrike took as proof of sophistication). Whereas FireEye said they did coordinate (which it took as proof of sophistication and uniqueness of this hack). I understand the truth is closer to the latter. APT 28 largely operated on its own, but at times, when it hit a wall of sorts, it got help from APT 29 (though there may have been some back and forth before APT 29 did share).

All of which brings me to two questions Elise Stefanik asked. First, she asked — casually raising it because it had “been in the news recently” — whether the FSB was collecting intelligence in its hack of Yahoo.

STEFANIK: Thank you. Taking a further step back of what’s been in the news recently, and I’m referring to the Yahoo! hack, the Yahoo! data breech, last week the Department of Justice announced that it was charging hackers with ties to the FSB in the 2014 Yahoo! data breech. Was this hack done to your knowledge for intelligence purposes?

COMEY: I can’t say in this forum.

STEFANIK: Press reporting indicates that Yahoo! hacked targeted journalists, dissidence and government officials. Do you know what the FSB did with the information they obtained?

COMEY: Same answer.

Again, in spite of the great deal of detail in the indictment, Comey refused to answer these obvious questions.

The question is all the more interesting given that the indictment alleges that Alexsey Belan (who was sanctioned along with GRU in December) had access to Yahoo’s network until December 2016, well after these hacks. More interestingly, Belan was “minting” Yahoo account credentials at least as late as May 20, 2016. That’s significant, because one of the first things that led DNC to be convinced Russia was hacking it was when Ali Chalupa, who was then collecting opposition research on Paul Manafort from anti-Russian entities in Ukraine, kept having her Yahoo account hacked in early May. With the ability to mint cookies, the FSB could have accessed her account without generating a Yahoo notice. Chalupa has recently gone public about some, though not all, of the other frightening things that happened to her last summer (she was sharing them privately at the time). So at a time when the FSB could have accomplished its goals unobtrusively, hackers within the DNC network, Guccifer 2.0 outside of it, and stalkers in the DC area were all alerting Chalupa, at least, to their presence.

While it seems increasingly likely the FSB officers indicted for the Yahoo hack (one of whom has been charged with treason in Russia) were operating at least partly on their own, it’s worth noting that overlapping Russian entities had three different ways to access DNC targets.

Note, Dianne Feinstein is the one other person I’m aware of who is fully briefed on the DNC hack and who has mentioned the Yahoo indictment. Like Comey, she was non-committal about whether the Yahoo hack related to the DNC hack.

Today’s charges against hackers and Russian spies for the theft of more than 500 million Yahoo user accounts is the latest evidence of a troubling trend: Russia’s sustained use of cyber warfare for both intelligence gathering and financial crimes. The indictment shows that Russia used these cyberattacks to target U.S. and Russian government officials, Russian journalists and employees of cybersecurity, financial services and commercial entities.

There seems to be a concerted effort to obscure whether the Yahoo hack had any role in the hack of the DNC or other political targets.

Finally, Stefanik asked Comey a question I had myself.

STEFANIK: OK, I understand that. How — how did the administration determine who to sanction as part of the election hacking? How — how familiar with that decision process and how is that determination made?

COMEY: I don’t know. I’m not familiar with the decision process. The FBI is a factual input but I don’t recall and I don’t have any personal knowledge of how the decisions are made about who to sanction.

One place you might go to understand the relationship between GRU and FSB would be to Obama’s sanctions, which described the intelligence targets this way.

  • The Main Intelligence Directorate (a.k.a. Glavnoe Razvedyvatel’noe Upravlenie) (a.k.a. GRU) is involved in external collection using human intelligence officers and a variety of technical tools, and is designated for tampering, altering, or causing a misappropriation of information with the purpose or effect of interfering with the 2016 U.S. election processes.
  • The Federal Security Service (a.k.a. Federalnaya Sluzhba Bezopasnosti) (a.k.a FSB) assisted the GRU in conducting the activities described above.

[snip]

  • Sanctioned individuals include Igor Valentinovich Korobov, the current Chief of the GRU; Sergey Aleksandrovich Gizunov, Deputy Chief of the GRU; Igor Olegovich Kostyukov, a First Deputy Chief of the GRU; and Vladimir Stepanovich Alexseyev, also a First Deputy Chief of the GRU.

Remember, by the time Obama released these sanctions, several FSB officers, including Dmitry Dokuchaev (who was named in the Yahoo indictment) had been detained for treason for over three weeks. But the officers named in the sanctions, unlike the private companies and individual hackers, are unlikely to be directly affected by the sanctions.

The sanctions also obscured whether Belan was sanctioned for any role in the DNC hack.

  • Aleksey Alekseyevich Belan engaged in the significant malicious cyber-enabled misappropriation of personal identifiers for private financial gain.  Belan compromised the computer networks of at least three major United States-based e-commerce companies.

Again, all of this suggests that the intelligence community has reason to want to obscure how these various parts fit together, even while publicizing the details of the Yahoo indictment.

Which suggests a big part of the story is about how the public story deviates from the real story the IC is so intent on hiding.

Marcy has been blogging full time since 2007. She’s known for her live-blogging of the Scooter Libby trial, her discovery of the number of times Khalid Sheikh Mohammed was waterboarded, and generally for her weedy analysis of document dumps.

Marcy Wheeler is an independent journalist writing about national security and civil liberties. She writes as emptywheel at her eponymous blog, publishes at outlets including the Guardian, Salon, and the Progressive, and appears frequently on television and radio. She is the author of Anatomy of Deceit, a primer on the CIA leak investigation, and liveblogged the Scooter Libby trial.

Marcy has a PhD from the University of Michigan, where she researched the “feuilleton,” a short conversational newspaper form that has proven important in times of heightened censorship. Before and after her time in academics, Marcy provided documentation consulting for corporations in the auto, tech, and energy industries. She lives with her spouse and dog in Grand Rapids, MI.

When a White Republican Gets Spied On, Privacy Suddenly Matters

As expected, much of today’s hearing on the Russian hack consisted of members of Congress — from both parties — posturing for the camera.

At first, it seemed that the Republican line of posturing — complaining about the leak that exposed Mike Flynn’s conversations with Ambassador Sergey Kislyak — tracked Donald Trump’s preferred approach, to turn this into a witch hunt for the leakers.

But it was actually more subtle than that. It appears Republicans believe the leaks about Flynn have (finally) made Congress skittish about incidental collection of US person communications as part of FISA collection. And so both Tom Rooney and Trey Gowdy spent much of their early hearing slots discussing how much more difficult the leak of Flynn’s name will make Section 702 reauthorization later this year. In the process, they should have created new fears about how painfully ignorant the people supposedly overseeing FISA are.

Rooney, who heads the subcommittee with oversight over NSA, started by quizzing Mike Rogers about the process by which a masked US person identity can be disclosed. Along the way, it became clear Rooney was talking about Section 702 reauthorization even while he was talking traditional FISA collection, which doesn’t lapse this year.

Rooney: If what we’re talking about is a serious crime, as has been alleged, in your opinion would leaking of a US person who has been unmasked and disseminated by intelligence community officials, would that leaking hurt or help our ability to conduct national security.

Rogers: Hurt.

Rooney: Ok, if it hurts, this leak, which through the 702 tool, which we all agree is vital–or you and I at least agree to that–do you think that that leak actually threatens our national security. If it’s a crime, and if it unmasks a US person, and this tool is so important it could potentially jeopardize this tool when we have to try to reauthorize it in a few months, if this is used against our ability to reauthorize this tool, and we can’t get it done because whoever did this leak, or these nine people that did this leak, create such a stir, whether it be in our legislative process or whatever, that they don’t feel confident a US person, under the 702 program, can be masked, successfully, and not leaked to the press, doesn’t that hurt–that leak–hurt our national security.

Eventually Admiral Rogers broke in to explain to his congressional overseer very basic facts about surveillance, including that Flynn was not and could not have been surveilled under Section 702.

Rogers: FISA collection on targets in the United States has nothing to do with 702, I just want to make sure we’re not confusing the two things here. 702 is collection overseas against non US persons.

Rooney: Right. And what we’re talking about here is incidentally, if a US person is talking to a foreign person that we’re listening to whether or not that person is unmasked.

Nevertheless, Rooney made it very clear he’s very concerned about how much harder the Flynn leak will make it for people like him to convince colleagues to reauthorize Section 702, which is even more of a privacy concern than traditional FISA.

Rooney: But it’s really going to hurt the people on this committee and you in the intelligence community when we try to retain this tool this year and try to convince some of our colleagues that this is really important for national security when somebody in the intelligence community says, you know what the hell with it, I’m gonna release this person’s name, because I’m gonna get something out of it. We’re all gonna be hurt by that. If we can’t reauthorize this tool. Do you agree with that?

A little later, Trey Gowdy got his second chance to complain about the leak. Referencing Rogers’ earlier explanation that only 20 people at NSA can unmask a US person identity, Gowdy tried to figure out how many at FBI could, arguing (this is stunning idiocy here) that by finding a finite number of FBI officials who could unmask US person identities might help assuage concerns about potential leaks of US persons caught in FISA surveillance.

Comey: I don’t know for sure as I sit here. Surely more, given the nature of the FBI’s work. We come into contact with US persons a whole lot more than the NSA does because we may be conducting — we only conduct our operations in the United States to collect electronic surveillance. I can find out the exact number. I don’t know it as I sit here.

Gowdy: I think Director Comey given the fact that you and I agree that this is critical, vital, indispensable. A similar program is coming up for reauthorization this fall with a pretty strong head wind right now, it would be nice to know the universe of people who have the power to unmask a US citizen’s name. Cause that might provide something of a road map to investigate who might have actually disseminated a masked US citizen’s name.

Here’s why this line of questioning from Gowdy is unbelievably idiotic. Both for traditional FISA, like the intercept targeting Kislyak that caught Flynn, and for Section 702, masking and unmasking identities at FBI is not the concern. That’s because the content from both authorities rests in FBI’s databases, and anyone cleared for FISA can access the raw data. And those FBI Agents not cleared for FISA can and are encouraged just to ask a buddy who is cleared to do it.

In other words, every Agent at FBI has relatively easy way to access the content on Flynn, so long as she can invent a foreign intelligence or criminal purpose reason to do so.

Which is probably why Comey tried to pitch something he called “culture” as adequate protection, rather than the very large number of FBI Agents who are cleared into FISA.

Comey: The number is … relevant. What I hope the US–the American people will realize is the number’s important but the culture behind it is in fact more important. The training, the rigor, the discipline. We are obsessive about FISA in the FBI for reasons I hope make sense to this committee. But we are, everything that’s FISA has to be labeled in such a way to warn people this is FISA, we treat this in a special way. So we can get you the number but I want to assure you the culture in the FBI and the NSA around how we treat US person information is obsessive, and I mean that in a good way.

So then Gowdy asks Comey something he really has a responsibility to know: what other agencies have Standard Minimization Procedures. (The answer, at least as the public record stands, is NSA, CIA, FBI, and NCTC have standard minimization procedures, with Main Justice using FBI’s SMPs.)

Gowdy: Director Comey I am not arguing with you and I agree the culture is important, but if there are 100 people who have the ability to unmask and the knowledge of a previously masked name, then that’s 100 different potential sources of investigation. And the smaller the number is, the easier your investigation is. So the number is relevant. I can see the culture is relevant. NSA, FBI, what other US government agencies have the authority to unmask a US citizen’s name?

Comey: Well I think all agencies that collect information pursuant to FISA have what are called standard minimization procedures which are approved by the FISA court that govern how they will treat US person information. So I know the NSA does, I know the CIA does, obviously the FBI does, I don’t know for sure beyond that.

Gowdy: How about Main Justice?

Comey: Main Justice I think does have standard minimization procedures.

Gowdy: Alright, so that’s four. NSA, FBI, CIA, Main Justice. Does the White House has the authority to unmask a US citizen’s name?

Comey: I think other elements of the government that are consumers of our can ask the collectors to unmask. The unmasking resides with those who collected the information. And so if Mike Rogers’ folks collected something, and they send it to me in a report and it says it’s US person #1 and it’s important for the FBI to know who that is, our request will go back to them. The White House can make similar requests of the FBI or NSA but they don’t on their own collect, so they can’t on their own unmask.

That series of answers didn’t satisfy Gowdy, because from his perspective, if Comey isn’t able to investigate and find a head for the leak of Flynn’s conversation with Kislyak — well, I don’t know what he thinks but he’s sure an investigation, possibly even the prosecution of journalists, is the answer.

Gowdy: I guess what I’m getting at Director Comey, you say it’s vital, you say it’s critical, you say that it’s indispensable, we both know it’s a threat to the reauthorization of 702 later on this fall and oh by the way it’s also a felony punishable by up to 10 years. So how would you begin your investigation, assuming for the sake of argument that a US citizen’s name appeared in the Washington Post and the NY Times unlawfully. Where would you begin that investigation?

This whole series of questions frankly mystifies me. I mean, these two men who ostensibly provide oversight of FISA clearly didn’t understand what the biggest risk to privacy is –back door searches of US person content — which at the FBI doesn’t even require any evidence of wrong-doing. That is the biggest impediment to reauthorizing FISA.

And testimony about the intricacies of unmasking a US person identity — particularly when a discussion of traditional FISA serves as stand-in for Section 702 — does nothing more than expose that the men who supposedly oversee FISA closely have no fucking clue — and I mean really, not a single fucking clue — how it works. Devin Nunes, too, has already expressed confusion on how access to incidentally collected US person content works.

Does anyone in the House Intelligence Committee understand how FISA works? Bueller?

In retrospect, I’m really puzzled by what is so damning about the Flynn leak to them. I mean, don’t get me wrong, I’m very sympathetic to the complaint that the contents of the intercepts did get leaked. If you’re not, you should be. Imagine how you’d feel if a Muslim kid got branded as a terrorist because he had a non-criminal discussion with someone like Anwar al-Awlaki? (Of course, in actual fact what happened is the Muslim kids who had non-criminal discussions with Awlaki had FBI informants thrown at them until they pressed a button and got busted for terrorism, but whatever.)

But Rooney and Gowdy and maybe even Nunes seemed worried that their colleagues in the House have seen someone like them — not a young Muslim, but instead a conservative white man — caught up in FISA, which has suddenly made them realize that they too have conversations all the time that likely get caught up in FISA?

Or are they worried that the public discussion of FISA will expose them for what they are, utterly negligent overseers, who don’t understand how invasive of privacy FISA currently is?

If it’s the latter, their efforts to assuage concerns should only serve to heighten those concerns. These men know so little about FISA they don’t even understand what questions to ask.

In any case, after today’s hearing I am beginning to suspect the IC doesn’t like to have public hearings not because someone like me will learn something, but because we’ll see how painfully little most of the so-called overseers have learned in all the private briefings the IC has given them. If these men don’t understand the full implications of incidental collection, two months after details of Flynn’s conversations have been leaked, then it seems likely they’ve been intentionally mis or underinformed.

Or perhaps they’re just not so bright.

Marcy has been blogging full time since 2007. She’s known for her live-blogging of the Scooter Libby trial, her discovery of the number of times Khalid Sheikh Mohammed was waterboarded, and generally for her weedy analysis of document dumps.

Marcy Wheeler is an independent journalist writing about national security and civil liberties. She writes as emptywheel at her eponymous blog, publishes at outlets including the Guardian, Salon, and the Progressive, and appears frequently on television and radio. She is the author of Anatomy of Deceit, a primer on the CIA leak investigation, and liveblogged the Scooter Libby trial.

Marcy has a PhD from the University of Michigan, where she researched the “feuilleton,” a short conversational newspaper form that has proven important in times of heightened censorship. Before and after her time in academics, Marcy provided documentation consulting for corporations in the auto, tech, and energy industries. She lives with her spouse and dog in Grand Rapids, MI.

FBI Delayed Telling the Gang of Four about Trump-Related Investigation Because It Is So Serious

As every newspaper in town has reported, at today’s hearing into Russia’s hack of the DNC, Jim Comey confirmed that the FBI has a counterintelligence investigation into the hack that includes whether Trump’s associates coordinated with Russian actors. Along the way, Comey refused to join in James Clapper’s statement that there was no evidence of collusion between Trump’s aides and Russia. When the now retired Director of National Intelligence said that, Clapper had emphasized that his statement only extended through the end of his service, January 20; he warned that some evidence may have been discovered after that.

A far more telling detail came close to the end of the hearing, during NY Congresswoman Elise Stefanik’s questioning. She started by asking what typical protocols were for informing the DNI, the White House, and senior Congressional leadership about counterintelligence investigations.

Stefanik: My first set of questions are directed at Director Comey. Broadly, when the FBI has any open counterintelligence investigation, what are the typical protocols or procedures for notifying the DNI, the White House, and senior congressional leadership?

Comey: There is a practice of a quarterly briefing on sensitive cases to the Chair and Ranking of the House and Senate Intelligence Committees. The reason I hesitate is, thanks to feedback we’ve gotten, we’re trying to make it better. And that involves a briefing briefing the Department of Justice, I believe the DNI, and the — some portion of the National Security Council at the White House. We brief them before Congress is briefed.

Stefanik: So it’s quarterly for all three, then, senior congressional leadership, the White House, and the DNI?

Comey: I think that’s right. Now that’s by practice, not by rule or by written policy. Which is why, thanks to the Chair and Ranking giving us feedback, we’re trying to tweak it in certain ways.

Note that point: the practice has been that FBI won’t brief the Gang of Four until after they’ve briefed DOJ, the DNI, and the White House. Stefanik goes on to ask why, if FBI normally briefs CI investigations quarterly, why FBI didn’t brief the Gang of Four before the last month, at least seven months after the investigation started. Comey explains they delayed because of the sensitivity of the investigation.

Stefanik: So since in your opening statement you confirmed that there is a counterintelligence investigation currently open and you also referenced that it started in July, when did  you notify the DNI, the White House, or senior Congressional leadership?

Comey: Congressional leadership, sometime recently — they were briefed on the nature of the investigation and some details, as I said. Obviously the Department of Justice must have been aware of it all along. The DNI … I don’t know what the DNI’s knowledge of it was, because we didn’t have a DNI until Mr. Coats took office and I briefed him his first morning in office.

Stefanik: So just to drill down on this, if the open investigation began in July, and the briefing of Congressional leadership only occurred recently, why was there no notification prior to the recent — the past month.

Comey: I think our decision was it was a matter of such sensitivity that we wouldn’t include it in the quarterly briefings.

Stefanik: So when you state “our decision,” is that your decision, is it usually your decision what gets briefed in those quarterly updates?

Comey: No. It’s usually the decision of the head of our counterintelligence division.

Stefanik: And just again, to get the details on the record, why was the decision not to brief senior congressional leadership until recently, when the investigation had been open since July, a very serious investigation. Why was that decision made to wait months?

Comey: Because of the sensitivity of the matter.

Stefanik then got Comey to reconfirm what the IC report says: that Russia had hacked numerous entities, he would later say over a thousand, including Republican targets.

Stefanik then turned to the Yahoo investigation. She asked whether the FSB officers involved conducted the hack for intelligence purposes — a question Comey refused to answer. He also refused to answer what the FSB did with the information stolen.

Stefanik: Taking a further step back of what’s been in the news recently and I’m referring to the Yahoo hack, the Yahoo data breach, last week the Department of Justice announced it was charging hackers with ties to the FSB in the 2014 data breach. Was this hack done, to your knowledge, for intelligence purposes?

Comey: I can’t say in this forum.

Stefanik: Press reporting indicates the Yahoo hack targeted journalists, dissidents and government officials. Do you know what the FSB did with the information they obtained?

Comey: Same answer.

Stefanik: Okay, I understand that.

This is important for a number of reasons, including the evidence that the FSB was hiding their hacking from others in Russia.

Stefanik then turned to the sanctions, asking if Comey had any insight into how the Obama Administration chose who got sanctioned in December — which included Alexsey Belan but not the FSB officers involved (one of whom, Dmitry Dokuchaev, was already under arrest for treason by the time of the sanctions).

Stefanik: How did the Administration determine who to sanction as part of the election hacking? How familiar are [] with that decision process and how is that determination made?

Comey: I don’t know. I’m not familiar with the decision-making process. The FBI is a factual input but I don’t recall — I don’t have any personal knowledge about how the decisions were made about who to sanction.

Again, her interest in this is significant — I’ll explain why in a follow-up.

Stefanik then asked what the intelligence agencies would do going forward to keep entities safe from Russian hacking. As part of the response, Mike Rogers revealed (unsurprisingly) that NSA first learned of FSB’s hacking of those many targets in the summer of 2015.

Finally, Stefanik returned to her original point, when Congress gets briefed on CI investigations. Comey’s response was remarkable.

Stefanik: It seems to me, in my first line of questioning, the more serious a counterintelligence investigation is, that would seem to trigger the need to update not just the White House, the DNI, but also senior congressional leadership. And you stated it was due to the severity. I think moving forward, it seems the most severe and serious investigations should be notified to senior congressional leadership. And with that thanks for your lenience, Mr. Chairman, I yield back.

Comey could have been done with Stefanik yielding back. But instead, he interrupted, and suggested part of the delay had to do with the practice of briefing within the Executive Branch NSC before briefing Congress.

Comey: That’s good feedback, Ms. Stefanik, the challenge for is, sometimes we want to keep it tight within the executive branch, and if we’re going to go brief congressional leaders, the practice has been then we brief inside the executive branch, and so we have to try to figure out how to navigate that in a good way.

Which seems to suggest one reason why the FBI delayed briefing the Gang of Four (presumably, this is the Gang of Eight) is because they couldn’t brief all Executive Branch people the White House, and so couldn’t brief Congress without first having briefed the White House.

Which would suggest Mike Flynn may be a very central figure in this investigation.

Update: I’ve corrected my last observation to match Comey’s testimony that the delay had to do with keeping things on a close hold within the Executive Branch. That may be nothing, it may reflect the delay on confirming Dan Coats, it may be Flynn (if you normally brief the NSC, after all the National Security Advisor would be among the first to be briefed), but it also could be Jeff Sessions.

Marcy has been blogging full time since 2007. She’s known for her live-blogging of the Scooter Libby trial, her discovery of the number of times Khalid Sheikh Mohammed was waterboarded, and generally for her weedy analysis of document dumps.

Marcy Wheeler is an independent journalist writing about national security and civil liberties. She writes as emptywheel at her eponymous blog, publishes at outlets including the Guardian, Salon, and the Progressive, and appears frequently on television and radio. She is the author of Anatomy of Deceit, a primer on the CIA leak investigation, and liveblogged the Scooter Libby trial.

Marcy has a PhD from the University of Michigan, where she researched the “feuilleton,” a short conversational newspaper form that has proven important in times of heightened censorship. Before and after her time in academics, Marcy provided documentation consulting for corporations in the auto, tech, and energy industries. She lives with her spouse and dog in Grand Rapids, MI.

Trump Raises the Axe over the Intelligence Community, Again

The Intelligence Community is finishing its report on the intelligence regarding Russia’s influence in our elections. The report is expected to be delivered to President Obama tomorrow and briefed to President Elect Trump on Friday.

That’s the context for — and surely at least part of the explanation for — this WSJ story reporting that Trump plans to reorganize the intelligence community.

[A]dvisers also are working on a plan to restructure the Central Intelligence Agency, cutting back on staffing at its Virginia headquarters and pushing more people out into field posts around the world. The CIA declined to comment on the plan.

“The view from the Trump team is the intelligence world [is] becoming completely politicized,” said the individual, who is close to the Trump transition operation. “They all need to be slimmed down. The focus will be on restructuring the agencies and how they interact.”

[snip]

The Office of the Director of National Intelligence was established in 2004 in large part to boost coordination between intelligence agencies following the Sept. 11, 2001 terror attacks.

Many Republicans have proposed cutting the ODNI before, but this has proven hard to do in part because its mission centers are focused on core national security issues, such as counterterrorism, nuclear proliferation, and counterintelligence.

“The management and integration that DNI focuses on allows agencies like the CIA to better hone in on its own important work,” said Rep. Adam Schiff (D., Calif.), the ranking Democrat on the House Intelligence Committee, who believes dismantling the ODNI could lead to national security problems.

Mr. Trump’s advisers say he has long been skeptical of the CIA’s accuracy, and the president-elect often mentions faulty intelligence in 2002 and 2003 concerning Iraq’s weapons programs. But he has focused his skepticism of the agencies squarely on their Russia assessments, which has jarred analysts who are accustomed to more cohesion with the White House.

The report repeats earlier reporting — in part from some of the same WSJ reporters — that Trump planned this briefing. Back then, in mid-November, Trump was merely disdainful of the IC and much of the reorganization appeared to be a mix of vengeance on the part of Mike Flynn and, frankly, some reasonable ideas (things like splitting NSA and reversing some of the questionable changes John Brennan made). At the center of it all was a plan to make Admiral Mike Rogers Director of National Intelligence.

The day after that reporting, however, outlets reported that Ash Carter and James Clapper had been planning to fire Rogers, partly because the NSA had remained a leaky sieve under his tenure and partly because he had delayed cyber-bombing ISIS (perhaps to preserve intelligence collection). And that’s before it became public that the NSA hadn’t adopted four security measures recommended after the Snowden leaks.

After that, of course, Democrats and the CIA started leaking that Russia hacked the DNC with the purpose of electing Trump, which gave Trump the entrée to suggest this discussion is all politicized, which has escalated to this week. Trump seems to have orchestrated the Sean Hannity interview at which Julian Assange said what he has long said — that he didn’t get the DNC files from Russia.

Reuters is now reporting that after the election the IC determined that third parties had gotten the files from Russian entities to Wikileaks, which means Assange likely has no idea where the files came from.

But the timing of this story, sourced significantly to the Trump camp, seems to be a warning to those who will brief Trump on Friday. While Clapper and Brennan are on their way out (the fate of Comey and Rogers is still undecided), they certainly will want to protect their agencies.

Which should make for an interesting briefing Friday.

Marcy has been blogging full time since 2007. She’s known for her live-blogging of the Scooter Libby trial, her discovery of the number of times Khalid Sheikh Mohammed was waterboarded, and generally for her weedy analysis of document dumps.

Marcy Wheeler is an independent journalist writing about national security and civil liberties. She writes as emptywheel at her eponymous blog, publishes at outlets including the Guardian, Salon, and the Progressive, and appears frequently on television and radio. She is the author of Anatomy of Deceit, a primer on the CIA leak investigation, and liveblogged the Scooter Libby trial.

Marcy has a PhD from the University of Michigan, where she researched the “feuilleton,” a short conversational newspaper form that has proven important in times of heightened censorship. Before and after her time in academics, Marcy provided documentation consulting for corporations in the auto, tech, and energy industries. She lives with her spouse and dog in Grand Rapids, MI.

The Purge, the Benghazi Report, and Trump’s Claim Obama Created ISIS

Please consider a donation to support this work — we’ve got a long haul ahead 

When I learned yesterday that, in addition to “purging” Mike Rogers, Trump had added Devin Nunes and Crazy Pete Hoekstra to his transition team (thus replacing Rogers with both his predecessor and successor as House Intelligence Chair), I wondered whether the Benghazi report had something to do with the exchange. As I noted when the House Intelligence Committee’s report came out, Nunes repeatedly asked questions that Rogers cut short.

The NYT confirms that that is, indeed, one of the reasons Rogers got purged.

One member of the transition team said that at least one reason Mr. Rogers had fallen out of favor among Mr. Trump’s advisers was that, as chairman of the House Intelligence Committee, he had overseen a report about the 2012 attacks on the American diplomatic compound in Benghazi, Libya, which concluded that the Obama administration had not intentionally misled the public about the events there. That report echoed the findings of numerous other government investigations into the episode.

The report’s conclusions were at odds with the campaign position of Mr. Trump, who repeatedly blamed Hillary Clinton, his Democratic opponent and the secretary of state during the attacks, for the resulting deaths of four Americans.

In point of fact, the Additional Views that Rogers released with three other Republicans on the committee (but not Nunes) did find,

Senior U.S. officials perpetuated an inaccurate story that matched the Administration’s misguided view that the United States was nearing victory over al-Qa’ida.

The Additional Views also blamed State for ignoring safety concerns in Benghazi.

So that may not be the key difference between Rogers and Trump with regards to the Benghazi report.

Instead, consider what the report did not say about CIA’s facilitation of Saudi, Qatari, and Turkish arms transfers to Syria during this period — and Nunes’ attempts to push this issue further.

The report concludes that, “The CIA was not collecting and shipping arms from Libya to Syria.” It then explains how it proved this, noting that all witnesses (it sourced its reports only to security personnel and the Benghazi base chief, not the officers at the Annex) said they had not seen any non-CIA weapons at the Annex. But then it said:

From the Annex in Benghazi, the CIA was collecting intelligence about foreign entities that were themselves collecting weapons in Libya and facilitating their passage to Syria.

Here’s what the transcript of the committee’s interview with Mike Morell and the other intel bosses actually shows (page 15):

Mr. [Devin] Nunes: Are we aware of any arms that are leaving that area and going into Syria?

Mr. Morell: Yes, sir.

Mr. Nunes: And who is coordinating that?

Mr. Morell: I believe largely the [redacted–right length for Saudis] are coordinating that.

Mr. Nunes: They are leaving Benghazi ports and going to Syria?

Mr. Morell: I don’t know how they are getting the weapons from Libya to Syria. But there are weapons going from Libya to Syria. And there are probably a number of actors involved in that. One of the biggest are the [redacted–could be Qataris]

Mr. Nunes: And were the CIA folks that were there, were they helping to coordinate that, or were they watching it, were they gathering information about it?

Mr. Morell: Sir, the focus of my officers in Benghazi was [redacted], to try to penetrate the terrorist groups that were there so we could learn their plans, intentions and capabilities

Mike Rogers then interrupts because not everyone in the room is cleared to hear about what the CIA was doing in Benghazi. (Note, Fox’s Catherine Herridge also covered this here.)

Four months later, in a follow-up interview of Morell (file one, file two, at the break), Nunes picked up that line of questioning again. Having gotten Morell to state that there were weapons for security folks at the annex, he tries to clarify that none of these were being sent on. Mike Rogers again interrupts to offer “clarification,” though it becomes clear that on at least one occasion the CIA facility was used to transfer weapons.

The Chairman: There may be an exception, but that was not the rule.

So at the very least CIA was watching its allies send weapons from Libya to Syria, which given the clusterfuck in Syria — most notably the possibility that these weapons are now in the hands of ISIL — may be one reason to moderate the report.

That is, the interviews behind the report include clear evidence that the CIA was watching our allies run arms to Syria (and note, even there, Morell stopped short of saying the CIA wasn’t directly involved). Evidence that Nunes had a particular interest in pursuing.

Now consider a pair of rather famous DIA reports — reports done at a time that Trump advisor Mike Flynn was running the agency — on how the US ended up on the same side as al Qaeda in Syria.

What did the CIA know and when did they know it?

That’s the real question that ought to be raised by a recently declassified Defense Intelligence Agency (DIA) report, obtained by Judicial Watch in a Freedom of Information Act lawsuit. The August 2012 document describes how the U.S. ended up on the same general side in the Syrian Civil War as Al Qaeda in Iraq, the predecessor to ISIS. “AQI supported the Syrian opposition from the beginning,” the report explained. Meanwhile, “[w]estern countries, the Gulf states, and Turkey are supporting” rebel efforts against the Assad regime in a proxy war, putting them on the same side as, if not working together with, the terrorists now overrunning Iraq.

Some outlets have concluded that this means “the West intentionally sponsored violent Islamist groups to destabilize Assad.”

But as Juan Cole counters, the report that western powers supported rebels “doesn’t say that the US created sectarian groups and it does not say that the US favors al-Qaeda in Syria or the so-called ‘Islamic State of Iraq.’” Cole continues, “It says that those powers (e.g. Turkey and the Gulf monarchies) supporting the opposition wanted to see the declaration of a Salafi (hard line Sunni) breakaway statelet, in order to put pressure on the al-Assad regime.”

In a nutshell, Cole argues that the U.S. didn’t support Al-Qaeda in Syria directly. But its allies certainly did.

Two months after the report laying out AQI support for the rebels — another of the documents obtained by Judicial Watch shows — the DIA provided a detailed description of how weapons got shipped from Benghazi to Syria, presumably for rebel groups. “During the immediate aftermath of, and following the uncertainty caused by, the downfall of the [Qaddafi] regime in October 2011 and up until early September of 2012,” the report explained, “weapons from the former Libya military stockpiles located in Benghazi, Libya were shipped from the port of Benghazi, Libya, to the ports of Banias and the Port of Borj Islam, Syria.”

The report obtained by Judicial Watch says that the weapons shipments ended in “early September of 2012.” But note what event this second report conspicuously does not mention: The Sept. 11 attack on the State Department and CIA facilities in Benghazi at the same time that the flow of weapons stopped.

By all appearances, the Benghazi attack interrupted a CIA effort to arm the rebels in Syria that the US government acknowledged were allied with al Qaeda.

That’s what the Rogers-directed HPSCI report did not include.

Just as importantly, this fits in with what Flynn has said during the campaign [RT link intentional]. which is where Trump got the claim that Obama (and Hillary) “created” ISIS.

In addition, recall that in Flynn’s wake, DIA whistleblowers revealed that their more pessimistic take on ISIS was getting softened before it got to CentCom bosses.

Two senior analysts at CENTCOM signed a written complaint sent to the Defense Department inspector general in July alleging that the reports, some of which were briefed to President Obama, portrayed the terror groups as weaker than the analysts believe they are. The reports were changed by CENTCOM higher-ups to adhere to the administration’s public line that the U.S. is winning the battle against ISIS and al Nusra, al Qaeda’s branch in Syria, the analysts claim.

That complaint was supported by 50 other analysts, some of whom have complained about politicizing of intelligence reports for months. That’s according to 11 individuals who are knowledgeable about the details of the report and who spoke to The Daily Beast on condition of anonymity.

You can see where this is going. One of the first things Trump has done has been to ensure agreement in its national security team on this point: that by letting our Middle Eastern allies arm al Qaeda-allied fighters, the Obama Administration created the mess that is in Syria.

And unanimity on that point — accompanied by what is sure to be a very ugly campaign of recriminations against the Obama Administration for cooking intelligence (even aside from the merit of this claim, Flynn has been bitter about his firing for what he sees as objecting to this cooked intelligence) — will provide the basis for Trump to work with Putin on ending the civil war in Syria to Bashar al-Assad’s advantage.

Marcy has been blogging full time since 2007. She’s known for her live-blogging of the Scooter Libby trial, her discovery of the number of times Khalid Sheikh Mohammed was waterboarded, and generally for her weedy analysis of document dumps.

Marcy Wheeler is an independent journalist writing about national security and civil liberties. She writes as emptywheel at her eponymous blog, publishes at outlets including the Guardian, Salon, and the Progressive, and appears frequently on television and radio. She is the author of Anatomy of Deceit, a primer on the CIA leak investigation, and liveblogged the Scooter Libby trial.

Marcy has a PhD from the University of Michigan, where she researched the “feuilleton,” a short conversational newspaper form that has proven important in times of heightened censorship. Before and after her time in academics, Marcy provided documentation consulting for corporations in the auto, tech, and energy industries. She lives with her spouse and dog in Grand Rapids, MI.

Day Six: Our First Purge

The big news from the Trump transition this morning is that Mike Rogers — who had joined Trump as an advisor on national security close to the end of the campaign — has been ousted.

Former House Intelligence Committee Chairman Mike Rogers left President-elect Donald Trump’s transition team, days after Trump’s surprise victory and a shakeup at the top of the team’s organizational chart.

Rogers’ abrupt departure came at the request of team officials, said two people familiar with the matter. The Michigan Republican, who’d also worked for the FBI, had been tapped to help guide the new administration on national security issues.

Several people have already referred to this move as a purge of people associated with Christie. Others have even called it Stalinesque. That suggests Trump demoted Christie last week not because he was perceived as tainted by the Bridgegate scandal, but because of some sense of distrust. I’m also interested in the focus — in stories on this — on Rogers’ FBI background — it has been more than 20 years since Rogers worked at FBI, and there have always been lurking questions about the circumstances of his departure. I wonder whether there wasn’t a concern about Rogers’ loyalty.

Meanwhile, Neocon godfather Eliot Cohen — who led a lot of the Never Trump opposition — has officially given up on reaching out to the Trump’s team.

After exchange w Trump transition team, changed my recommendation: stay away. They’re angry, arrogant, screaming “you LOST!” Will be ugly.

I consider all this a good sign.

Not a good sign that our country will soon be led by someone who can’t even work with the leading lights of his nominal party. But a good sign that Trump is so aggressively retaliating against Republicans.

A woman from Iran did a tweetstorm the other night describing what it’s like to live in a (religious) dictatorship. Read the whole thing. But the key point is that power in dictatorships depends on picking off minorities and those who protect them. The rest of the society remains disciplined out of fear that they will be added to the select group of minorities used to justify power.

Trump will likely (try to) get there, especially with Steve Bannon installed in his White House. Trump has already promised to increase on Obama’s already sky high number of deportations of Latinos. His Contract on to America includes several promises targeted at (Latino and Arab) immigrants.

★ THIRD, cancel all federal funding to sanctuary cities.
★ FOURTH, begin removing the more than two millioncriminal illegal immigrants from the country and cancelvisas to foreign countries that won’t take them back.
★ FIFTH, suspend immigration from terror-prone regionswhere vetting cannot safely occur. All vetting of peoplecoming into our country will be considered “extreme vetting.”

[snip]

End Illegal Immigration Act
Fully-funds the construction of a wall on our souther nborder with the full understanding that the country of Mexico will be reimbursing the United States for the full cost of such wall; establishes a two-year mandatory minimum federal prison sentence for illegally re-entering the U.S. after a previous deportation, and a five-year mandatory minimum federal prison sentence for illegally re-entering for those with felony convictions, multiple misdemeanor convictions or two or more prior deportations; also reforms visa rules to enhance penalties for overstaying and to ensure open jobs are offered to American workers first.

And it includes one that I suspect will be used to target Black Lives Matter and similar opposition groups.

Restoring Community Safety Act

Reduces surging crime, drugs and violence by creating a task force on violent crime and increasing funding for programs that train and assist local police; increases resources for federal law enforcement agencies and federal prosecutors to dismantle criminal gangs and put violent offenders behind bars.

So we should expect Trump to move towards targeting African Americans, Latinos, and Muslims. We should be prepared to protect people from these marginalized groups. More importantly, we should try, as much as possible, to prevent them from becoming a minority.

Hillary Clinton won the popular majority on Tuesday. There are plenty more people — such as the African Americans and Latinos that didn’t turn out to vote for Hillary, or Republicans who voted against Trump but not for Hillary — who are also in that majority. A majority of this country does not subscribe to Trump’s divisiveness. So long as we keep that majority together, it will be very hard for Trump’s scapegoating to work.

And rather than turn to his key scapegoats right away, Trump has instead turned against disloyal groups: Lindsey Graham, who opposed Trump because of his attacks on Muslims but who also happens to be closeted; Harry Reid, who has called him out aggressively but is also a Mormon, a faith that very aggressively opposed Trump; now other Republicans, including Neocons, perceived as disloyal. He has, effectively, widened and reinforced the majority that opposes him.

I have less than no time for Mike Rogers. Ditto, Lindsey Graham. But by targeting his own, first, Trump makes it more likely this country can stay together to defend far more vulnerable potential targets.

Marcy has been blogging full time since 2007. She’s known for her live-blogging of the Scooter Libby trial, her discovery of the number of times Khalid Sheikh Mohammed was waterboarded, and generally for her weedy analysis of document dumps.

Marcy Wheeler is an independent journalist writing about national security and civil liberties. She writes as emptywheel at her eponymous blog, publishes at outlets including the Guardian, Salon, and the Progressive, and appears frequently on television and radio. She is the author of Anatomy of Deceit, a primer on the CIA leak investigation, and liveblogged the Scooter Libby trial.

Marcy has a PhD from the University of Michigan, where she researched the “feuilleton,” a short conversational newspaper form that has proven important in times of heightened censorship. Before and after her time in academics, Marcy provided documentation consulting for corporations in the auto, tech, and energy industries. She lives with her spouse and dog in Grand Rapids, MI.

Pew Poll Finding Majority Oppose Apple Is Premised on FBI Spin

Screen Shot 2016-02-22 at 9.00.37 PMImagine if Pew called 1000 people and asked, “would you support requiring Apple to make iPhones less secure so the FBI could get information on a crime the FBI has already solved?”

Respondents might find the entire question bizarre, as requiring a private company to damage its product for information on a crime the FBI had already solved would be a tremendous waste. Based on the argument I laid out here — that the information the FBI might get from Syed Rezwan Farook’s work phone wouldn’t add all that much to what they presumably already got off two phones he tried unsuccessfully to destroy, as well as the phones or iCloud accounts of his colleagues — that’s the question I think Pew should have asked in its poll.

Here’s what Pew asked :

As you may know, RANDOMIZE: [the FBI has said that accessing the iPhone is an important part of their ongoing investigation into the San Bernardino attacks] while [Apple has said that unlocking the iPhone could compromise the security of other users’ information] do you think Apple [READ; RANDOMIZE]?

To be fair to Pew, FBI has said this phone will be “important,” and to Pew’s great credit, they described Apple’s stance to be about security, not privacy.

But the fact of the matter is FBI is demanding access to this phone knowing full well who the perpetrators are — Farook and his wife — and knowing (per Admiral Mike Rogers and a slew of FBI statements before his) that the couple didn’t have overseas help. San Bernardino was, the FBI has known for months, a particularly brutal workplace killing inspired by radical Islam.

I sort of suspect Americans might think differently about this particular back door request (though maybe not another case where the phone really would be central to solving the case) if it were explained in those terms.

Marcy has been blogging full time since 2007. She’s known for her live-blogging of the Scooter Libby trial, her discovery of the number of times Khalid Sheikh Mohammed was waterboarded, and generally for her weedy analysis of document dumps.

Marcy Wheeler is an independent journalist writing about national security and civil liberties. She writes as emptywheel at her eponymous blog, publishes at outlets including the Guardian, Salon, and the Progressive, and appears frequently on television and radio. She is the author of Anatomy of Deceit, a primer on the CIA leak investigation, and liveblogged the Scooter Libby trial.

Marcy has a PhD from the University of Michigan, where she researched the “feuilleton,” a short conversational newspaper form that has proven important in times of heightened censorship. Before and after her time in academics, Marcy provided documentation consulting for corporations in the auto, tech, and energy industries. She lives with her spouse and dog in Grand Rapids, MI.

Why Tell the Israeli Spying Story Now?

“Intelligence professionals have a saying: There are no friendly intelligence services,” the WSJ describes former House Intelligence Chair Mike Rogers saying, on the record. While there’s no way of telling — particularly not with WSJ’s described “more than two dozen current and former U.S. intelligence and administration officials” sources behind it’s blockbuster story on US spying on Bibi Netanyahu and other Israelis, Rogers is a likely candidate for some of the other statements attributed to “former US officials,” a moniker that can include agency officials, consultants, and members of Congress.

Which is awfully funny, given that two of the people squealing most loudly in response to the story are Rogers’ immediate predecessor, Crazy Pete Hoekstra, who called it a “Maybe unprecedented abuse of power,” and successor, Devin Nunes, who has already started an investigation into the allegations in the story.

It is the height of hypocrisy for these men, who have been privy to and by their silence have assented to this and, in Crazy Pete’s case, far worse patently illegal spying, to wail about a story that shows the Administration abiding by NSA minimization procedures they’ve both celebrated as more than adequate to protect US person privacy. If NSA’s minimization procedures are inadequate to protect US persons, the first thing Nunes should do is repeal FISA Amendments Act, which can expose far more people than the tailored, presumably EO 12333 tap placed on Bibi, not to mention OmniCISA, which can be targeted at Americans and will have even fewer protections for US persons.

The immediate attempt by a bunch of surveillance maximalists to turn compliant spying into a big scandal raises the question of why this story is coming out now, not incidentally just after Iran turned over its uranium stockpile over to Russia and in the process achieved another big step of the Iran deal.

I’m not in any way meaning to slight the WSJ reporting. Indeed, the story seems to show a breadth of sources that reflect a broad range of interests, and as such is not — as would otherwise be possible — Mike Rogers attempting to leak something to the WSJ so his fellow Republicans can make a stink about things.

This story includes “current and former U.S. officials” providing a list of leaders they claim were detasked from spying in 2014 — François Hollande, Angela Merkel, and other NATO leaders — and those they claim were not — along with Bibi Netanyahu, Turkey’s leader Recep Tayyip Erdogan. Of course, like James Clapper’s claim that Edward Snowden’s leaks forced the NSA to shut down its full take spying on Afghanistan, this “confirmation” may instead have been an effort to cover for collection that has since been restarted, especially given the story’s even more revealing explanation that, “Instead of removing the [surveillance] implants, Mr. Obama decided to shut off the NSA’s monitoring of phone numbers and email addresses of certain allied leaders—a move that could be reversed by the president or his successor.” Obama did not eliminate the infrastructure that allows him to request surveillance (in actually, monitoring of surveillance going on in any case) to be turned on like a switch, and this WSJ article just conveyed that detail to Hollande and Merkel.

So the story could serve as disinformation to cover up restarted surveillance, and it could serve as a cue for the bogus, unbelievably hypocritical political scandal that Crazy Pete and Nunes appear to want to make it.

But I’m just as interested in the dick-waving in the story.

Some of the most interesting details in the story — once you get beyond the wailing of people like Crazy Pete and Devin Nunes probably swept up in intercepts described in the story — pertain to what NSA did and did not learn about Bibi’s efforts, largely executed through Israeli Ambassador to the US Ron Dermer, to thwart the Iran deal. A key detail here is that while (it is implied) NSA destroyed most or all of the intercepts involving members of Congress directly with Bibi, they passed on (with US person identities masked) the reports back through foreign ministry channels of discussions with or on behalf of Bibi.

The NSA has leeway to collect and disseminate intercepted communications involving U.S. lawmakers if, for example, foreign ambassadors send messages to their foreign ministries that recount their private meetings or phone calls with members of Congress, current and former officials said.

“Either way, we got the same information,” a former official said, citing detailed reports prepared by the Israelis after exchanges with lawmakers.

In other words, NSA might not pass on the intercepts of calls members of Congress had with Bibi directly, but they would pass on the reports that Dermer or Bibi’s aides would summarize of such discussions. And according to “a former official” (curiously not described as high ranking) by passing on the reports of such conversations, “we got the same information.”

Usually, but not always, according to the story.

It describes that “Obama administration officials” (which may but probably doesn’t include intelligence officials) didn’t learn about John Boehner’s invitation to Bibi to address Congress ahead of time, even though Boehner extended that invite through Dermer.

On Jan. 8, John Boehner, then the Republican House Speaker, and incoming Republican Senate Majority Leader Mitch McConnell agreed on a plan. They would invite Mr. Netanyahu to deliver a speech to a joint session of Congress. A day later, Mr. Boehner called Ron Dermer, the Israeli ambassador, to get Mr. Netanyahu’s agreement.

Despite NSA surveillance, Obama administration officials said they were caught off guard when Mr. Boehner announced the invitation on Jan. 21.

According to the description of the article, this call should have been fair game to be shared with the White House as a report through the foreign ministry, but either wasn’t reported through normal channels on the Israeli side or NSA didn’t pass it along.

But, according to the story, the White House did get many of the details about Dermer’s attempt to scotch the Iran deal.

The NSA reports allowed administration officials to peer inside Israeli efforts to turn Congress against the deal. Mr. Dermer was described as coaching unnamed U.S. organizations—which officials could tell from the context were Jewish-American groups—on lines of argument to use with lawmakers, and Israeli officials were reported pressing lawmakers to oppose the deal.

[snip]

A U.S. intelligence official familiar with the intercepts said Israel’s pitch to undecided lawmakers often included such questions as: “How can we get your vote? What’s it going to take?”

Let me interject and note that, if the people squealing about these intercepts weren’t such raging hypocrites, I might be very concerned about this.

Consider the Jane Harman case. In 2009 it got reported that NSA and FBI collected conversations Jane Harman had (probably on an individual FISA wiretap) with AIPAC suspects in which Harman allegedly agreed to help squelch the criminal investigation into the organization in exchange for help getting the Chairmanship of the House Intelligence Committee. The position, not incidentally, that all the people (save Mike Rogers, who seems to have had no problem with them) squealing about these intercepts have held or currently hold. At least according to 2009 reports on this, lawyers in then Attorney General Alberto Gonzales’ DOJ considered criminal charges against Harman, but chose not to pursue them, because Gonzales — who had criminally, personally authorized the Stellar Wind program in March 2004 — needed Harman’s support in advance of NYT breaking the Stellar Wind story at the end of 2005. That suggests (if these stories are to be believed) Gonzales used Harman’s purported criminal exposure to get protection against his own.

Now, Crazy Pete was out of power well before these particular intercepts were described (though may have his own reason to be concerned about what such intercepts revealed), but in the same period, Devin Nunes got himself appointed HPSCI Chair, just like AIPAC was allegedly brokering with Harman. He got himself appointed HPSCI Chair by the guy, Boehner, who invited Bibi to address Congress.

And what were AIPAC and other groups — who allegedly were offering congressional leadership posts back in 2005 — offering lawmakers last year to oppose the Iran deal? “What’s it going to take?” the intercepts apparently recorded.

What were they offering?

This is the reason permitting lawmakers’ communications to be incidentally collected is such a risk — because it collects the sausage-making behind legislative stances — but also defensible — because it might disclose untoward quid pro quo by foreign governments of members of Congress. It is a real concern that the Executive is collecting details of Congress’ doings. More protections, both for Members of Congress and for regular schlubs, are needed. But wiretapping the incidentally collected communications with foreign leaders is not only solidly within the parameters of Congressionally-approved NSA spying, but may sometimes be important to protect the US.

That’s the kind of the thing the White House may have seen outlines of in the reports it got on Darmer’s attempts — though the report indicates that Democratic lawmakers and Israelis who supported the Iranian deal (probably including former Mossad head Efraim Halevy, who was criticizing Bibi and Darmer’s efforts in real time) were sharing details of Darmer’s efforts directly with the White House.

In the final months of the campaign, NSA intercepts yielded few surprises. Officials said the information reaffirmed what they heard directly from lawmakers and Israeli officials opposed to Mr. Netanyahu’s campaign—that the prime minister was focused on building opposition among Democratic lawmakers.

Which brings me to the dick-waving part. Here’s the last line of the WSJ story.

The NSA intercepts, however, revealed one surprise. Mr. Netanyahu and some of his allies voiced confidence they could win enough votes.

Some of this story is likely to be disinformation for our allies, much of this story seems to be warning (both friendly and unfriendly) to those likely implicated by the intercepts. But this just seems like dick-waving, the spook-and-politician equivalent of spiking the football and doing a lewd dance in the end zone. The Israelis surely knew all the monitoring was going on (even if members of Congress may have been stupid about them), especially given the way John Kerry, as laid out in the story, raised concerns about Israeli spying during negotiations. But this line, the final reveal in the story, mocks the Israelis and their American interlocutors for assuming they had enough to offer — “What’s it going to take to get your vote?”– to kill the Iran deal.

This may, in part, be an effort to get those implicated in the intercepts to exercise some more caution. But it also seems to be a victory dance, just as Russia ships away Iran’s uranium stockpiles.

Marcy has been blogging full time since 2007. She’s known for her live-blogging of the Scooter Libby trial, her discovery of the number of times Khalid Sheikh Mohammed was waterboarded, and generally for her weedy analysis of document dumps.

Marcy Wheeler is an independent journalist writing about national security and civil liberties. She writes as emptywheel at her eponymous blog, publishes at outlets including the Guardian, Salon, and the Progressive, and appears frequently on television and radio. She is the author of Anatomy of Deceit, a primer on the CIA leak investigation, and liveblogged the Scooter Libby trial.

Marcy has a PhD from the University of Michigan, where she researched the “feuilleton,” a short conversational newspaper form that has proven important in times of heightened censorship. Before and after her time in academics, Marcy provided documentation consulting for corporations in the auto, tech, and energy industries. She lives with her spouse and dog in Grand Rapids, MI.

Marco Rubio Explains the Dragnet

SIGINT and 215A penny dropped for me, earlier this week, when Marco Rubio revealed that authorities are asking “a large number of companies” for “phone records.” Then, yesterday, he made it clear that these companies don’t fall under FCC’s definition of “phone” companies, because they’re not subject to that regulator’s 18 month retention requirement.

His comments clear up a few things that have been uncertain since February 2014, when some credulous reporters started reporting that the Section 215 phone dragnet — though they didn’t know enough to call it that — got only 20 to 30% of “all US calls.”

The claim came not long after Judge Richard Leon had declared the 215 phone dragnet to be unconstitutional. It also came just as the President’s Review Group (scoped to include all of the government’s surveillance) and PCLOB (scoped to include only the 215 phone dragnet) were recommending the government come up with a better approach to the phone dragnet.

The report clearly did several things. First, it provided a way for the government to try to undermine the standing claim of other plaintiffs challenging the phone dragnet, by leaving the possibility their records were among the claimed 70% that was not collected. It gave a public excuse the Intelligence Community could use to explain why PRG and PCLOB showed the dragnet to be mostly useless. And it laid the ground work to use “reform” to fix the problems that had, at least since 2009, made the phone dragnet largely useless.

It did not, however, admit the truth about what the 215 phone dragnet really was: just a small part of the far vaster dragnet. The dragnet as a whole aspires to capture a complete record of communications and other metadata indicating relationships (with a focus on locales of concern) that would, in turn, offer the ability to visualize the networks of the world, and not just for terrorism. At first, when the Bush Administration moved the Internet (in 2004) and phone (in 2006) dragnets under FISC authority, NSA ignored FISC’s more stringent rules and instead treated all the data with much more lax EO 12333 rules(see this post for some historical background). When FISC forced the NSA to start following the rules in 2009, however, it meant NSA could no longer do as much with the data collected in the US. So from that point forward, it became even more of a gap-filler than it had been, offering a thinner network map of the US, one the NSA could not subject to as many kinds of analysis. As part of the reforms imposed in 2009, NSA had to start tracking where it got any piece of data and what authority’s rules it had to follow; in response, NSA trained analysts to try to use EO 12333 collected data for their queries, so as to apply the more permissive rules.

That, by itself, makes it clear that EO 12333 and Section 215 (and PRTT) data was significantly redundant. For every international phone call (or at least those to countries of terrorism interest, as the PATRIOT authorities were supposed to be restricted to terrorism and Iran), there might be two or more copies of any given phone call, one collected from a provider domestically, and one collected via a range of means overseas (in fact, the phone dragnet orders make it clear the same providers were also providing international collection not subject to 215).  If you don’t believe me on this point, Mike Lee spelled it out last week. Not only might NSA get additional data with the international call — such as location data — but it could subject that data to more interesting analysis, such as co-location. Thus, once the distinction between EO 12333 and PATRIOT data became formalized in 2009 (years after it should have been) the PATRIOT data served primarily to get a thinner network map of the data they could only collect domestically.

Because the government didn’t want to admit they had a dragnet, they never tried to legislate fixes for it such that it would be more comprehensive in terms of reach or more permissive in terms of analysis.

So that’s a big part of why four beat journalists got that leak in February 2014, at virtually the same time President Obama decided to replace the 215 phone dragnet with something else.

The problem was, the government never admitted the extent of what they wanted to do with the dragnet. It wasn’t just telephony-carried voice calls they wanted to map, it was all communications a person might make from their phone, which increasingly means a smart phone. It wasn’t just call-chaining they wanted to do, it was connection chaining, linking identities, potentially using far more intrusive technological analysis.

Some of that was clear with the initial IC effort at “reform.” Significantly, it didn’t ask for Call Detail Records, understood to include either phone or Internet or both, but instead “records created as a result of communications of an individual or facility.” That language would have permitted the government to get backbone providers to collect all addressing records, regardless if it counted as content. The bill also permitted the use of such tools for all purposes, not just counterterrorism. In effect, this bill would have completed the dragnet, permitting the IC to conduct EO 12333 collection and analysis on records collected in the US, for any “intelligence” purpose.

But there was enough support for real reform, demonstrated most vividly in the votes on Amash-Conyers in July 2013, that whatever got passed had to look like real reform, so that effort was killed.

So we got the USA F-ReDux model, swapping more targeted collection (of communications, but not other kinds of records, which can still be collected in bulk) for the ability to require providers to hand over the data in usable form. This meant the government could get what it wanted, but it might have to work really hard to do so, as the communications provider market is so fragmented.

The GOP recognized, at least in the weeks before the passage of the bill, that this would be the case. I believe that Richard Burr’s claimed “mistake” in claiming there was an Internet dragnet was instead an effort to create legislative intent supporting an Internet dragnet. After that failed, Burr introduced a last minute bill using John Bates’ Dialing, Routing, Addressing, and Signaling language, meaning it would enable the government to bulk collect packet communications off switches again, along with EO 12333 minimization rules. That failed (in part because of Mitch McConnell’s parliamentary screw ups).

But now the IC is left with a law that does what it said it wanted (plus some, as it definitely gets non-telephony “phone” “calls”), rather than one that does what it wanted, which was to re-establish the full dragnet it had in the US at various times in the past.

I would expect they won’t stop trying for the latter, though.

Indeed, I suspect that’s the real reason Marco Rubio has been permitted to keep complaining about the dragnet’s shortcomings.

Marcy has been blogging full time since 2007. She’s known for her live-blogging of the Scooter Libby trial, her discovery of the number of times Khalid Sheikh Mohammed was waterboarded, and generally for her weedy analysis of document dumps.

Marcy Wheeler is an independent journalist writing about national security and civil liberties. She writes as emptywheel at her eponymous blog, publishes at outlets including the Guardian, Salon, and the Progressive, and appears frequently on television and radio. She is the author of Anatomy of Deceit, a primer on the CIA leak investigation, and liveblogged the Scooter Libby trial.

Marcy has a PhD from the University of Michigan, where she researched the “feuilleton,” a short conversational newspaper form that has proven important in times of heightened censorship. Before and after her time in academics, Marcy provided documentation consulting for corporations in the auto, tech, and energy industries. She lives with her spouse and dog in Grand Rapids, MI.

Someone Tell Bill Nelson Apple Isn’t a Telecom and that Metadata Is Available with Encryption

There were a number of interesting exchanges in the Senate Armed Services Committee on cybersecurity hearing today, which I’ll return to in a bit. But for the moment I wanted to point to this bizarre exchange featuring Bill Nelson.

Nelson: Admiral, I’m concerned about all of these private telecoms that are going to encrypt. If you have encryption of everything, how, in your opinion, does that affect Section 702 and 215 collection programs?

Rogers: It certainly makes it more difficult.

Nelson: Does the Administration have a policy position on this?

Rogers: No. I think we’re still — I mean, we’re the first to acknowledge this is an incredibly complicated issue, with a lot of very valid perspectives. And we’re still, I think, collectively trying to work through what’s the right way ahead, here, recognizing that there’s a lot of very valid perspectives but from the perspective as CyberCommand and NSA as I look at this issue, there’s a huge challenge here that we have got to deal with.

Nelson: A huge challenge? And I have a policy position. And that is that the telecoms better cooperate with the United States government or else … it just magnifies the ability for the bad guys to utilize the Internet to achieve their purposes.

Bill Nelson is apparently very upset by the increasing use of encryption, but seems to believe Apple — which is at the center of these discussions — is a telecom. I’m happy to consider Apple a “phone company,” given that iMessage messages would go through the Internet and Apple rather than cell providers, and I think the IC increasingly thinks of Apple as a phone company. But it’s not a telecom, which is a different legal category.

He also believes that Apple’s encryption would hurt NSA’s Section 215 collection program. And NSA Director Mike Rogers appears to agree!

It shouldn’t. While Apple’s use of encryption will make it harder to get iMessage content, the metadata should still be available. So I’m rather curious why it is that Rogers agreed with Nelson?

In any case, Nelson doesn’t seem very interested in why Rogers immediately noted how complicated this question is — this is, after all, a hearing on cybersecurity and we know the Administration admits that more widespread encryption actually helps cybersecurity (especially since sophisticated hackers will be able to use other available encryption methods).

But I am intrigued that Rogers didn’t correct Nelson’s assertion that encryption would hurt the Section 215 program.

Update: This, from Apple’s transparency report, is one more reason Rogers’ agreement that encryption creates problems for the Section 215 program is so curious.

To date, Apple has not received any orders for bulk data.

Marcy has been blogging full time since 2007. She’s known for her live-blogging of the Scooter Libby trial, her discovery of the number of times Khalid Sheikh Mohammed was waterboarded, and generally for her weedy analysis of document dumps.

Marcy Wheeler is an independent journalist writing about national security and civil liberties. She writes as emptywheel at her eponymous blog, publishes at outlets including the Guardian, Salon, and the Progressive, and appears frequently on television and radio. She is the author of Anatomy of Deceit, a primer on the CIA leak investigation, and liveblogged the Scooter Libby trial.

Marcy has a PhD from the University of Michigan, where she researched the “feuilleton,” a short conversational newspaper form that has proven important in times of heightened censorship. Before and after her time in academics, Marcy provided documentation consulting for corporations in the auto, tech, and energy industries. She lives with her spouse and dog in Grand Rapids, MI.