Which Major Companies Actually Encrypt Your Data

from the good-for-them dept

With so much recent concern about how the NSA and GCHQ (and, likely, others) basically look at unencrypted traffic as an easy way to hack into your data, it's becoming increasingly important for the big companies which manage tremendous amounts of the public's personal data to encrypt as much as possible. The folks over at the EFF have now put together a sort of crypto report card on which major companies are actually encrypting everything they can.

The results are a little disappointing. Only four companies -- Dropbox, Google, SpiderOak and Sonic.net -- got a perfect score on the five categories measured. Twitter is pretty close (and the only thing it's missing, STARTTLS, really would only matter if it were offering email, which it doesn't, other than to employees) while the rest still have a fair bit of work to do. The incumbent access providers -- AT&T, Verizon and Comcast -- don't appear to care nearly enough about security at all. That's why it's little surprise that the NSA's deals with at least AT&T and Verizon are a major source of information. Once again, I'm rather happy I'm a Sonic.net customer for my internet access these days. Hopefully this effort (and the ongoing concerns about the NSA, as well as outside hacking) lead more companies to upping their encryption game.

Filed Under: encryption, privacy
Companies: at&t, comcast, dropbox, eff, google, sonic.net, spideroak, twitter, verizon

Comcast And AT&T Want Their Cut From Prenda Too

from the welcome-to-the-big-leagues dept

Last week, we noted that yet another court had ruled against Prenda. In this case, rather than their own shell companies, Prenda was representing Lightspeed, a porn company which already had a questionable reputation. Also, this was a case where Prenda tried to use a "hacking" claim rather than a straight copyright claim, in an attempt to get the case in state court, rather than the more savvy federal courts. Finally, when the ISPs protested having to turn over names, the brilliant Prenda strategy was to sue the ISPs as well. So, now that the court found "the litigation smacked of bullying pretense," it's not just the random guy, Anthony Smith, seeking legal fees... but Comcast and AT&T as well. Late last week, Comcast and then AT&T each asked for John Steele, Paul Hansmeier and Paul Duffy (by name) to each pay their attorneys' fees as well. And, as you might imagine, they have some pricey attorneys. Comcast's filing goes into quite a bit of detail about the questionable actions taken by Team Prenda in this case (and in other cases). AT&T's filing is much shorter and more or less says "you already know what these guys have been up to, so no need to repeat it here."

Not surprisingly, Hansmeier quickly filed an angry response, arguing that there is no possible reason why he should have to pay attorneys' fees, and even arguing that there's still no evidence of wrongdoing... by himself (leaving the others out to dry). Basically, he argues that while he was involved with the case briefly, none of his actions were the problematic ones. He also claims that the requests for attorneys' fees isn't timely, since Team Prenda had dismissed the case six months ago -- leaving out the ruling from just last week which found Team Prenda's actions problematic and subject to attorneys' fees. Amusingly, he also argues that Comcast laying out in great detail all of the bogus actions of Team Prenda in this case, as well as how multiple other judges have called out their behavior and alerted law enforcement about their activities for criminal investigation, is nothing more than an ad hominem attack.

Sorry, Paul, if someone calls you a morally bankrupt scamming loser -- that would be an ad hominem attack. Comcast laying out in great detail how judges have ruled that you committed fraud on the court in very similar cases, and ordered you to pay attorneys' fees (while also alerting law enforcement, the IRS, local legal bars and others to investigate), is presenting relevant information to the court. It might help to learn the difference.

Filed Under: anthony smith, attorneys fees, john steele, paul duffy, paul hansmeier, steve lightspeed
Companies: at&t, comcast, lightspeed, prenda, prenda law

So Much For NSA Chief's Offer To Store Data At A 'Neutral' Site: AT&T Receiving $10 Million/Yr From CIA For Phone Records

from the well,-that's-officially-everybody dept

More news has arrived on AT&T's willing accommodation of every government agency that asks for a peek at the numbers (or a never ending, rolling 3-month haul of all records). At least this time, it's getting something more in return than boilerplate court orders with that new ink pad smell. As the New York Times reports, the CIA wants in on the action, and it doesn't need court orders -- just a big stack of cash.

The C.I.A. is paying AT&T more than $10 million a year to assist with overseas counterterrorism investigations by exploiting the company's vast database of phone records, which includes Americans' international calls, according to government officials.

This is all purely voluntary ($10mil of greased palms/wheels notwithstanding), hence the lack of court orders or subpoenas. Oddly enough, this voluntary system actually protects the privacy of Americans much better than the "legal" Section 215 collections.

The C.I.A. supplies phone numbers of overseas terrorism suspects, and AT&T searches its database and provides records of calls that may help identify foreign associates, the officials said…

Because the C.I.A. is prohibited from spying on the domestic activities of Americans, the agency imposes privacy safeguards on the program, said the officials, speaking on the condition of anonymity because it is classified. Most of the call logs provided by AT&T involve foreign-to-foreign calls, but when the company produces records of international calls with one end in the United States, it does not disclose the identity of the Americans and “masks” several digits of their phone numbers, the officials said.

Of course, these "masked" records can be very simply unmasked by "tipping" them to other agencies, like the FBI, which then acquires a subpoena/court order to "unmask" the records. This just goes to show that these agencies can cooperate, as long as its in the interest of furthering domestic surveillance.

Ultimately though, this news isn't surprising. Phone companies have been collecting government paychecks in exchange for data for a very long time. True, the telcos don't want to appear as though they're selling Americans' data for cash, but that's exactly what's happening. The CIA's primary focus is foreign surveillance and, thanks to AT&T, there's some minimization in place to keep the agency focused on its purview.

More interesting, however, is how this news affects General Alexander's "generous" offer to store data at a "neutral site" in order to alleviate privacy concerns. As was noted back when he made this offer, American telcos are hardly "neutral sites" given their history of swiftly coughing up anything requested with a minimum of pushback.

So, AT&T (and Verizon, etc.) are not "neutral" in any true sense of the word, but at least storing the data there would put the NSA in the position of having to bring its selectors to a third party before accessing stored records, rather than just having them conveniently available (and exploitable) in its own storage for an indefinite period of time. This would trim down the "accidental" abuse that has been displayed by the agency in the past.

More recently, ODNI lawyer Robert Litt (along with the FBI's general counsel) suggested storing data with the originators would lead to less privacy. Given what we know about the CIA's paid data plans, he might be correct, even if his motives for making that claim were completely disingenuous.

It would introduce extra steps, but it appears as though there would be a way to "tip" domestic data to the NSA by simply using the process it uses with the FBI. Restrictions on both the NSA and CIA are meant to minimize the amount of unrelated domestic metadata they have access to. The CIA's restrictions are harsher than the NSA's, but the CIA can still grab and let the NSA wrangle the paperwork needed to unmask numbers. Or vice versa. The NSA can access its on-site metadata stores (with unmasked numbers) and tip domestic call data back to the CIA.

Both of these scenarios are unlikely, but storing the data at AT&T seems to offer very minimal privacy advantages over storing it in the NSA's data centers. At best, this creates some mild speed bumps for the agency to deal with in exchange for a small amount of "peace of mind" privacy-wise. Most telcos have seemed even less interested protecting Americans' privacy than the inquiring agencies themselves. As you'll recall, AT&T went out of its way to perform phone record queries for the FBI for agents armed with nothing more legally binding than a Post-It note.

The other thing to note is that this is another bit of evidence that undercuts the telcos' repeated assurance that they "value their customers' privacy." This sentence is usually followed directly by defensive wording about "complying" with "applicable laws" -- which actually means "complying with intelligence agencies." There's very little true concern on display and little to no evidence AT&T (and Verizon) have ever made any serious attempt to push back on government requests.

Filed Under: cia, data, metadata, nsa, phone calls, privacy, surveillance
Companies: at&t

Another Big Loss For Team Prenda, As Their Bills Keep Adding Up

from the getting-expensive dept

Last week, Team Prenda took another big loss and got smacked around by another judge ordering them to pay even more in attorneys' fees. The list is really starting to add up. This case, which involved Prenda representing porn producers Lightspeed (rather than one of their own shell operations), had been sitting out there for a while, but it was one of the cases that involved Prenda trying to route around the trouble they'd been having with copyright claims by arguing a computer hacking violation instead. And, on top of that, it involved Prenda going after AT&T and Comcast for refusing to just blindly hand over the names of people attached to the IP addresses listed. Back in April, Prenda had filed a ridiculous response to lawyers Booth Sweet asking for attorneys' fees. Given everything that's come out (and, honestly, much of which had already been public) the hubris of Prenda's Paul Duffy is impressive. In the lawsuit he attacks Booth Sweet arguing that they "routinely file baseless motions for attorneys' fees in hopes they will eventually get lucky." Of course, Booth Sweet's track record is pretty strong here, and while it took a few months, the judge in the case, Patrick Murphy, realized that it was Team Prenda who was really playing games:

The litigation smacked of bullying pretense.

Elsewhere, the judge notes that awarding attorneys' fees is appropriate "when counsel acted recklessly, raised baseless claims despite notice of the frivolous nature of these claims, or otherwise showed indifference to statutes, rules, or court orders," suggesting that he sees Team Prenda's actions as fitting into those categories.

At this point, all of these attorneys' fees wins are more or less meaningless. It's doubtful that any of them will get paid (though, there does appear to be money somewhere...). The main event, a more thorough investigation and possible criminal charges against Team Prenda still await -- but those things take time. Still, that isn't stopping Team Prenda from pulling their standard response to these kinds of rulings against them, pulling the same failed tricks out of their increasingly frayed trick bag.

In this case, it involves Paul Hansmeier claiming "what? who, me?" in response. He notes that, while he was involved in the case at some point, briefly, this was really a Paul Duffy case all along, and he, Hansmeier, along with his partner in crime John Steele, simply had no idea this case was even still going on, let alone that they might be on the hook for potential attorneys' fees. As unbelievable as that might be (and potentially a process violation -- since Hansmeier is no longer a lawyer in this matter, he shouldn't make filings in the case without first getting permission from the court), the bigger issue is that this is the first time I can recall where Hansmeier and Steele appear to pretty clearly be throwing Paul Duffy under the bus.

If you haven't been paying attention, Team Prenda has been gradually dwindling as the main players have gradually thrown the redshirts under the bus one by one. Brett Gibbs went down first, but Mark Lutz was a recent addition to the under-the-bus crew. But, from the beginning, many have argued that Duffy was the patsy for Steele and Hansmeier, and here's a case where Hansmeier appears to be leaving Duffy out to dry on yet another failed case. You'd think that Hansmeier would be more careful, because if there's anyone who likely knows all the details of how Prenda is setup, it would be Paul Duffy. As they say, never throw anyone under the bus who might take you with them. Hansmeier and Steele seemed to miss that with Brett Gibbs, and now they're repeating it with Duffy. As for Lutz, he still seems to be completely MIA, which seems increasingly suspicious... especially since Hansmeier insisted that Lutz would appear shortly to answer questions the court had asked.

Filed Under: dan booth, jason sweet, paul duffy, paul hansmeier, steve lightspeed
Companies: at&t, comcast, lightspeed, prenda, prenda law

FISA Court Rubber Stamps Continued Collection Of Metadata On Every Single Phone Call

from the because-it-can dept

This won't come as a huge surprise, I would imagine, but the telephony metadata dragnet collection that has to be renewed every few months "expired" today and was promptly reapproved by the FISA court, because "fuck you, that's why." That's not quite what they said, but consider it the bureaucratic-speak equivalent, coming from the Director of National Intelligence:

Previously on several occasions, the Director of National Intelligence declassified certain information about this telephony metadata collection program in order to provide the public with a more thorough and balanced understanding of the program. Consistent with his prior declassification decision and in light of the significant and continuing public interest in the telephony metadata collection program, DNI Clapper has decided to declassify and disclose publicly that the government filed an application with the Foreign Intelligence Surveillance Court seeking renewal of the authority to collect telephony metadata in bulk, and that the court renewed that authority.

The administration is undertaking a declassification review of this most recent court order.

Of course, it's true that last month, the previous order rubber-stamping this approval was declassified and revealed. Even though the same thing has been rubber stamped every few months for at least the past seven years, this time there was an attempt at a full justification for why it made sense. Of course, since it was a one-sided situation, without any adversarial hearing or opinion, it allowed the FISA court to make up its own rules and completely contradict the Supreme Court (to whom it's supposed to listen). It seems highly doubtful that the eventual declassified version of this rubber stamp will be any different than the last one.

Of course, in the last three months, we've also learned that this program of collecting data on every phone call in the US has been necessary to stop precisely zero attacks in the US -- but it did apparently lead them to a taxi driver sending some money to some not very nice people in Somalia. And, because of that, the NSA gets to keep track of everyone's phone calls. As has been explained repeatedly, this seems to go against not just the spirit and intended purpose of the 4th Amendment, but the plain language of that same Amendment. But, the FISA court has earned its rubber stamp reputation for a reason, and apparently it's not about to give up on it.

Filed Under: business records, dragnet, fisa, fisa court, fisc, metadata, nsa, nsa surveillance, section 215
Companies: at&t, verizon

The DOJ's Insane Argument Against Weev: He's A Felon Because He Broke The Rules We Made Up

from the bad-news-all-around dept

We've covered the lawsuit against Andrew "weev" Auernheimer, in which the feds pushed criminal charges against him under the Computer Fraud and Abuse Act (CFAA) for discovering a massive (and ridiculous) security hole in the way AT&T set up the iPad. Basically, they saw that AT&T handed out iPad IDs in numerical order, and then left the website open, allowing him (and a partner) to just increment by number and get back email addresses on everyone who owned an iPad. The feds seemed to argue that this was some nefarious evil hack, and Auernheimer was sentenced to 41 months in prison and has to pay $73,000 to AT&T (roughly the cost it took AT&T to inform its customers of its own bone-headed lack of security). So much about this case is ridiculous, and it's complicated by the fact that nearly everyone agrees that weev is a world-class jerk. But, you need to separate that out from the details of what he did here, to note that it was nothing particularly special, and it involved the sort of thing that security researcers do all the time, and which all sorts of non-security researchers do quite often.

Auernheimer is appealing, and the DOJ filed its brief a week and a half ago. It took me until this weekend to finally have the time to dig into the full 133 pages, to realize just how ridiculous the whole thing is. Tim Lee, over at The Switch has a great explanation of what's going on here aimed at less technologically savvy folks. Meanwhile, Robert Graham has an equally fantastic writeup for the slightly more technically savvy world over at Errata Security.

We'll dig into some of the details in a bit, but as Graham points out, the feds somewhat obnoxiously nearly doubled the word limit imposed by the Third Circuit (the brief is 26,495, but the court only allows 14,000 as an upper limit). This is ridiculously unfair, because it lets the DOJ go on, at length, making claims that are almost wholly untrue, and at times ridiculous, while weev's lawyers were hamstrung in limiting what they could put in their own brief. Welcome to the criminal justice system where the DOJ still seems to think it gets to play by its own rules.

And, really, that's the most ridiculous part of all of this, because while the DOJ wants to play by its own rules, nearly its entire argument against Auernheimer is that he "didn't play by the rules" where "the rules" it's talking about aren't actual rules at all, but rather what the DOJ makes up in the minds of some clearly technologically-illiterate lawyers.

The short version is that the government's case is quite scary in the way it portrays weev's actions -- such that it could easily criminalize all sorts of things. For example, it goes on about changing the user-agent, as if this is some awful thing and a form of "lying."

Spitler changed the user agent in his Account Slurper program in order to trick the servers into thinking that he was using an iPad.... He “lied to the AT&T servers” in order to get the information.... Spitler gathered this information without asking for permission from AT&T or from any of the iPad users that he was impersonating.... AT&T did not design its system to allow these email addresses to be made public.

There are so many problems with this. First, there are no hard and fast rules about user-agents that suggest this sort of thing is breaking the law. As both Graham and Lee point out, if "faking" the user-agent is a form of "lying," nearly every browser does that and has for years. That's because years ago, Microsoft added "Mozilla" to its user-agent since many websites optimized for different browsers, and Microsoft wanted servers to believe it was competitor Netscape, which many sites had designed to be nicer. So pretty much all browsers "lie." Hell, for many years I've personally used "user agent switcher," a plugin for browsers, to change my browser user agent at times, mostly for simple testing on certain websites, and sometimes for reporting purposes (to see how different sites provide different info to different browsers). I never thought I was "lying" or coming close to committing a crime. It's just a bit of info a browser, or other piece of software, sends to a server to get information returned.

Similarly, the idea that AT&T "did not design its system to allow these email addresses to be made public" is simply, empirically, false. If they hadn't designed it that way, then weev and his partner wouldn't have been able to access it the way they did. The problem was clearly AT&T totally failed to lock down this system. Furthermore, they didn't need to "ask permission" because they sent a request to the server and the server answered. If they didn't have permission, the server would have rejected the request. It didn't. The problem was very clearly AT&T's. To charge weev with criminal charges for this is really insane.

Changing the user agent isn't breaking any "rules" -- except in the mind of the DOJ.

The DOJ really stretches to try to paint the actions by Auernheimer's partner as some masterful "hack" when the details suggest otherwise. The brief goes on at length about all the "steps" that Daniel Spitler had to go through to get access to the information, but most of the "steps" are ridiculously padded, because they have nothing to do with the "hack" itself, but were merely about Spitler trying to setup his computer to act like an iPad. That might sound odd and involved to the clueless lawyers at the DOJ, but this sort of thing is done all the freaking time by security researchers. That's how they can more easily test stuff out, by getting their computers to act like other machines. In theory, I guess, Spitler could have done the whole thing via an iPad, but what's the point? The whole idea was, in part, looking for security vulnerabilities. The fact that it took Spitler a bit of time and effort to get his computer to emulate an iPad has nothing to do with the scanning itself, but the DOJ uses it as if it shows how "difficult" AT&T made it to find these emails. That's wrong. AT&T made it quite easy to find the emails. The fact that Spitler had some trouble getting a computer to emulate an iPad is a totally separate issue.

From there, the DOJ starts playing dirty, pretending that because judicial law clerks can't find the same kind of security hole, it somehow means that Spitler and Auernheimer were up to no good:

If an ordinary, but reasonably sophisticated computer user, like a typical judicial law clerk, had been assigned the task of compiling a list of e-mail addresses of iPad users available on AT&T’s servers, he almost certainly would not have been able to duplicate what Spitler did. The law clerk would likely go to AT&T’s website and search in vain for any links or other means to access this information. No hyperlinks or search engine requests would have produced the desired results.

This is really obnoxious. The US Attorneys working on this case know that a judicial law clerk is going to make the key call on this case, and this is a way to flatter those law clerks, claiming that they're "sophisticated computer users." But a "sophisticated computer user" is quite different from a security researcher or a higher level technically proficient user. The fact that they couldn't find this info via a search engine is meaningless. No one is arguing that the info was available via search -- but rather that it was incredibly wide open because of a security hole, and yes, you'd need some level of technical proficiency to figure it out, but as far as I know there's no law making it illegal to be more technically proficient than a law clerk.

Later, the DOJ argues that using the ICC-ID number, which AT&T assigned incrementally is the equivalent of using a password. They're apparently not joking:

The argument that the ICC-ID “is not a password,” begs the question of what counts as a “password.” Wikipedia defines a “password” as “a secret word or string of characters used for user authentication to prove identity or access approval to gain access to a resource (example: an access code is a type of password), which should be kept secret from those not allowed access.”... MK makes the facile argument that an ICC-ID is not a password because it is frequently printed on the outside of phone packaging, and thus is not secret. But that cannot be correct. Combinations to locks are often printed on the packaging, but the combination nevertheless is the secret “password” that opens the lock. Openness to the public prior to purchase is irrelevant, because after purchase the combination becomes the owner’s secret. So too with an ICC-ID. Once a phone or other device using an ICC-ID is purchased, no one can easily learn the ICC-ID unless he or she actually possesses it.

Try not to guffaw. Yes, even though the ICC-ID is just an incremental number, permanently stuck to a device, and is permanently printed on the device, the DOJ is insisting that it's still just like a password. The fact that combinations are printed on packaging is meaningless, because it's not meant to be left on the lock. Furthermore, this totally ignores the fact that the ICC-IDs were incremental. If AT&T had intended them to be secret, rule number one would have been to use a system that you couldn't guess others accounts merely by adding one. And it gets worse:

An ICC-ID, unlike a password, is a unique identifier. In that regard, when it is used to gain access to a server, it can be even more secure than a password chosen by a user, which frequently can be guessed. Certainly a 19 or 20 digit ICC-ID is harder to guess using brute force than a typical four-digit ATM access code, misuse of which would certainly constitute a CFAA violation.

Except, uh, that's not how an ATM card password works (and, yes, ATM cards are not particularly secure). You don't put your ATM card into a machine and it automatically reads the code off the card and lets you into your account. That is, the PIN code is designed to be separate from the card, with the idea being that to get into your account you need both something physical and something in your head. The ICC-ID isn't like that. It was designed to let the user automatically access their account without a password. There wasn't that second "thing in your head" that makes a password a password.

From there, the DOJ tries to attack the fact that the "hack" was merely adjusting the URL incrementally to access each account. It does this by arguing that because SQL injection attacks can happen via a URL, therefore any "hack" via a URL can be a malicious hack.

For example, Albert Gonzalez was the mastermind of a credit card theft ring responsible for reselling more than 170 million credit card and ATM numbers from 2005 through 2007, the largest such fraud in history.... Gonzalez’s ring used what is known as an SQL injection attack, which can be performed by entering an “address” in a URL or entering data in publicly facing web forms. In many common SQL injection attacks, the challenge for the hackers is to determine the correct characters to send to the network’s database storing the data the attacker intends to exfiltrate. However, once the vulnerability is determined and the appropriate combination of characters is discovered, many SQL injection attacks can be reduced to a URL because malicious code entered into a form field in a website is often delivered to the victim’s network from the attacker’s computer in the form of a URL that includes within it the malicious string.

But, an SQL injection attack is very very different than merely incrementing a number in a URL. Yet, the DOJ wants to equate the two. That's crazy. It goes on to try to link the two things much more closely:

And the result of these attacks, like the result in SQL injections, is that the browser returns unauthorized data from a database. An SQL injection attack is among the most dangerous and notorious hacks used today...

Sure, an SQL injection attack can be "dangerous and notorious," but that's because it's entirely different than incrementing a number. An SQL injection to gain much more power over an entire server is not the same as just flipping through pages that are easily available. The attempt to link the two is crazy, but certainly could be used to mislead a less technically savvy "law clerk," for example.

Later, the DOJ further argues Auernheimer and Spitler were guilty of bad things because they didn't contact AT&T, but rather purposely chose to go to the press (specifically, Gawker) to publicize the discovery of the security vulnerability. While it's true that it's common to alert a company ahead of time, the fact that they didn't do this is kind of meaningless here. If they were really up to no good, they wouldn't have publicized the vulnerability at all. Yes, they sought to "benefit" from it: they wanted to use it to get attention for their security work at Goatse Security. But using the discovery of a security vulnerability to help get attention for their own security research operation doesn't seem like evidence of nefarious intent. In fact, it seems like exactly the opposite. Then there's this craziness:

The groups of security researchers and computer professionals who have filed amicus briefs in this case need not be troubled by this prosecution of this black hat hacker. Major technology companies today – Microsoft, Google, Facebook, PayPal, and Mozilla, to name a few – all pay bounties to white hat hackers who find flaws in their systems and thereby help keep them secure. The Government is not aware of any instance in which a security researcher who followed the rules of ethical hacking was prosecuted for violating the CFAA. Often, when a white hat hacker discovers and reports a security flaw, he is rewarded financially for his work by the company that he has hacked. But no one, not even a white hat hacker, gets to make his own rules.

Except, as Graham notes, the list above is the entire list of tech companies who pay bounties to white hat hackers. Most tech companies don't do that, including... AT&T. Furthermore, Graham highlights this wacky line: "The Government is not aware of any instance in which a security researcher who followed the rules of ethical hacking was prosecuted for violating the CFAA." Yes, they're back to their made up "rules." As Graham points out in response:

This is circular logic, saying that people who follow the rules don't break the rules. When the prosecutors make the arbitrary decision that you've violated the CFAA, they'll likewise decide that you don't follow the rules of ethical hacking. Such circular logic is the basis for the prosecutor's entire argument: Weev is a bad guy because he's a bad guy.

When that's the way the law is read, you no longer have the rule of law. And that's why the case against Auernheimer is so ridiculous. It only works if the feds get to make up the rules as they go along, and argue that something is wrong, because they say it's wrong.

Filed Under: andrew auernheimer, authorized access, cfaa, daniel spitler, doj, hacking, security research, user agent, weev
Companies: at&t

AT&T Has Employees Embedded In The Gov't Providing Near Realtime Searches On Nearly Every Phone Call

from the forget-the-nsa dept

We've obviously been talking plenty about how the big telcos appear to provide tremendous amounts of data to the NSA -- including, basically, call records on every single call ever made. We also discussed how the DEA appears to be getting secret info from the NSA and other intelligence agencies, via its Special Operations Division (SOD), and is then told to effectively launder where it got it's tips from. However, over the weekend, the NY Times broke a huge story about a program called Hemisphere, set up by AT&T and the DEA, such that the DEA and a variety of other law enforcement agencies (including some at state level) have near real-time access to data on every single call that touches an AT&T switch (which goes way beyond cases where one of the parties on the call has an account with AT&T). And this database goes back to 1987 (unlike the NSA which claims to delete most data beyond five years, which may or may not be true). Also, unlike the NSA, this Hemisphere database includes location info.

Oh, and making it even crazier: the government is paying AT&T to have a bunch of AT&T employees embedded with the DEA so that they can respond to requests to search this database faster. The government insists this is no big deal (of course) in part because the "database" is not actually held by the feds, but rather by AT&T. But, really, does that distinction really matter when the AT&T employees who can query it are basically DEA employees -- paid by the US government, working with DEA units? In order to query Hemisphere, the DEA and other agencies apparently just need an administrative subpoena, which is the equivalent of saying the DEA just needs to ask for it. There's no review or oversight by a court or anything.

Furthermore, this seems to totally decimate the argument that the NSA and its defenders were making a few weeks ago, claiming that with the dragnet collection of metadata on all phone calls, it was necessary for the NSA to store this data, because it would take way too long to have the telcos do the searches for the government. They seem to have conveniently left out that there was already a program in place whereby law enforcement folks could walk over to the next cubicle and get the AT&T employee paid for by the government run a search for them with no real oversight.

Also, as with the SOD "leads" it appears that those in law enforcement making use of Hemisphere data are told to launder the use of the database. The PowerPoint presentation (which was revealed -- perhaps accidentally -- in response to a FOIA request) talks about "protecting the program," which includes telling people who use the program "to never refer to Hemisphere in any official document." It also explains how to "wall off" Hemisphere by using the information gleaned via the program to then seek a more regular subpoena for a specific carrier's records. Basically, they use Hemisphere to find out key information and then tell law enforcement to use a different kind of subpoena to pretend the info came out of something different.

Furthermore, it appears they've been expanding the list of law enforcement people who can make use of Hemisphere. Washington state began allowing law enforcement in Washington to make use of Hemisphere, and they seem pretty excited about expanding such access to this massive database -- which adds 4 billion call records every day. While the program is considered "unclassified," the NY Times notes that it does not appear to have ever been mentioned publicly.

The tool is apparently quite good at locating people who are using burner phones and connecting various dots when people abandon one phone and pick up another. Obviously, you can see why such info might be valuable to law enforcement -- especially the Drug Enforcement Agency -- but there are serious questions about whether or not having access to all that data with so little oversight is actually legal. If you thought the NSA's "metadata" database was big, this is much bigger. And almost no one even seemed to know it existed.

Filed Under: burner phones, dea, embedded employees, hemisphere, location info, metadata, phone calls, privacy
Companies: at&t

Latest Leak: NSA Can Spy On Almost Anything, Gets To Set Its Own Filters

from the and-another-shoe-drops dept

And, here we go again. This time, it's the WSJ journal with the scoop on NSA surveillance, and how the defenders of the NSA have been lying to us. Despite claims that the NSA was really only focused on foreign communications, the WSJ is reporting that it actually covers 75% of US internet traffic:

The National Security Agency—which possesses only limited legal authority to spy on U.S. citizens—has built a surveillance network that covers more Americans' Internet communications than officials have publicly disclosed, current and former officials say.

The system has the capacity to reach roughly 75% of all U.S. Internet traffic in the hunt for foreign intelligence, including a wide array of communications by foreigners and Americans. In some cases, it retains the written content of emails sent between citizens within the U.S. and also filters domestic phone calls made with Internet technology, these people say.

Basically, they're just revealing more details about the things that whistleblower Mark Klein revealed years ago: that the NSA has deals with the major telcos which scoop up a huge amount of internet traffic.

The programs, code-named Blarney, Fairview, Oakstar, Lithium and Stormbrew, among others, filter and gather information at major telecommunications companies. Blarney, for instance, was established with AT&T Inc., former officials say. AT&T declined to comment.

This filtering takes place at more than a dozen locations at major Internet junctions in the U.S., officials say.

The WSJ report is wrong on one account, though. It claims that people believed that the NSA's filtering actually happened "where undersea or other foreign cables enter the country" but that's not true. Mark Klein made it clear that the NSA had machines directly on AT&T's property.

And, of course, it will come as no surprise that these programs that work directly with telcos to tap into full internet traffic aren't just about metadata:

...this set of programs shows the NSA has the capability to track almost anything that happens online, so long as it is covered by a broad court order.

[....] Inevitably, officials say, some U.S. Internet communications are scanned and intercepted, including both "metadata" about communications, such as the "to" and "from" lines in an email, and the contents of the communications themselves.

This also shouldn't be a surprise. For all the talk of "metadata" it was always clear that the surveillance defenders were talking about this program only, which was the Patriot Act Section 215 "business records" program. But other programs, such as these listed above, were clearly about actual content as well.

While the report does note that some "minimization" happens, there is clearly widespread ability to abuse. The system works by having the NSA telling the telcos to only send over certain traffic covering "certain areas of interest" which the NSA then "briefly copies" and decides what to keep and what to dump. Again, this is consistent with earlier reports of the NSA searching all emails that go into and out of the US.

The latest report is, again, replete with NSA doublespeak. It claims that it's not "accessing" all of this traffic, because it asks the telcos to do some of the filtering for it. That's how it gets away with talking about "things we actually touch," even though its deals with the telcos basically mean they can access almost everything.

The WSJ further reports that, while most of the requests are targeted towards foreign communications, there are times when it's quite clear that requests are likely to cover domestic communications. Some telcos apparently push back, causing "friction", while others seem to comply with no qualms, though there is no indication of which telcos fall into which camp.

The report further confirms that this program is considered "legal" by the administration thanks to a broad interpretation of the FISA Amendments Act, giving the NSA the power to snoop on people "reasonably believed" to be outside the US, rather than requiring "probable cause" that they were "an agent of a foreign power." Also, there's this:

NSA has discretion on setting its filters, and the system relies significantly on self-policing. This can result in improper collection that continues for years.

The report also claims that it was one of these "mistakes" that resulted in three years of illegal collections (much greater than the "few months" that were revealed in last week's Washington Post article).

And now we wait for another bunch of carefully worded statements from NSA defenders...

Filed Under: abuses, americans, blarney, fairbiew, filters, lithium, nsa, nsa surveillance, oakstar, spying, stormbrew
Companies: at&t, cisco, juniper, narus, verizon

FISA Order To Verizon Expires Today, No One Wants To Say If It's Being Renewed

from the because-it-is dept

The very first of the Ed Snowden leaks was a FISA court order to Verizon, ordering it to hand over information on every single phone call, on an "ongoing, daily basis." That order expired on July 19, 2013. Today. It quickly came out that the FISA court has been approving nearly identical orders every 90 days for about seven years, though the defenders of the program like to use that "it's only for 90 days" excuse to suggest there's "oversight." Still, given that the existence of this effort is now actually public, plenty of people are wondering whether or not the FISA court issued the expected followup. Of course, no one who knows wants to say anything.

The Obama administration is refusing to say whether it will seek to renew a court order that permits the National Security Agency's bulk collection of phone records on millions of Verizon customers when it expires at the end of this week.

Officials declined to discuss what action they intend to take about the order at the center of the current surveillance scandal, which formally expires at 5pm Friday.

That's because it's almost certain that it's already been renewed and rubber stamped by the FISA court. The White House told Guardian reporters to ask the Justice Department. Guess where that went:

The White House referred queries to the Justice Department. "We have no announcement at this time," said Justice Department spokesman Brian Fallon. The NSA and office of the Director of National Intelligence did not respond to questions.

A spokesman for the Fisa court, Sheldon Snook, said the court "respectfully declines to comment".

In other words: please, please, go away and can we hope this story dies down by the time the next 90-day window rolls around?

Thankfully, some members of Congress have told the White House not to seek a renewal, but it seems unlikely that the White House will do anything, other than keep on sucking up all that data.

Filed Under: business records, fisa court, fisc, metadata, section 215, telcos
Companies: at&t, sprint, verizon

Telcos 'Volunteered' To Hand Over Data To NSA... And Got Over $100 Million For It

from the the-industrial-intelligence-complex dept

We've written a few times about the questionable nature of the "intelligence-industrial complex" in which various private companies are very tightly intertwined with the government's surveillance efforts, and are profiting handsomely from those efforts, giving everyone the incentive to play up bogus "threats" and to continually expand surveillance without oversight. Julian Sanchez has a great piece exploring some of the details on one of the more recent leaks from the Snowden files, involving the Inspector General's report looking into the original warrantless surveillance program called Stellar Wind (which was revealed years ago) by whistleblowers like Bill Binney, as well as the NY Times.

As Sanchez notes, while Stellar Wind had been talked about extensively, there were still many important details that hadn't been know that were revealed in this report, including that the program was much broader than originally reported, that President Bush almost certainly lied in public about the extent of the program, that the decision to spy on Americans came from Cheney's office (without consulting the NSA) and the actual numbers of people being spied on, both domestic and foreign (37,644 people, 3,018 of whom were Americans -- though that only counts the "targets" and not the many Americans they likely emailed with or called, whose communications were also intercepted).

But perhaps the most interesting is the role of the telcos. As Sanchez notes, it would appear that AT&T and Verizon actively "volunteered" to hand over data to the government... and then proceeded to make over $100 million dollars as the government paid for this "voluntary" dismantling of the privacy of their customers.

After the attacks of September 11, 2001—but before President Bush authorized the program that would become STELLAR WIND on October 4—two major telecommunications companies approached the NSA to volunteer their assistance. Though they’re identified only as “COMPANY A” and “COMPANY B” in the reports, experts agree that they are almost certainly AT&T and Verizon. One of them, COMPANY B, had even done some of its own freelance intelligence work: it told the NSA that it had “noticed odd patterns in domestic calling records surrounding the events of 11 September and offered call records and analysis."

Then again, perhaps “volunteer” isn’t quite the right word. The report tallies the costs of the program, which came to a bit more than $146 million over fiscal years 2002–2006. But only about $44 million of that went to the software and hardware infrastructure needed to sift through all that data. By far the biggest expense category—accounting for the other $102 million in outlays—was the “metadata and content” itself, an apparent reference to payments to the participating telecoms.

It remains telling that AT&T and Verizon have remained almost entirely silent about all of this, as various other companies mentioned in much more limited programs, have been pretty vocal about things.

Filed Under: data, intelligence industrial complex, nsa, nsa surveillance, privacy, telcos, volunteering
Companies: at&t, verizon