US Still Can't Figure Out What Snowden Took; What Happened To Those Perfect 'Audits'?

from the total-failure dept

Remember how the NSA's biggest defenders keep insisting that the NSA's perfect "audits" prevent abuse? Here's Keith Alexander insisting that such audits are perfect:

"The assumption is our people are just out there wheeling and dealing. Nothing could be further from the truth. We have tremendous oversight over these programmes. We can audit the actions of our people 100%, and we do that," he said.

Addressing the Black Hat convention in Las Vegas, an annual gathering for the information security industry, he gave a personal example: "I have four daughters. Can I go and intercept their emails? No. The technical limitations are in there." Should anyone in the NSA try to circumvent that, in defiance of policy, they would be held accountable, he said: "There is 100% audibility." Only 35 NSA analysts had the authority to query a database of US phone records, he said.

Yet, many months after the initial leaks, it's being reported that the US government still doesn't know what Snowden took:

More than two months after documents leaked by former contractor Edward Snowden first began appearing in the news media, the National Security Agency still doesn’t know the full extent of what he took, according to intelligence community sources, and is “overwhelmed” trying to assess the damage.

First off, this shows that the claims of 100% auditability are complete crap. If they can't tell what Snowden took so many months later, they don't have very good auditability at all. Furthermore, this raises serious questions about the NSA's data management capabilities. For all the claims that there are no "willful" or "intentional" violations by the NSA of people's privacy, it seems difficult to believe they can know that. Here's a case where they flat out know that someone got access to all sorts of documents, and over many months they still can't figure out what he got. And, yet, they expect us to believe that they can tell with perfect accuracy what their staffers are doing with the data they have access to? Seriously?

Yes, there have been thousands of "accidental" violations that were caught in audits, but it seems highly likely that there are intentional violations that the NSA just doesn't know about. If they can't track what an outside contractor is downloading, how can they even pretend that they have control over their data and information?

Filed Under: abuses, audits, ed snowden, keith alexander, leaks, nsa, nsa surveillance, violations

Latest Leak: NSA Can Spy On Almost Anything, Gets To Set Its Own Filters

from the and-another-shoe-drops dept

And, here we go again. This time, it's the WSJ journal with the scoop on NSA surveillance, and how the defenders of the NSA have been lying to us. Despite claims that the NSA was really only focused on foreign communications, the WSJ is reporting that it actually covers 75% of US internet traffic:

The National Security Agency—which possesses only limited legal authority to spy on U.S. citizens—has built a surveillance network that covers more Americans' Internet communications than officials have publicly disclosed, current and former officials say.

The system has the capacity to reach roughly 75% of all U.S. Internet traffic in the hunt for foreign intelligence, including a wide array of communications by foreigners and Americans. In some cases, it retains the written content of emails sent between citizens within the U.S. and also filters domestic phone calls made with Internet technology, these people say.

Basically, they're just revealing more details about the things that whistleblower Mark Klein revealed years ago: that the NSA has deals with the major telcos which scoop up a huge amount of internet traffic.

The programs, code-named Blarney, Fairview, Oakstar, Lithium and Stormbrew, among others, filter and gather information at major telecommunications companies. Blarney, for instance, was established with AT&T Inc., former officials say. AT&T declined to comment.

This filtering takes place at more than a dozen locations at major Internet junctions in the U.S., officials say.

The WSJ report is wrong on one account, though. It claims that people believed that the NSA's filtering actually happened "where undersea or other foreign cables enter the country" but that's not true. Mark Klein made it clear that the NSA had machines directly on AT&T's property.

And, of course, it will come as no surprise that these programs that work directly with telcos to tap into full internet traffic aren't just about metadata:

...this set of programs shows the NSA has the capability to track almost anything that happens online, so long as it is covered by a broad court order.

[....] Inevitably, officials say, some U.S. Internet communications are scanned and intercepted, including both "metadata" about communications, such as the "to" and "from" lines in an email, and the contents of the communications themselves.

This also shouldn't be a surprise. For all the talk of "metadata" it was always clear that the surveillance defenders were talking about this program only, which was the Patriot Act Section 215 "business records" program. But other programs, such as these listed above, were clearly about actual content as well.

While the report does note that some "minimization" happens, there is clearly widespread ability to abuse. The system works by having the NSA telling the telcos to only send over certain traffic covering "certain areas of interest" which the NSA then "briefly copies" and decides what to keep and what to dump. Again, this is consistent with earlier reports of the NSA searching all emails that go into and out of the US.

The latest report is, again, replete with NSA doublespeak. It claims that it's not "accessing" all of this traffic, because it asks the telcos to do some of the filtering for it. That's how it gets away with talking about "things we actually touch," even though its deals with the telcos basically mean they can access almost everything.

The WSJ further reports that, while most of the requests are targeted towards foreign communications, there are times when it's quite clear that requests are likely to cover domestic communications. Some telcos apparently push back, causing "friction", while others seem to comply with no qualms, though there is no indication of which telcos fall into which camp.

The report further confirms that this program is considered "legal" by the administration thanks to a broad interpretation of the FISA Amendments Act, giving the NSA the power to snoop on people "reasonably believed" to be outside the US, rather than requiring "probable cause" that they were "an agent of a foreign power." Also, there's this:

NSA has discretion on setting its filters, and the system relies significantly on self-policing. This can result in improper collection that continues for years.

The report also claims that it was one of these "mistakes" that resulted in three years of illegal collections (much greater than the "few months" that were revealed in last week's Washington Post article).

And now we wait for another bunch of carefully worded statements from NSA defenders...

Filed Under: abuses, americans, blarney, fairbiew, filters, lithium, nsa, nsa surveillance, oakstar, spying, stormbrew
Companies: at&t, cisco, juniper, narus, verizon

Intelligence Official Says He Was Fired For Not Lying To Congress; Says Rogers & Feinstein Don't Know What's Happening

from the more-whistleblowing dept

As more and more details come out about the NSA surveillance programs, the federal government is looking more and more ridiculous. The latest comes from a column by John Fund at the National Review Online -- a publication which has been a pretty strong supporter of the surveillance state. The column highlights that even the NSA's staunchest defenders are beginning to get fed up with the NSA as more leaks come out (especially last week's revelation of thousands of abuses). But the really interesting tidbit is buried a bit:

A veteran intelligence official with decades of experience at various agencies identified to me what he sees as the real problem with the current NSA: “It’s increasingly become a culture of arrogance. They tell Congress what they want to tell them. Mike Rogers and Dianne Feinstein at the Intelligence Committees don’t know what they don’t know about the programs.” He himself was asked to skew the data an intelligence agency submitted to Congress, in an effort to get a bigger piece of the intelligence budget. He refused and was promptly replaced in his job, presumably by someone who would do as told.

Yes, it's an unsourced quote, so you can take it with whatever grains of salt you'd like. However, given the various revelations over the past few weeks and months, it's becoming increasingly clear that Congress does not, in fact, know what the NSA is up to, despite the claims by Rogers and Feinstein that there's strong oversight. Given that we've already seen how NSA agents are told to withhold certain info from those in charge of oversight, combined with the use of a loophole to avoid reporting details of its activities to Congress, the statement above certainly is supported by the various leaks to date.

Fund also highlights how the claim that Rogers' strong defense of the NSA appears to be out of ignorance of what's going on is based on Rogers' own quotes:

Back in July, House Intelligence Committee chair Mike Rogers claimed that there have been “zero privacy violations” on the part of NSA. After the leaked audit made news on Friday, he retreated to saying that “there was no intentional and willful violation of the law.”

A person who was really in charge of oversight would be demanding more information, public hearings and changes. But Rogers is doing none of that. How is he still in that job?

Filed Under: abuses, congress, dianne feinstein, intelligence, mike rogers, nsa, nsa surveillance, oversight, privacy

Key Loophole Allows NSA To Avoid Telling Congress About Thousands Of Abuses

from the oversight! dept

As we've noted, one of the key claims by NSA surveillance defenders was that the program had strong oversight from Congress. However, with the revelations last week about thousands of abuses, it's become quite clear that this isn't true. Late on Friday, Rep. Jim Himes, who is on the House Intelligence Committee, claimed that he was unaware of those violations, was told that there were "no abuses" and that these kinds of abuses are unacceptable:

Possibility of 1000s of NSA violations unacceptable. Many intel comm members unaware of this report. In fact, we have been told no abuses.

— Jim Himes (@jahimes) August 16, 2013

Remember, this isn't just a Congressional Rep, but a member of the Intelligence Committee, who is in charge of overseeing the NSA surveillance program. Hell, he's even on the oversight subcommittee, and no one told him about any abuses, despite thousands happening per year. That's astounding, and highlights how the claims of Congressional oversight are clearly bogus. Furthermore, it makes a mockery of the statement that House Intelligence Committee chair Mike Rogers put out on Friday, claiming that "The Committee has been apprised of previous incidents." Himes says that's completely untrue.

How is this happening? Marc Ambinder explains the "loophole" that the NSA has used to avoid telling Congress about these abuses. It's a bit convoluted, but basically, the NSA believes that Congressional oversight only covers spying done under FISA -- the law that covers any spying done on Americans, for which a court order is needed. FISA doesn't cover spying on non-US persons (i.e., foreigners who are outside the country at the time of surveillance). And that's where some of the abuses came in, and the NSA believes that since those aren't "FISA" related, and Congress is only overseeing "FISA," they don't have to report those mistakes.

Since the focus of oversight efforts has been on FISA compliance, NSA gives Congress detailed narratives of violations of the FISA-authorized data sets, like when metadata about American phone records was stored too long, when a wrong set of records was searched by an analyst or when names or “selectors” not previously cleared by FISA were used to acquire information from the databases. In these cases, the NSA’s compliance staff sends incident reports to the Senate Select Committee on Intelligence and the House Permanent Select Committee on Intelligence for each “significant” FISA violation, and those reports include “significant details,” the official said.

But privacy violations of this sort comprise just one third of those analyzed by the inspector general. Of the 2,776 violations reported by the NSA from May 2011 to May 2012, more than two-thirds were counted as E.O. 12333 incidents. And the agency doesn’t provide Congress detailed reports on E.O. 12333 violations.

Now, you can argue these are very different circumstances, but Ambinder points out that's not really true in many cases:

In some ways, it’s a distinction without a difference: it does not matter to U.S. citizens whether their phone call was accidentally intercepted by an analyst focusing on U.S.-based activities or those involving a foreign country. But the difference is relevant as it keeps Congress uninformed and unable to perform its oversight duties because the NSA doesn’t provide the intelligence committees with a detailed narrative about the latter type of transgressions.

For example, if someone’s e-mails were inadvertently obtained by the NSA’s International Transit Switch Collection programs, it would count as 12333 error and not a FISA error, even though the data was taken from U.S. communication gateways, and NSA would not notify Congress.

So, basically, any "error" that involves spying on Americans doesn't "count" as an abuse, as far as the NSA tells Congress (who keep claiming they're in charge of oversight), because they "obtained" it outside the US, and the "error" is considered outside of FISA. That's a pretty massive loophole through which the NSA can hide its abuse of programs from Congress.

Filed Under: abuses, congress, foreign intelligence, house intelligence committee, jim himes, loopholes, nsa, nsa surveillance, oversight, violations

Wyden And Udall: Latest Revelations Of Abuses 'Are Just The Tip Of A Larger Iceberg'

from the and-here-we-are-on-the-titanic dept

Following the latest revelations of widespread abuses by the NSA, Senators Mark Udall and Ron Wyden -- who had just recently warned that the intelligence community was not being upfront about abuses -- have put out a statement saying that there's still a lot more that hasn't yet been revealed:

The executive branch has now confirmed that the rules, regulations and court-imposed standards for protecting the privacy of Americans have been violated thousands of times each year. We have previously said that the violations of these laws and rules were more serious than had been acknowledged, and we believe Americans should know that this confirmation is just the tip of a larger iceberg.

They point out that they really can't reveal the details, but they're hopeful that President Obama and the intelligence community recognizes that it's better for them to come clean themselves. The obvious implication is that everyone knows that there are still thousands of documents held by reporters, and these other abuses are likely to come to light before long:

While Senate rules prohibit us from confirming or denying some of the details in today's press reports, the American people have a right to know more details about the scope and severity of these violations, and we hope that the executive branch will take steps to publicly provide more information as part of the honest, public debate of surveillance authorities that the Administration has said it is interested in having.

In particular, we believe the public deserves to know more about the violations of the secret court orders that have authorized the bulk collection of Americans' phone and email records under the USA PATRIOT Act. The public should also be told more about why the Foreign Intelligence Surveillance Court has said that the executive branch's implementation of Section 702 of the Foreign Intelligence Surveillance Act has circumvented the spirit of the law, particularly since the executive branch has declined to address this concern.

If the past is any indication, the intelligence community and the White House will ignore this. Sooner or later they're going to have to realize that every misrepresentation, every denial later proven false and every outright lie is only making things even worse. The window has probably already passed for the administration and the intelligence community to regain the trust of the public, but if it's going to happen, having the government come clean would be a good start.

Filed Under: abuses, mark udall, nsa, nsa surveillance, ron wyden, tip of the iceberg