Want Anybody's Personal Details From Aadhaar, India's Billion-Person Identity Database? Yours For $8

from the Aadhaar-admin-accounts-also-available-on-request dept

We've been writing about the world's largest biometric database, India's Aadhaar, since July 2015. Over 1.1 billion people have now been enrolled, and assigned an Aadhaar number and card, which represents 99.9% of India's adult population. There are currently around 40 million authentications every day, a number that will rise as Aadhaar becomes inescapable for every aspect of daily life in India, assuming it survives legal challenges. That scale necessarily entails a huge infrastructure to handle enrollment and authentication. So it will comes as no surprise to Techdirt readers that it turns out you can obtain unauthorized access to the Aadhaar system very easily, and for very little cost. As the Indian newspaper The Tribune revealed:

It took just Rs 500 [about $8], paid through Paytm [an Indian online payment system], and 10 minutes in which an "agent" of the group running the racket created a "gateway" for this correspondent and gave a login ID and password. Lo and behold, you could enter any Aadhaar number in the portal, and instantly get all particulars that an individual may have submitted to the UIDAI (Unique Identification Authority of India), including name, address, postal code (PIN), photo, phone number and email.

What is more, The Tribune team paid another Rs 300 [$4.75], for which the agent provided "software" that could facilitate the printing of the Aadhaar card after entering the Aadhaar number of any individual.

Given the repeated assurances by the UIDAI that the Aadhaar database was completely secure, this is big news, and led to some breathless damage limitation by the Indian authorities on Twitter. The UIDAI explained that: "Some persons have misused demographic search facility, given to designated officials to help residents who have lost Aadhaar/Enrollment slip to retrieve their details"; and: "There has not been any data breach of biometric database which remains fully safe & secure with highest encryption at UIDAI and mere display of demographic info cannot be misused without biometric". Although it may be true that this is not a biometric data breach, it nonetheless reveals a serious vulnerability in the system's design, and on a vast scale. According to the original article in The Tribune, more than 100,000 "village-level enterprise operators", hired to help with Aadhaar enrollment, have been offering this kind of unauthorized access to the database. In fact, the problem seems to be even more serious than simply providing login credentials to thousands of people. Here's what another Indian site discovered:

Following up on an investigation by The Tribune, The Quint found that completely random people like you and me, with no official credentials, can access and become admins of the official Aadhaar database (with names, mobile numbers, addresses of every Indian linked to the UIDAI scheme). But that's not even the worst part. Once you are an admin, you can make ANYONE YOU CHOOSE an admin of the portal. You could be an Indian, you could be a foreign national, none of it matters -- the Aadhaar database won't ask.

Even if biometric data is not involved, it's hard to see how UIDAI could claim that these aren't breaches of the database, or deny that the entire Aadhaar system is seriously compromised. It's almost inevitable that the security of an important database system will be defeated eventually in some way, since the rewards are by definition so high. The fundamental problem with Aadhaar is its underlying intent -- to create a single, giant database with key personal information about a billion people that can be accessed very frequently and very widely. That's never going to be safe, as the inevitable future breaches will confirm.

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Filed Under: aadhaar, database, hacked, id, identity, india, privacy

NYPD Tells Judge Its $25 Million Forfeiture Database Has No Backup

from the overpriced-by-at-least-$25-million dept

The NYPD is actively opposed to transparency. It does all it can to thwart outsiders from accessing any info about the department's inner workings. This has led to numerous lawsuits from public records requesters. It has also led to a long-running lawsuit featuring the Bronx Defenders, which has been trying to gain access to civil forfeiture documents for years.

The NYPD has repeatedly claimed it simply cannot provide the records the Bronx Defenders (as well as other records requesters) have requested. Not because it doesn't want to, even though it surely doesn't. But because it can't.

The department has spent $25 million on a forfeiture tracking system that can't even do the one thing it's supposed to do: track forfeitures. The Property and Evidence Tracking System (PETS) is apparently so complex and so badly constructed, the NYPD can't compile the records being sought.

Oddly enough, the Bronx Defenders has pieced together enough data from the NYPD's broken PETS (along with other public records) to at least point out the glaring discrepancy between what the department publicly claims it has in its forfeiture accounts and what the database says it does.

At the hearing, the NYPD claimed that it only legally forfeited $11,653 in currency last year — that is, gone to court and actually made a case as to why the NYPD should be taking this money.

[...]

In the accounting summaries which the Bronx Defenders submitted as part of its testimony, the NYPD reports that as of December 2013, its property clerk had almost $69 million in seized cash on hand. This amount had been carried over from previous years, showing an annual accumulation of seized cash that has reached an enormous amount. The documents also show that each month, the five property clerk’s offices across the city took in tens of thousands of dollars in cash, ultimately generating over $6 million in revenue for the department.

When pressed in court, NYPD experts claim the NYPD lacks the expertise to extract the sought data from its forfeiture database. These assertions are at odds with the NYPD's self-perception: that it is fastest and smartest law enforcement agency in the US (better than the FBI, in fact) and foreign governments should be grateful its officers and analysts are showing up uninvited at scenes of overseas terrorist attacks.

Somehow, these highly-trained officers are unable to extract data from a $25 million database. Maybe it's not the lack of talent. Maybe it's the lack of desire. Maybe the NYPD has zero interest in tracking this data because it doesn't want the public to see how much it has hoovered up or make it any easier for citizens to challenge forfeitures.

The lawsuit continues, with the NYPD continuing to top itself with each round of expert testimony. As Adam Klasfield reports for Courthouse News, the NYPD's $25 million database is worth even less than previously assumed.

New York City is one power surge away from losing all of the data police have on millions of dollars in unclaimed forfeitures, a city attorney admitted to a flabbergasted judge on Tuesday.

“That’s insane,” Manhattan Supreme Court Judge Arlene Bluth said repeatedly from the bench.

It is insane. There's no way around it. The assumption would be that a $25 million database has built-in redundancy. But of course it wouldn't. Not with the NYPD running it and not with its active disinterest in providing records to records requesters or having any accountability present in its forfeiture system.

And why should the NYPD fix it? From its perspective, this is fine. Data goes in and never comes out. If it all disappears because someone trips over the power cord, the NYPD suffers no negative consequences. Everything it has taken over the years defaults to the NYPD until proven otherwise by claimants. And that's going to be a lot tougher to do when the NYPD has no records related to the forfeiture.

The court is in no position to do anything about this. It can't order the NYPD to fix its system. All it can do is demand it comply with records requests and pay the legal fees of prevailing parties. But the NYPD can continue to run a useless system for the rest of whatever. The burden of proof in forfeiture cases is already shifted to claimants. A broken system places even more of a burden on those seeking return of their property, thanks to PETS being unable to confirm or deny existence of responsive records. It's GlomarDb and it makes a mockery of public records laws and due process simultaneously.

Filed Under: asset forfeiture, database, foia, nypd, transparency

School District Routinely Abused Access To Law Enforcement Database; Suspended Whistleblower Who Exposed It

from the like-any-other-criminal-enterprise,-the-government-hates-snitches dept

Give enough people access to sensitive information and abuse is inevitable. We've covered multiple incidents of law enforcement database misuse by police officers. Some have used their access to track former spouses. Others use it to harvest info on potential partners, supplementing the minimal personal data supplied by internet dating sites.

But it's not just law enforcement officers abusing this access. It's also abused by public employees who have been granted access to these databases. Jose Gaspar of Bakersfield.com details the apparent routine misuse of database access by school administrators.

Kern High School District administrators and other employees misused a criminal database to investigate students, and while sheriff’s officials recommended criminal charges against two, no one was prosecuted, according to documents obtained this past week.

The chief of police for the school district (Joe Lopeteguy) suspected unauthorized use of access of the CLETS (California Law Enforcement Telecommunications System) database so he asked the Kern County Sheriff's Office to investigate. The office confirmed Chief Lopeteguy's suspicions.

The report says KHSD police accessed CLETS to get information about a special education student for unknown reasons; an employee who’d filed a workers’ compensation claim with the district; and about 30 student athletes.

What tipped Chief Lopeteguy off was a request sent to him by the athletics director asking him to run a student's plates. Lopeteguy told the requester he wouldn't because such a search would be illegal. Apparently, this was the first time the athletics director had been told "no."

Shortly after, the chief reportedly said, he received an email from his boss, KHSD Director of Pupil Personnel Otis Jennings, wondering what was going on.

The message from Jennings read, “This is something we've done in the past through the chief for purposes of the district.”

The former school police chief (Mike Collier) admitted to approving these (apparently illegal) search requests in the past. Both the athletic director and personnel director had submitted multiple database search requests, often without informing Collier of their plans. The district's police dispatcher -- who ultimately controlled database access -- confirmed this.

[The dispatcher] told investigators that [athletics director] Greene would come in with a list of licenses to run, but she would only run requests under Collier's order and with him providing his CLETS identification number. According to the report, Stonecipher also said Jennings would make CLETS requests and she would direct him to Collier.

Collier apparently approved the 246 database searches performed using his credentials during the 2014-15 school year, even though a majority of them were for information school staff wasn't allowed to obtain via the law enforcement database.

Investigators tried to speak to Collier about his search history but he lawyered up and refused to cooperate. The other administrators named in the investigation also refused to speak to the Sheriff's Office.

Not that their refusal to cooperate ultimately matters. The Sheriff's Office recommended bringing charges against Collier and Jennings for their access violations, but the District Attorney decided not to prosecute. The only person being punished for this abuse is the man who reported it: Chief Lopeteguy.

During the investigation, on May 13, KHSD placed Lopeteguy on administrative leave. Lopeteguy told investigators the district was accusing him of misusing CLETS and of incompetence.

Lopeteguy was reinstated two months later but claims -- via a $2.3 million lawsuit against the district -- that he's still being harassed by district staff, who have gone so far as to attempt to have the Sheriff's Office investigate him for abuse of the CLETS database.

Here we see the government acting in two of its standard roles: the routine abuser of access to information citizens are required to provide it with, and as the punisher of whistleblowers who expose this abuse. Neither of these actions serve the public in any way, shape or form, making a mockery of the term "public servant."

Filed Under: bakersfield, database, law enforcement, students
Companies: kern high school

DMCA Takedown Company Thinks It's Making A Point With 'Transparency Report' -- Really Just Looks Like A Jackass

from the what-point-are-they-making-really dept

Over the weekend, TorrentFreak picked up on yet another weird case of some copyright extremists trying to "make a point" but really just coming across as jackasses instead. It involves one of a group of wacky companies that promise to help issue DMCA takedown notices for copyright holders. In this case, it's an outfit called "Remove Your Media" (creative!) which put up a Tumblr site and a tweet pretending that it was "turning the tables" on the famous and useful Lumen Database (formerly known as the Chilling Effects database): If you went to that website, for at least a little while, Remove Your Media was posting full details of people who filed counternotices to some of its DMCA takedowns. These postings made no effort whatsoever to redact personal information such as emails and phone numbers (TorrentFreak has an image where it redacted the info itself).

The "point" that Remove Your Media is so weakly trying to make is that there is a tiny group of copyright extremists who think that Lumen / Chilling Effects is itself a source of piracy because in posting DMCA notices, it leaves the links that copyright holders are demanding be taken down (it's noteworthy that Lumen does redact personal information, though). Of course, these are apples to oranges differences. The reason that Lumen leaves up those links is because the whole point of Lumen is to act as a clearinghouse of data for people to understand how the DMCA is used. And, in fact, it's been an invaluable tool for us and other researchers in finding examples of DMCA abuse. That would be significantly more difficult if the links in the notices were redacted. In fact, it would take away nearly all of the value of the database.

In response to the TorrentFreak article, it appears that Remove Your Media has taken down the information that it posted, and replaced it with a link to the head cheerleader of the anti-Lumen/Chilling Effects crowd, Ellen Seidler. Seidler has spent many, many, many years tilting at windmills complaining about piracy, which she blames for the poor performance of her poorly reviewed film (which, amusingly, borrowed its title from a much more famous movie). Just a few months ago, at the Copyright Office hearings in San Francisco, Seidler again raised this issue of Lumen itself being some sort of "rogue site" for posting DMCA notices.

However, as was pointed out at the time, there is basically no evidence whatsoever that Lumen is used as a source to find pirated links to any extent that matters at all. Without any evidence of pirate hordes searching an academic database of DMCA takedown notices, this hardly seems like a worthwhile thing to bitch about. And, besides, what Remove Your Media did in "turning the tables" doesn't even make the point it wanted to make. There's a world of difference between posting the details included in a DMCA notice in such a database, and deliberately revealing someone's private info. One is a legitimate attempt to collect useful data on how DMCAs are being used.

The other is just acting like a complete jackass.

Filed Under: database, dmca, ellen seidler, takedowns, transparency
Companies: lumen database, remove your media

Court Upholds Sentence For Ex-Cop Who Abused Law Enforcement Database Access

from the officer-unicorn dept

If asset forfeiture is just cops shopping for things they want, what is unauthorized access of law enforcement databases for personal reasons? Shopping for women? (h/t Eric Goldman)

The evidence indicated that defendant's login was used when information regarding LM, CG, and GL was accessed.

LM testified that she met defendant through her job at a flower shop, and they dated for approximately two months. She never asked defendant to look up her driving or criminal records. However, defendant admitted to her that he "ran her name" and, during the search, learned of an accident in which she was involved. CG testified that she became acquainted with defendant because he frequented a bar where she worked. On one occasion, after CG and defendant had exchanged messages on Facebook, defendant gave her a ride home from a bar when she was intoxicated. Subsequently, she asked defendant to search her driving record, testifying at trial that she asked him to do so for her own personal use and gain. GL testified that she dated defendant "on and off" between 2009 and 2011. There is no indication that she ever asked defendant to search her driving record, and she was never stopped by defendant in a law enforcement capacity.

The defendant, Taylor (MI) police officer Michael Calabrese, was originally charged with 11 counts of misusing the Law Enforcement Information Network (LEIN). This makes Calabrese somewhat of an anomaly. While every user of the LEIN is warned that improper access could result in criminal charges, this almost never actually happens. Suspensions may be handed out, but they tend to be minimal (three days at most). Others just receive written reprimands. Someone actually convicted of abusive access is a rarity.

Calabrese appealed his convictions on several grounds, one of them being a lack of evidence. The Michigan Court of Appeals isn't sympathetic.

Despite the absence of direct eyewitness testimony that defendant searched the women's names on the LEIN, there is ample circumstantial evidence that he was the individual who performed the searches, as the queries at issue were performed using defendant's unique login. Although there was testimony that a LEIN search could be performed using another officer’s login information, such a search was against police department policy and occurred only under exceptional circumstances, such as during a situation when officer safety was at risk. In these instances, there is no evidence that suggests that the LEIN searches giving rise to defendant’s convictions were necessary for officer safety.

[...]

On this record, even though the prosecution did not present a witness who observed defendant performing the searches or who had personal knowledge of defendant's specific intent when the searches were performed, there was sufficient circumstantial evidence for the jury to reasonably infer that defendant intentionally ran the searches for his own personal benefit, as the searches were made using his login information and involved women with whom he had a personal connection.

The verdict and sentence former officer Calabrese was challenging wasn't much. Of the eleven charges, only three misdemeanor counts stuck. Calabrese will now have to serve one year probation and pay $1,600 in fines. The probation time will be cut in half if Calabrese's payments remain on track. The punishment from the court doesn't amount to much. It's the loss of his law enforcement position that will probably hurt Calabrese more, but that may only last as long as his probation does. Law enforcement agencies have proven more willing to forgive and forget than the private sector, which often refuses to employ ex-cons under any circumstances.

Filed Under: abuse, database, michael calabrese, police, spying, surveillance

Denver Police Officers Improperly Access Sensitive Crime Database Because Department Has No Interest In Stopping Them

from the also-because-they're-terrible-people-who-abuse-their-position dept

Massive databases full of personal information are in the hands of law enforcement. There are many legitimate uses for these databases, but like anything containing sensitive information, the temptation to abuse access privileges is omnipresent. This is highly problematic when the violator is a law enforcement officer. Not only does this violate internal policies and local statutes, but it puts sensitive info in the hands of someone who has plenty of power but little apparent interest in wielding it properly.

Officers have run suspect background checks on police review board members, used sensitive databases to screen potential dates, and spy on their ex-wives. So, it's unsurprising that another law enforcement agency has been found to be housing abusers of sensitive databases.

[Independent Monitor Nicholas] Mitchell said 25 Denver officers have been punished for inappropriate use of the databases since 2006. Most of them received reprimands rather than the harsher penalties some police agencies impose for the same offense. None of the 25 was charged with a crime.

The abuse will continue at the Denver PD unless something changes. Officers are warned that improper access of the NCIC (National Crime Information Center) database may result in criminal charges, but that's obviously not true. The report says that, in the last decade, no officer caught abusing access to the database has received anything more severe than a three-day suspension. It further notes that these officers may not have even received this minimal suspension if it weren't for previous misconduct on the records prior to the improper access violation.

This improper access was used to facilitate activities that could themselves be considered criminal.

The Denver cases include an officer who looked up the phone number of a hospital employee with whom he chatted during a sex assault investigation and called at home against her wishes.

Another officer ran a man’s license plate seeking information for a friend, who then began driving by the man’s house and threatening him, according to the monitor’s report.

Unsurprisingly, the monitor has suggested the Denver PD immediately institute harsher punishments for improper access. The Denver PD has responded by saying the punishments are harsh. And they are. It can fire officers and bring criminal charges against them for improper access. It just has never done so. I guess a theoretical deterrent is better than no deterrent at all?

And, while 25 officers may seem like a really low number of abusers, the monitor says his office has no idea how widespread this abuse is. The Denver PD never audits its officers' use of the database. It only responds to complaints of possible improper access. Its internal oversight is just as weak as its half-hearted wrist slaps in response to verified abuse.

Filed Under: database, denver, law enforcement

FBI To Replace Terrible Voluntary Police Shooting Reporting System With NEW Voluntary Police Shooting Reporting System

from the unrecognizable-'changes'-ahead! dept

Back in October, the FBI very belatedly admitted it had been doing an abysmal job tracking the number of people killed by law enforcement officers. For nearly 15 years, the DOJ has been charged with collecting this data, but so far has only managed to produce totals that are half of those compiled by citizens and journalists.

The FBI admitted it hadn't done a very good job collecting this data and vowed to improve things in the future. But it didn't say how it would accomplish this. It didn't appear to be considering changing the one factor contributing the most to its yearly under-count: the system is entirely voluntary. As a result, less than 3% of the nation's 18,000 law enforcement agencies have regularly reported their shootings to the FBI.

More details have emerged on the FBI's new use-of-force tracking initiative. The former program -- which none other than FBI director James Comey called a "travesty" -- is being overhauled. The voluntary reporting system will be replaced with a revamped, more detailed… completely voluntary reporting system.

The new database will continue to rely on the voluntary reports of local police departments; FBI officials said they lack the legal authority to mandate reporting.

Cynics/critics will be delighted unmoved to hear the FBI thinks this voluntary system will work better than the last one, which was a federal embarrassment (again, Comey's own words). Why? Because they've been promised that everyone will try harder to turn over information this time.

But [FBI Assistant Director of Criminal Justice Information] Stephen Morris said the leaders of the nation’s largest police organizations have agreed for the first time to lobby local departments to produce the data. The Justice Department is also looking to offer federal grants to local departments that may need additional resources to comply.

“We will be relying on peer pressure and financial incentives,” Morris said.

Well, peer pressure definitely has improved the nation's law enforcement agencies by ridding them of "bad apples" and internal corruption… oh, wait, none of that ever happened. Financial incentives may work better than peer pressure. A nation full of asset forfeiture abuse can attest to that. But if the money can only be spent on complying with a voluntary effort that might make agencies/individual officers "look bad," it's unlikely this "carrot" will work better than the stick the FBI can't wield.

The FBI may not be able to make this reporting mandatory, but Congress can. So far, legislative efforts aimed at doing exactly that haven't gone anywhere. But despite FBI officials publicly wringing their hands over the results of the agency's multiple years of indifference, the agency has yet to offer any public support for this sort of legislation.

If this effort ever approaches large-scale participation, the stats gathered will be much more in-depth than anything the DOJ's collected to date.

The new effort will go beyond tracking fatal shootings and, for the first time, track any incident in which an officer causes serious injury or death to civilians, including through the use of stun guns, pepper spray and even fists and feet.

[...]

Morris said the data will also be “much more granular” than in the past and will probably include the gender and race of officers and suspects involved in these encounters, the level of threat or danger the officer faced, and the types of weapons wielded by either party.

What will likely produce more and better results sooner is this effort -- which is already in progress.

Change is also underway at the Bureau of Justice Statistics, another Justice Department agency that has kept a separate count of civilians who die in police custody.

The bureau scrapped its old database and this year created a pilot program that relies on The [Washington] Post’s database and other open-source data-collection efforts to identify deaths that are not being reported. Then, BJS officials contacted police, medical examiners and other local officials to check the accuracy of the information and to gather additional facts.

The government doesn't always need to bootstrap its data gathering. The private sector tends to produce solid results. Plus,it's motivated -- at least in this case -- to collect as much data as possible and make it publicly-available. Law enforcement agencies are generally motivated to do the opposite, unless otherwise instructed. And it generally takes more than a "Would you kindly?" from the federal government to generate changes in mindset.

Anything would be better than what the FBI has delivered for the past several years. But it will take more than the FBI's public dismay to overcome law enforcement's natural instinct to bury anything that remotely resembles a questionable use of force.

Filed Under: database, fbi, police shooting, records, tracking, voluntary

The NSA Will Apparently Still Be Accessing The Old Phone Metadata It Said It Would No Longer Be Accessing

from the 'reform'-as-in-'maintain-status-quo' dept

The NSA's bulk phone metadata collection may no longer technically be a "collection" (the NSA now has to seek responsive metadata from telcos using targeted court orders), but that doesn't mean the agency isn't still seeking ways to keep the "dragnet" in "dragnet surveillance."

The NSA was only supposed to have access to previously collected bulk metadata for "analytic purposes." Apparently, "analyzing" the data also means searching the data, as was pointed out by FISA Court on Twitter (not affiliated at all with the actual FISA Court).

Fascinating: the Court will let NSA compare old bulk call data to new responses for a while. https://t.co/sY0PQxKJYM pic.twitter.com/XQrpeHnqOP

— FISA Court (@FISACourt) December 5, 2015

Fascinating: the Court will let NSA compare old bulk call data to new responses for a while.

The court finds that the USA Freedom Act did not expressly dictate limits on use of the metadata collected under Section 215 previous to the enactment of the surveillance reform bill. Because of this lack of statutory specificity, the court has agreed to grant NSA both access and extended retention of the data for two reasons.

The first is to verify the completeness of phone records obtained with targeted FISC orders.

[F]or a period ending on February 29, 2016, appropriately trained and authorized technical personnel will have access to the BR Metadata solely for the purpose of verifying the completeness and accuracy of call detail records produced under the targeted (i.e., non-bulk) production orders issued by the Court after November 28, 2015. According to the government, verification will involve a comparison of the two sets of records (i.e., the BR Metadata and call detail records received pursuant to subsequent, targeted orders). See Government Response at 9. NSA technical personnel will compare the number of call detail records produced for a specific selection term with the number of call detail records identified in response to a query of the BR Metadata using the same identifier. See id at 9-10. Such comparisons will help provide assurance that the new collection process is working as intended.

Extended retention of the bulk metadata will be permitted because the records themselves are still the subject of multiple lawsuits.

Analysis of the data will also double as a search of the data, mixing newly-obtained phone records with the old ones and muddying the line between what is explicitly permitted under USA Freedom and what isn't explicitly forbidden.

Once the NSA has obtained the responsive records, they will stay in the agency's hands for five years, presumably. At that point, they will become part of the larger collection -- some of which will never be destroyed.

Information obtained or derived from call detail records which has been previously disseminated in accordance with approved minimization procedures will not be recalled or destroyed.[2] Also, select query results generated by pre-November 29, 2015, queries of the bulk records that formed the basis of a dissemination in accordance with approved minimization procedures will not be destroyed.

[2] This practice does not differ from similar circumstances where, for example Court-authorized electronic surveillance and/or physical search authorities under Title I or III expire. While raw (unminimized) information is handled and destroyed in accordance with applicable minimization procedures, prior authorized disseminations and the material underpinning those disseminations are not recalled or otherwise destroyed.

It would appear that minimization, as far as the NSA is concerned, occurs at the point of handover from telcos. Records considered "minimized" by the FISA Court include those swept up by the agency's contact chaining, and these also will be compared to the "old" database for analytical purposes. As Marcy Wheeler explains, the dragnet isn't dead yet.

This means that everyone within two or three degrees of a target that the NSA has found interesting — potentially over the last decade — will remain available and subject to NSA’s analytical toys from here on out.

So, while some of the bulk metadata "ages off" at the five-year point, the NSA apparently considers "material" it has previously disseminated to other agencies or to its own analysts to be excluded from this time limit. How much data that involves is only known to the agency, which is being trusted to abide by the stipulations of the USA Freedom Act and destroy its Section 215 records once given the go-ahead from the FISA Court.

Filed Under: database, fisa court, metadata, nsa, phone records, section 215, surveillance

Transparency Watch Releases Searchable Database Of 27,000 US Intelligence Workers

from the publicly-posted-information,-searchable-by-the-public dept

Intelligence gathering on intelligence gatherers. Watching the watchers. Whatever you want to call it, Transparency Toolkit is doing it. It has gathered 27,000 publicly-posted resumes from members of the "intelligence community" and turned them into a searchable database.

The database -- ICWatch -- was put together using software specifically constructed by Transparency Watch (and posted at Github). Not only can the database be searched through TW's front end, but the data is also available in raw form for data-mining purposes.

Some may find this searchable database to be a form of doxxing, but TW says that isn't the intent. Instead, it's meant to give the public additional insight into the inner workings of the intelligence community, as well as allowing researchers and journalists to sniff out information on still-unrevealed surveillance programs.

"These resumes include many details about the names and functions of secret surveillance programs, including previously unknown secret codewords," Transparency Toolkit said.

"We are releasing these resumes in searchable form with the hopes that people can use them to better understand mass surveillance programs and research trends in the intelligence community."

What Transparency Watch has done is simplified a task anyone could have performed prior to the compilation of the ICWatch database. In fact, nearly two years ago, the ACLU's Chris Soghoian pointed out that public LinkedIn profiles were coughing up classified program names posted by intelligence community members in their listed skills and work history.

This is all Transparency Watch has done -- only in aggregate and accessible to those without a LinkedIn account.

The data was collected from LinkedIn public profiles using search terms like known codewords, intelligence agencies and departments, intelligence contractors, and industry terms, the group said.

What Soghoian noted back in 2013 remains true. Searches for known NSA programs frequently bring up other program names, all posted publicly by employees and contractors with an apparent disregard for the agency's "everything is a secret" policies.

A search for "PINWALE" brings up a profile listing the following:

Cultweave, UIS, Nucleon, CREST, Pinwale, Anchory, Association, Dishfire, SharkFinn, GistQueue, GoldPoint, Mainway

And another listing these terms:

Snort, TRAFFICTHIEF, PINWALE, BOUNDLESS INFORMANT, BLARNEY, BULLRUN, CARNIVORE

You can also find out who's involved in Predator drone flights. Or who's participated in the NSA's Tailored Access Operations.

Some may argue that this algorithmic collection of resumes and LinkedIn profiles may be dragging some people under the "intelligence community" umbrella that shouldn't really be there. That's likely true, but this is one of those inescapable outcomes of dragnet operations. They may also argue that turning over this information to the public may cause some of those listed to be subjected to harassment or put them in danger. Also, this may unfortunately be true as well.

But there's a simple solution, albeit one that can't be applied retroactively.

As the government so frequently points out to us, publicly-posted information carries no expectation of privacy. The same goes for government employees and government contractors in sensitive positions who choose to disclose information about their skills and employment publicly. If any danger to these people exists, it has always existed. ICWatch may make the job simpler, but it's done nothing any person can't do on their own, using simple search tools.

Filed Under: code names, database, intelligence, intelligence community, resumes
Companies: linkedin, transparency watch