Defense Department Oversight Finds More Evidence Of Retaliation Against Whistleblowers

from the government-shutdown dept

More evidence has surfaced showing the US government really doesn't care for whistleblowers. A Defense Department Inspector General's report [PDF] obtained by MuckRock contains details of Air Force supervisors turning against a civilian employee who reported time card abuse.

The heavily redacted report, which MuckRock requested following on an announcement in the January newsletter of the Department of Defense Inspector General, found that the supervisor accused the whistleblower of being a mentally unstable drug abuser in addition to revoking his security clearance for the offense of reporting that colleagues were allowed to leave work hours early and lie on their time cards.

After that, things apparently became personal. (Well, they were already personal, what with supervisors accusing the whistleblower of being crazy/on drugs.) The relationship between the employee and his supervisors went from bad to worse to toxic. The report says "several verbal altercations" were noted as the work relationship became "mutually hostile."

The Air Force then pulled some more crap, resulting in another whistleblowing attempt by the same employee. When told not to perform an asbestos test before drilling into walls to install surveillance equipment, the employee bypassed the proper channels (which had already proven useless and retaliatory) and went straight to the Inspector General.

Having been notified of this, the IG dug deeper, uncovering the Air Force's vengeful tactics. In response to the employee's report to the IG, the Air Force supervisor doubled down on his "crazy drug user" claims -- the ones he used in support of having the employee suspended and his security clearances revoked.

The supervisor justified that suspension by telling IG investigators that his subordinate “had difficulty getting along with fellow employees, that employees were afraid of Complainant and locked the office door because of that fear and that he suspected Complainant was using drugs.”

Citation please.

[T]he Inspector General concluded that the supervisor “could not provide any evidence to support these allegations,” and that the clearance revocation was reprisal.

The statement given by the retaliatory supervisor to explain away the lack of documented evidence supporting his "crazy drug user" claims is a joy to read, filled with multiple layers of truly-terrible CYA logic.

When queried as to why he did not document these "bizarre" behaviors in either the December 22, 2011, or April 29, 2012, memo to support Complainant's suspension, [redacted] testified he had been "hamstrung" on documenting anything because Complainant grieved everything that was documented. [Redacted] further testified he believed his chain of command did not want documentation of these things for fear that there would be complaints filed by Complainant. [Redacted] testified he received no support from the Civilian Personnel Office or his chain of command when it came to dealing with Complainant. [Redacted] testified [redacted] told him [redacted] that he had handled the issues regarding Complainant correctly; but he was going to order a CDI [Commander-Directed Investigation] to throw Complainant a bone and so, "maybe Complainant would not file a bunch of IG complaints."

That seems to have worked out well.

Not every whistleblower ends up without a career or investigated by the agency they work for, but far too many face this sort of response when calling out government wrongdoing. Efforts have been made to shore up protections for whistleblowers, but it's illustrative of where these efforts fall short to note that this employee -- a civilian -- would not have been protected by federal whistleblower laws. Perhaps that's why Air Force supervisors felt so comfortable acting in retaliation. The government routinely uses civilian contractors and is under no statutory obligation to behave any better when dealing with their whistleblowing than the Air Force did here.

Filed Under: defense department, dod, inspector general, nsa, proper channels, retaliation, whistleblowers

Obama Has Saved One Copy Of The Torture Report From Destruction, But What's Going To Happen To The Rest Of Them?

from the 'accidental'-incineration,-probably dept

Even if the White House won't declassify the full CIA Torture Report, at least we know one copy will be locked up in President Obama's archives for 12 years. That prevents Senator Burr and others from making the report disappear completely.

The White House copy isn't the only copy of the report, but at least we know where that one is. Other agencies have copies. Or had them. But they haven't read them. The CIA destroyed its copy of the report -- the sort of "accident" that often befalls damning reports in the hands of the agency targeted by them.

There's another copy sitting further up the hierarchy as well. Or is there? The Defense Department is supposed to have its own copy and as the department the CIA answers to, it should be doing what it can to ensure its copy doesn't disappear.

The Defense Department, however, may or may not have one -- depending on who you ask and when you ask it. Katherine Hawkins of Just Security notes that the DoD's copy -- if it even still exists -- won't be made a part of any public record anytime soon if it can help it.

Last week it emerged that the existence of the Defense Department’s copy is also in doubt. The chief prosecutor at the Guantanamo military commissions, Army Brig. Gen. Mark Martins, repeatedly refused to answer direct questions from the military judge about whether the Department of Defense still had its copy of the report. The Defense Department had acknowledged receipt of the full report in a court declaration in January 2015, and the U.S. government told both a federal court and the military commission judge that it would be preserved.

That was early last year, long before anyone inside the government was asking an outgoing president to declassify the report. That was also long before the Defense Department was having to discuss the existence of the document in court, thanks to the trial of alleged 9/11 attack mastermind Khalid Sheik Mohammed. Mohammed's attorney hinted that the document could very well vanish sometime after Inauguration Day and asked the presiding judge to push the DoD to preserve its copy as well.

Martins, however, refused to make any such promises, much less fully confirm the DoD's copy was still intact.

Nonetheless, asked whether DoD had kept its word and retained its copy, Martins repeatedly evaded the question, and finally replied, “I’m not prepared to answer the question. I can determine if there’s a way to find that information.”

Whatever that means.

Martins may not want the document to become part of the court record. Or it could mean Martins truly has no idea whether the DoD's copy is still intact. Either way, it's clear the Defense Department would rather not acknowledge the document's existence on the record. Fortunately, the judge has ordered the Defense Department to answer the question in writing within the next couple of days.

Hawkins points out that even if Obama doesn't want to declassify the document, he could at least make sure every other government agency with a copy takes care to preserve theirs as well.

Obama could remedy the situation by writing a letter to executive agencies instructing them to open the report and begin reviewing it for lessons learned, and replace any copies that were destroyed. The administration could also withdraw its opposition to detainees’ pending motions seeking preservation of the report as a court record in both the military commissions and habeas corpus cases.

As it stands now, all that has been guaranteed is the existence of a single copy -- the President's. And that one's just going to sit in his archives for the next dozen years, still out of reach of the general public.

Filed Under: cia, cia torture report, dod, history, president obama, torture, torture report

Pressure Mounts to Punish Russia For Hacking Without Evidence And Before Investigations Are Concluded

from the evidence-is-for-sissies dept

While it's certainly possible Russia has been busy using hackers to meddle in (or at least stoke the idiot pyres burning beneath) the U.S. elections, we've noted how actual evidence of this is hard to come by. At the moment, most of this evidence consists of either comments by anonymous government officials, or murky proclamations from security firms that have everything to gain financially from stoking cybersecurity tensions. Of course, transparent evidence is hard to come by when talking about hackers capable of false flag operations while obfuscating their footprints completely.

Granted that hasn't stopped people from demanding a cyber or real world attack on Russia, both idiotic ideas for what should be obvious reasons. But with no hard evidence forthcoming, those looking for perceived justice are apparently getting a little punchy. The Washington Post notes that the government continues to conduct an investigation into the DNC hacks, but the whole "obtaining actual evidence before doing anything stupid" thing is clearly frustrating the 1980's action movie sect of the intelligence community:

"The White House’s and some Cabinet officials’ insistence on awaiting the probe’s results has frustrated some officials at the FBI, the Justice Department and within the intelligence community, who favor holding Moscow accountable. The White House’s continued requests for more evidence, said one official, is “to delay — purposely delay” a public attribution."

Again, it's not like you're going to find a goddamned memo linking Russia to the DNC hacks, and any hacker worth his or her salt isn't going to leave evidence of the hack or their ties to a nation state. There's also the ongoing reality that the leading country when it comes to nation state hacking has generally been the United States, making any vocal moral repudiation kind of laughable. Still, that doesn't seem to be stopping folks like Senator Ben Sasse, who insists that we should just skip the whole actual evidence thing and proceed to lambasting Russia for doing what the United States has done for decades:

"Sen. Ben Sasse (R-Neb.), a member of the Homeland Security committee, said President Obama should publicly name Russia and do so before the November election. A failure to do so will only encourage further cyber intrusions and meddling in the U.S. election, he said.

“If the Obama administration has a reason for not clearly attributing these hacks to Russia, it contradicts their own cyber strategy,” Sasse said. “If they’re silent because it would invite response, that suggests that we’re operating from a position of weakness — in other words, we know that we need to aggressively deter cyberattacks, but we are too vulnerable to do it. Neither scenario is reassuring."

But again, what good is publicly shaming Russia for hacking when you've spent decades doing the same thing -- or worse? The only net outcome is you wind up looking like a giant, blithering hypocrite to the global community. The entire article stumbles on like this, quoting various officials on and off the record demanding we do everything from impose sanctions to start leaking Putin's dirty laundry:

"The National Security Agency, for instance, could disrupt a Russian computer system in a way that leaves no doubt who did it and that warns the Russians “to knock it off,” one former intelligence official said. Or the CIA could leak documents that are embarrassing in some way to Russian President Vladi­mir Putin."

Attack! Attack! Who needs evidence? Who needs the moral high ground? Generally, the press-driven public dialogue on cybersecurity and intelligence is so far from what's actually happening in the wild (as intelligence whistleblowers illustrate every few years) that one really should treat press reports on the subject as creative fiction. Combine that with the way nationalism leads to hypocrisy and the fact that most of these "former intelligence officials" don't even know what a gigabyte is, and you've got a recipe for keystone-cops-esque high comedy.

Again, none of this is to suggest that Russia isn't hacking the United States. But to ignore that all nation states are hacking each other all the time is myopic, and suggesting the DNC attack constitutes some rare breach of international ethics is hysterically naive given what we know about the States' own hacking attacks. The real danger here remains the threat of false flag hacking attacks and misinformation campaigns designed to prompt countries to dramatic action without substantive proof. The smarter path is to focus this energy on securing, upgrading and patching government systems to protect against intrusion, even though that's certainly a lot less fun than starting a new world war just because you think hard evidence is for sissies.

Filed Under: cybersecurity, dod, doj, hacking, politics, response, russia, us government

Defense Department Issues Opsec Guidelines For Safe And Secure Pokemon Hunting

from the pokemon-go:-now-literally-played-by-everyone dept

Given the cultural phenomenon that is Pokemon Go, it was only a matter of time before security-conscious government agencies would be forced to confront the inevitable: that their employees would be joining in the quasi-AR madness.

Kristan J. Wheaton of the Sources and Methods blog was handed an apparently official document from the Defense Department that lays down several common sense rules for employees throwing imaginary balls at imaginary creatures. (A screenshot of the original document can be seen in Thomas Rid's tweet, embedded at the bottom of this post.)

One of my contacts (Thanks!) within the intel community put together a tip sheet for friends and family and, having read it, it sounds like good advice for anyone who wants to play Pokemon Go with a reasonable level of safety and privacy. Remember, it is a tip sheet and is designed to be helpful, not comprehensive. If it is not covered here, just remember D²S² – Don’t Do Stupid Stuff.

Considering the source, the list of do's and do not do's is straightforward and on point. And, as Wheaton points out, good advice for anyone playing the game, not just those with high-level security clearances chasing down rarities behind CIA filing cabinets.

In short, make sure you're downloading the authentic application, be aware your location will be recorded, and -- more importantly, given the nature of DoD components -- the photos taken during Pokemon hunts might accidentally reveal something meant to stay hidden.

Be mindful of your surroundings when using this augmented reality (AR) mobile game, especially when taking pictures of Pokemon during the capture process. Note what's in the foreground and background, including reflective surfaces and information revealing identity and or location (street signs, vehicle license plates, Government buildings, etc.). Disabling AR makes Pokemon easier to catch! The location where you take a picture of a Pokemon is also likely embedded in the picture's metadata.

In addition, the DoD suggests employees use something other than their personal Google account to log in and to select usernames that do not reflect their IRL names.

Some classic military-industrial complex paranoia surfaces in the penultimate bullet point, however.

When physically visiting Pokestops and gyms, maintain awareness of your surroundings. Travel with a buddy or remain in your vehicle with the doors locked. It is not necessary to physically enter the real-world establishment where a Pokestop or gym is located, you may be able to interact with the Pokestop/gym from the curb or even across the street.

While there have been reports of strongarm robberies at bogus Pokestops, the whole "situational awareness" vibe adds far more cloak-and-dagger than seems absolutely necessary.

The full list at Wheaton's blog is worth a read, though, whether you're a normal citizen or a DC insider neck deep in redacted drone strike reports/Rattatas.

Filed Under: defense department, dod, opsec, pokemon, pokemon go

Air Force, Lockheed Martin Combine Forces To 'Lose' 100,000 Inspector General Investigations

from the Up-in-the-air!-Into-the-wi34dz.eea.3rdek))we$#21....-[A]BORT,-[R]ETRY,-[F]AIL dept

In an era where storage is insanely cheap and the warning to schedule regular backups has been ringing in the ears of computer users for more than four decades, there's seemingly no explanation for the following:

The U.S. Air Force has lost records concerning 100,000 investigations into everything from workplace disputes to fraud.

A database that hosts files from the Air Force’s inspector general and legislative liaison divisions became corrupted last month, destroying data created between 2004 and now, service officials said. Neither the Air Force nor Lockheed Martin, the defense firm that runs the database, could say why it became corrupted or whether they’ll be able to recover the information.

The Air Force didn't lose investigations dating back to the mid-60s and stored on archaic, oddball-sized "floppies." It lost more than a decade's-worth of investigatory work -- from 2004 going forward, right up to the point that Lockheed discovered the "corruption" and spent two weeks trying to fix before informing its employer. At which point, the USAF kicked it up the ladder to its bosses, leaving them less than impressed.

In a letter to Secretary James on Monday, Sen. Mark Warner, D-Va., said the lost database “was intended to help the Air Force efficiently process and make decisions about serious issues like violations of law and policy, allegations or reprisal against whistleblowers, Freedom of Information Act requests, and Congressional inquiries.”

“My personal interest in the [Inspector General’s] ability to make good decisions about the outcomes of cases, and to do so in a timely manner, stems from a case involving a Virginia constituent that took more than two years to be completed, flagrantly violating the 180-day statutory requirement for case disposition,” Warner wrote.

Some notification is better than no notification, even if the "some" notification is extremely minimal and arrives well after the fact. Senator Warner remains underwhelmed.

“The five-sentence notification to Congress did not contain information that appeared to have the benefit of five days of working the issue,” Warner wrote.

The Air Force says there's no evidence of malicious intent, as far as it can tell. But there's also no evidence of competence. Why is it that files related to oversight of a government agency have no apparent redundancy? It's small details like these that show the government generally isn't much interested in policing itself.

If anything's going to be recovered, it's going to be Lockheed's job, and it's already spent a few weeks trying with little success. There may be some files stored locally at bases where investigations originated, but they're likely to be incomplete.

While I understand the inherent nature of bureaucracy makes it difficult to build fully-functioning systems that can handle digital migration with any sort of grace, it's completely incomprehensible that a system containing files collected over the last decade would funnel into a single storage space with no backup. It's one thing if this was just the Air Force's fault.

But this is more Lockheed's fault -- and despite its position as a favored government contractor -- it's also known for its innovation and technical prowess. Neither of those qualities are on display in this public embarrassment. And if it can't recover the data, it's pretty much erasing more than a decade's-worth of government mistakes, abuse, and misconduct. And while no one's going to say anything remotely close to this out loud, there has to be more than a few people relieved to see black marks on their permanent records suddenly converted to a useless tangle of 1s and 0s.

Filed Under: air force, corrupted hard drive, dod, inspector general, investigations
Companies: lockheed martin

Defense Department Screws Over FOIA Requester Repeatedly, Blames Him For 'Breaking' The FOIA Process

from the the-other-FOIA-terrorist dept

The FOIA system is broken. The administration pays lip service to transparency while aggressively deploying exemptions. Agencies routinely complain about FOIA response budgets and staffing levels, yet no one seems motivated to fix this perennial issue. FOIA reform efforts moving forward with bipartisan support are repeatedly killed after receiving pushback from the White House.

Then there's this: a single requester is being blamed for a backlog of FOIA requests at an agency that's never underfunded -- the Department of Defense.

According to its "Chief Freedom of Information Act Officer Report," Nick Turse is the US citizen who has managed to bring the slowly-moving DoD FOIA machinery to a complete halt.

The report, for instance, laments that “despite their best efforts to provide helpful details, great customer service and efficient responses,” some DOD components were “still overwhelmed by one or two requesters who try to monopolize the system by filing a large number of requests or submitting disparate requests in groups which require a great deal of administrative time to adjudicate.” The study went on to call out:

"[o]ne particular requester [who] singlehandedly filed three requests with SOUTHCOM [U.S. Southern Command], 53 requests with AFRICOM, 35 requests with SOCOM [Special Operations Command] and 217 requests with OSD/JS [Office of the Secretary of Defense/ Joint Staff] for a total of 308 cases this fiscal year alone. For AFRICOM, this represents 43 percent of their entire incoming requests for the year and 12 percent for SOCOM. This requester holds over 13 percent of the currently open and pending requests with OSD/JS and over the past two years has filed 415 initial requests and 54 appeals with this one component."

If this seems like a lot of requests from one person, it isn't. This is the way the system works. Agencies routinely delay responses (Turse has been waiting more than four years for responses to some of his FOIA requests) when not redacting them to uselessness, forcing requesters to make multiple requests for the same information or related documents, in hopes of actually receiving some information in response to their information requests.

The percentages may seem high, but AFRICOM isn't exactly a popular FOIA target. This focus relates to Turse's ongoing investigative reporting on abusive behavior by US soldiers stationed at bases in Africa. What he has managed to uncover so far isn't pretty, and his reporting on it has won him no friends in the Pentagon.

I made, for instance, a couple hundred attempts to contact the command for information, comment, and clarification while working on an article about criminal acts and untoward behavior by U.S. troops in Africa — sexual assaults, the shooting of an officer by an enlisted man, drug use, sex with prostitutes, a bar crawl that ended in six deaths. Dozens of phone calls to public affairs personnel went unanswered, countless email requests were ignored.

At one point, I called [DoD Chief of Media Engagement Benjamin] Benson, the AFRICOM media chief, 32 times on a single business day from a phone line that identified me by name. He never picked up. I then placed a call from another number so that my identity would be concealed. He answered on the second ring. Once I identified myself, he claimed the connection was bad and the line went dead.

[...]

Today, when I write to the current AFRICOM public affairs chief, Lt. Cmdr. Anthony Falvo, I receive similar treatment. I often get a return receipt back that tells me my email to him “was deleted without being read.” This happened to me, for example, on Thursday, September 10, 2015; Friday, October 2, 2015; Tuesday, October 6, 2015; Thursday, November 5, 2015; Friday, November 27, 2015; Wednesday, February 10, 2016 … you get the picture.

That the DoD finds itself swamped by Turse's requests is its own fault. Had it simply returned the requested documents in a timely fashion, it would not have this Turse-centric backlog to complain about. Now, it's using an official report to portray the FOIA process as unnecessarily burdensome on the government and prone to abuse by tenacious citizens. This portrayal is not only false, but it obscures the fact that the DoD still controls every interaction with FOIA requesters. It has held Turse at arms length for several years and now it won't even answer his emails and phone calls regarding requests it has yet to answer. But in its report, it complains that it's Turse that has broken the system, rather than this being the FOIA system's natural state: that it only works as well as responding agencies want it to.

Filed Under: africom, defense department, dod, foia, nick turse

Silk Road 2.0 Court Docs Show US Government Paid Carnegie Mellon Researchers To Unmask Tor Users

from the you-can-browse-privately,-just-don't-expect-your-privacy-to-hold-up-in-court dept

Rumors that the US government used a university's research institute to uncloak Tor users began floating around nearly two years ago. In July of 2014, the first hint that something weird was going on at Carnegie Mellon took the form of a hastily-cancelled Black Hat Conference talk on the subject of de-anonymizing Tor users. Carnegie Mellon's lawyers stepped in and called the whole thing off at the last minute. The thought process at the time was that CMU's legal team may have been concerned the researchers' actions had broken wiretap laws.

Nearly a year-and-a-half later, hints were dropped that CMU's Tor-related efforts may not have been for research purposes only. An anonymous tipster claimed the FBI had paid CMU $1 million to unmask Tor users. A quasi-confirmation popped up during the DOJ's prosecution of Brian Ferrell, who was allegedly assisting Blake Benthall in running Silk Road 2.0. Ferrell and Benthall were both swept up in the wake of a Tor-related FBI raid known as "Operation Onymous," which began a few months after the hastily-cancelled Black Hat talk.

Included in the information handed over to Farrell's legal representative was the following:

On October 13, 2015, the government provided defense counsel a letter indicating that Mr. Farrell’s involvement with Silk Road 2.0 was identified based on information obtained by a “university-based research institute” that operated its own computers on the anonymous network used by Silk Road 2.0.

Tor Project itself claimed it had noticed a series of attacks during the first six months of 2014, seemingly aimed at de-anonymizing users. The unmasking efforts it noticed occurred shortly before the FBI Silk Road 2.0 raids. All of this was disturbing but also very circumstantial. Both CMU and the FBI (very weakly) denied any involvement in the unmasking effort. Notably, both parties only specifically denied the payment aspect, with CMU reps saying they "were not aware of any payment" and the FBI stating the allegation it had paid CMU $1 million was "inaccurate" -- which is not nearly the same thing as saying the allegation was false.

Three months after the FBI rumor/tip, the government's use of CMU to de-anonymize Tor users has been confirmed. The only aspect that appears to be incorrect is the agency behind the effort. Joseph Cox at Motherboard has the details.

[B]oth the name of the university and the existence of a subpoena have been confirmed in a recent filing in one of the affected criminal cases.

“The record demonstrates that the defendant's IP address was identified by the Software Engineering Institute (“SEI”) of Carnegie Mellon University (CMU”) [sic] when SEI was conducting research on the Tor network which was funded by the Department of Defense (“DOD”),” an order filed on Tuesday in the case of Brian Farrell reads. Farrell is charged with conspiracy to distribute cocaine, heroin, and methamphetamine due to his alleged role as a staff member of the Silk Road 2.0 dark web marketplace.

“Farrell's IP address was observed when SEI was operating its computers on the Tor network. This information was obtained by law enforcement pursuant to a subpoena served on SEI-CMU,” the filing continues.

So, the DoD "hired" CMU researchers to find ways to unmask Tor users. It's probably worth noting here that the NSA... is a part of the DoD. The FBI was not directly involved, as alleged earlier, nor did it hand $1 million to CMU to facilitate its efforts. However, it was Johnny-on-the-Spot when it came to issuing subpoenas for Tor user info. Not that it's interested in discussing its fortuitous timing…

When asked how the FBI knew that a Department of Defense research project on Tor was underway, so that the agency could then subpoena for information, Jillian Stickels, a spokesperson for the FBI, told Motherboard in a phone call that “For that specific question, I would ask them [Carnegie Mellon University]. If that information will be released at all, it will probably be released from them.”

The buck has been passed, but CMU refuses to touch it.

Kenneth Walters, a spokesperson from CMU, told Motherboard in an email, "We have nothing to add beyond our Nov. 18 statement."

This statement says nothing more than CMU receives subpoenas from time to time and hints that everybody is probably wrong about everything because "inaccurate media reports."

Farrell's lawyers have tried to obtain more details on CMU's DoD-funded de-anonymization efforts, but the judge has denied further discovery along these lines. Judge Richard A. Jones, echoing the judge presiding over the FBI's now-infamous "Playpen" case (where the FBI ran a seized child porn site as a honeypot for two weeks), says there's no expectation of privacy in an IP address, even if said IP address was obscured by the use of Tor.

“SEI's identification of the defendant's IP address because of his use of the Tor network did not constitute a search subject to Fourth Amendment scrutiny,” the order reads.

In short, there's no expectation of privacy in the use of a service specifically designed to protect users' privacy. Users may believe they have an expectation of privacy but it's a belief that won't be upheld by this nation's courts. Efforts made by the government to strip this protection away are not viewed as intrusive -- at least not in the Fourth Amendment sense of the word.

So, nearly two years later, the story coheres: the Department of Defense has been seeking ways to unmask Tor users with the assistance of CMU's researchers. And all the while, the FBI has apparently been looking over the DoD's shoulder and firing off subpoenas. No one involved wants to talk about it and now it appears they won't have to, thanks to Judge Richard Jones.

Filed Under: anonymity, defense department, dod, fbi, tor, unmasking
Companies: carnegie mellon, silk road 2.0

Documents Show 1033 Program Still Resulting In Lots Of Lost Weapons And Other Abuse

from the surely-you-can-trust-a-few-thousand-cops? dept

The Pentagon's 1033 program is a case study in unintended consequences. The idea -- put military equipment back into service rather than simply scrapping it -- has some merit. The actual deployment has been a nightmare.

The Dept. of Defense wondered who could possibly make use of military weapons, armor and vehicles, and came to an almost-logical conclusion. Law enforcement agencies became the military's little brother, taking ownership of cheap/free hand-me-downs and putting them to use in the War at Home.

Of course, a militaristic mindset evolved to match the acquired gear. Police departments became armies and citizens, combatants. Worse, the program was badly mismanaged and subject to very little oversight. The DoD had no idea how much equipment it had dispensed and the agencies on the receiving end weren't much better at tracking their own inventories.

Shawn Musgrave has obtained two mostly-depressing spreadsheets from the Dept. of Defense listing law enforcement agencies which are currently suspended from the program, or have been in the past. He sent this "expedited request" during the Ferguson fallout, during which the DOJ itself expressed concern about the military aura the local PD projected. Not that the Pentagon's Defense Logistics Agency cared about the timeliness of its response. 14 months after issuing his "please hurry" request, the DLA has finally responded.

The lists contain plenty of suspensions for lost weapons, which possibly means military-grade weapons are in the hands of private citizens. The lists also contain intriguing redactions and a few moments of WTF-ness.

For instance, an Arkansas county coroner's office is participating in the program for reasons unknown. It could be that it only used the program to obtain harmless office equipment, but if so, it seems these sorts of acquisitions -- no matter how badly handled or poorly inventoried -- would not result in a suspension. The question of why it was suspended remains unanswered.

Reason can not be released at this per State Coordinators request.

And the state of North Carolina appears to have gone rogue. Among the many agencies listed as "terminated" by the DLA is the state's Parks and Recreation department.



North Dakota is possibly headed for a bloodbath, seeing as its Highway Patrol has misplaced a street gang's-worth of weapons.

DURING PCR ON JULY 23, 2013, 159 WEAPONS WERE UNABLE TO BE ACCOUNTED FOR BY A SIGNED CUSTODY RECEIPT

And one wonders how this sort of situation arises, considering the logistics required to make it happen in the first place. (Richland County Sheriff's Office, South Carolina)

Misappropriation of aircraft

The list of agencies no longer suspended from the program isn't exactly heartening. The Searcy (AR) Police Dept. is back in the DLA's good graces despite the ATF serving a search warrant for its (former) police chief.


And we discover that the Richland County Sheriff's Office isn't the only South Carolina agency to abuse 1033 aircraft.


Many of those on the "Unsuspended" list have never recovered weapons they reported as lost or stolen, but have been designated by the Office of the Inspector General as "cold cases." Once the trail goes dead, so does the suspension, apparently.

In other oddities, it appears the entire state of Montana took a year off from performing required 1033 inventories and the nation's biggest, baddest police force -- the NYPD -- faced (briefly) the threat of termination for reasons not detailed in the responsive documents.

So, in other words, it's business as usual for the 1033 program. Even those "responsibly" partaking in the program are loading up with military gear which they then deploy against combatants citizens in war zones their communities.

Filed Under: 1033, dod, lost weapons, militarized police, oversight, police, police militarization, weapons

DOD Was Apparently Sending Trademark Notices To Veterans Groups Over Military Seals

from the stop-supporting-our-troops! dept

Honor our troops and veterans. It’s something we hear a lot, especially in times of war. And while our troops and vets certainly do deserve to be honored, it appears the DOD hasn’t gotten the memo.

Yes, apparently the DOD has been sending out C&D notices over government trademarks on military seals to veterans groups who will be using them on Memorial Day to celebrate the nation's veterans. This is happening enough, in fact, that it caught the attention of Congress, which sent a letter to the Secretary of Defense essentially asking what the hell the DOD was thinking.

Dear Secretary Carter:

We were disturbed to learn that the Department of Defense has been sending cease-and-desist letters to veterans groups alleging trademark infringement for their use of official military seals to indicate, celebrate, and honor the various military departments they served. Honoring our nation's veterans should not require veterans' organizations to seek a trademark license from DOD. For example, the United Veterans Council of Santa Clara County (UVC) received a cease-and-desist letter for their use of official seals that indicated the departments they were honoring on a flyer for their Memorial Day observance - the flyer is enclosed for your review. The UVC also uses these seals on parade banners and other parade materials and has done so for 97 years without issue. It appears that other veterans' organizations have also received such letters.

It is difficult to understand the legal basis, never mind the logic of the DOD threatening any non-profit veterans group with trademark liability for using official seals to honor our nation's veterans.

The letter goes on to suggest that the DOD issue a one-time waiver for all vets groups to use the official seals on Veterans Day or any other patriotic events for the rest of the year. Which is all well and good...but what the hell? There is simply zero trademark issue here, never mind anything that the DOD would actually take action on. Imagine the DOD dragging a veterans group to court over trademarked military seals. Seals used by non-profit vets groups that aren't engaged in any commerce, never mind commerce competing with the Department of Defense.

I'll echo the letter's hope that this whole thing happened due to some overzealous DOD people at very low levels who didn't really know what they were doing, because if this actually had support of the higher ranks, we have a serious level of stupid in the DOD.

Filed Under: dod, military, trademark, veterans

Government Accountability Offices Finds Government Still Mostly Terrible When It Comes To Cybersecurity

from the can't-even-secure-a-filing-cabinet,-apparently dept

The government has done a spectacularly terrible job at protecting sensitive personal information over the past couple of years. Since 2013, the FDA, US Postal Service, Dept. of Veterans Affairs, the IRS and the Office of Personnel Management have all given up personal information. So, it's no surprise the Government Accountability Office's latest report on information security contains little in the way of properly-secured information.

It opens with this depressing graph, showing just how many agencies flunked its information security controls assessment. Keep in mind that it only surveyed 24 agencies.

But what's most concerning about the report (which is full of concerning conclusions) is that, in an era of cyber-everything, the most common "security incidents" have nothing to do with phishing, security holes or any other cyber-related threat. They have to do with people and the mishandling of dead tree byproducts.


Non-cyber incidents are defined by the GAO as:

...a report of PII [personally-identifiable information] spillage or possible mishandling of PII that involves hard copies or printed material as opposed to digital records.

The GAO reports that security incidents have skyrocketed over the past eight years, from 5,500 in 2006 to nearly 70,000 last year.


It also notes that incidents involving personally-identifiable information have increased steadily as well.

[T]he number of information security incidents involving PII reported by federal agencies has more than doubled in recent years, from 10,481 in 2009 to 27,624 in 2014.

It all adds up to something fairly disturbing. Not only are government agencies increasingly under attack from outside forces, but their internal handling of hard-copy PII is getting worse as well -- even if the percentage of non-cyber incidents has declined over the past five years.

And despite the government's increased focus on all things cyber, the first chart makes it clear there has been almost no improvement in information security controls since 2013.

It also appears as though there's only one agency taking the GAO's past recommendations seriously: the Department of Defense.

OMB established a fiscal year 2014 target of 75 percent implementation for strong authentication. In its report on fiscal year 2014 FISMA implementation, OMB indicated that the 24 federal agencies covered by the CFO Act had achieved a combined 72 percent implementation of these requirements, but this number dropped to only 41 percent implementation for the 23 civilian agencies when excluding DOD.

Obviously, overhauling security controls in a large number of agencies is an enormous undertaking. But this low level of implementation is both frightening and pathetic. The government demands large amounts of personal information from citizens, as well as from its employees and job applicants. There's no opting out. Then it takes this information and provides only the most perfunctory of protections. Government agencies clearly can't be trusted with securing this information, but there's no option other than to submit and hope for the best. It's even more disheartening when you realize that some of these directives that still haven't been fully complied with have been in place since 2002.

The government asks for too much and provides too little in return. Multiple agencies want to be the "ground force" in the cyberwar. But until the homefront is secured, it seems unwise to deploy elsewhere.

Filed Under: cybersecurity, dod, gao, government, nsa