Thank Snowden, As NSA Estimates He Singlehandedly Sped Up Encryption Adoption By 7 Years

from the thank-you-ed dept

As part of our funding campaign for our coverage of encryption, we reached out to some companies that care about these issues to ask them to show their support. This post is sponsored by Golden Frog, a company dedicated to online privacy, security and freedom.

---

James Clapper, Director of National Intelligence, is claiming that, according to NSA estimates the Snowden revelations sped up the adoption rate of encryption by 7 years. Apparently, that's based on NSA estimates of the adoption curve of encryption. As reported by Jenna McLaughlin at the Intercept:

“As a result of the Snowden revelations, the onset of commercial encryption has accelerated by seven years,” James Clapper said during a breakfast for journalists hosted by the Christian Science Monitor.

The shortened timeline has had “a profound effect on our ability to collect, particularly against terrorists,” he said.

When pressed by The Intercept to explain his figure, Clapper said it came from the National Security Agency. “The projected growth maturation and installation of commercially available encryption — what they had forecasted for seven years ahead, three years ago, was accelerated to now, because of the revelation of the leaks.”

Of course, it's worth noting that, in the past few months, it seemed as if the NSA and the intelligence community was moving away from its kneejerk hatred of encryption, pushing back against the FBI's argument that we need to backdoor encryption. But, apparently they're not willing to go quite this far. Basically, the NSA wants strong encryption out there, but it doesn't really want you to use it.

Asked if that was a good thing, leading to better protection for American consumers from the arms race of hackers constantly trying to penetrate software worldwide, Clapper answered no.

“From our standpoint, it’s not … it’s not a good thing,” he said.

Yup. James Clapper would prefer that the American public be less safe by not using encryption, rather than protecting their digital lives.

Of course, many other people do think it's a very, very good thing. Including Ed Snowden:

Of all the things I've been accused of, this is the one of which I am most proud. https://t.co/1qybuvnmpt https://t.co/yoAF71KFXc

— Edward Snowden (@Snowden) April 25, 2016

So, the guy in the US government is upset that the public is more safe, and the guy that people want to accuse of being a traitor is proud of helping Americans to better protect themselves. Maybe we ought to reverse their roles...

---

VyprVPN from Golden Frog is the world's fastest highly-secure VPN.
Get 25% off VyprVPN now »

Filed Under: edward snowden, encryption, james clapper, nsa, sponsored post

House Reps To James Clapper: No, Really, Stop Ignoring The Question And Tell Us How Many Americans Are Spied On By NSA

from the get-to-it dept

Way back before Ed Snowden became a household name, Senator Ron Wyden kept pushing James Clapper, the Director of National Intelligence, to reveal more details on how the NSA was interpreting certain provisions in the PATRIOT Act to spy on Americans. You probably recall the infamous exchange in a 2013 Senate hearing in which Wyden asked Clapper "does the NSA collect any type of data at all on millions or hundreds of millions of Americans?" and Clapper said "No sir... not wittingly." Snowden himself later noted that this particular exchange was part of what inspired him to leak documents to reporters just a couple months later.

However, that question had some history. Two years earlier, in 2011, we wrote about James Clapper's ridiculous response to a letter from Wyden about this topic. Wyden had asked Clapper to answer some questions about NSA authorities to collect information on Americans and Clapper had refused to answer on the basis of he didn't really want to.

A year later, in the summer of 2012, Wyden got more explicit, saying that he would block the FISA Amendments Act until Clapper gave an estimate of how many Americans had their information sucked up by the NSA. This time, Clapper responded in December of 2012 by saying that it would be impossible to actually say how many Americans had their information scooped up by the NSA. We now know why -- because six months later, Ed Snowden revealed the answer to be "basically everyone." But in December, Clapper sent a letter saying to Wyden:

We cannot provide additional answers to your questions in an unclassified format. Rather than provide you with imprecise, unclassified information, I reiterate our offer to meet with you -- and any other Members of Congress -- in a classified setting to discuss these authorities and answer any questions you might have.

Wyden (along with a few other Senators) pointed out that their question shouldn't reveal anything classified:

First, we asked if any entities have made any estimates -- even imprecise estimates -- about how many US communications have been collected under section 702 of the FISA statute (which is the central provision of the FISA Amendments Act). You did not answer this question. Please provide an answer. We would expect this answer to be unclassified, but if you disagree please provide your reasons for keeping this answer secret.

Second, we asked if it was possible to estimate the order of magnitude of this number. (For example, is the number of US communications collected under section 702 closer to 100. or 100.000. or 100 million?) You did not answer this question directly, however the Director of the NSA has made public statements that appear to estimate this order of magnitude. Specifically, the NSA Director has said that "the story that [the NSA] has millions or hundreds of millions of dossiers on people is absolutely false." Please explain whether this statement should be understood to mean that the number of US communications collected under section 702 is less than "millions or hundreds of millions." Since the NSA Director made this statement publicly, we would expect this answer to be unclassified as well.

Third, we asked if any wholly domestic American communications had been collected under section 702 authorities. Your response was classified. We do not understand how simply stating whether any wholly domestic communications have been collected under section 702 authorities would have any impact at all on US national security interests. if you believe that it would, please explain why. And if you agree that it would not, please provide an unclassified answer to this question.

Fourth, we noted that the FISA Amendments Act does not prohibit searching through communications collected under section 702 to find the communications of particular Americans, and asked if the US government has ever attempted to search for the communications of a specific American in this way without a warrant or emergency authorization. Your response was classified. We do not understand how providing a 'yes' or 'no' answer to this question would impact US national security interests in any way, and we ask that you provide an unclassified response.

Eventually, after getting a lot of pressure from other Senators, Wyden agreed to lift his hold on the bill. At first he offered an Amendment saying he would lift the hold if only the NSA would release a number about how many Americans had their information collected by the NSA. However, with folks like Dianne Feinstein and Saxby Chambliss screaming about how terrorists would blow up everything if the spying didn't continue, the bill eventually passed.

And while some tried to bravely follow up on the questions raised by Wyden, once the bill passed there was no legislative leverage any more -- and nothing much happened. It was just a couple months later that Wyden asked his now famous question and Snowden released his documents.

But a bunch of Representatives on the other side of the Capitol, all members of the House Judiciary Committee, have realized that James Clapper has still never answered the question, and thus they've now sent him a letter, asking him to finally answer at least some sort of question concerning how many Americans have their data sucked up by the NSA:

In order that we may properly evaluate these programs, we write to ask that you provide us with a public estimate of the number of communications or transactions involving United States persons subject to Section 702 surveillance on an annual basis.

We note that we are not the first to ask you for this basic information. Since at least 2011, Senators Ron Wyden and Mark Udall have "sought repeatedly to gain an understanding of how many Americans have had their phone calls or emails collected and reviewed under this statute, but [they] have not been able to obtain even a rough estimate of this number."

They also note that the PCLOB -- the Privacy and Civil Liberties Oversight Board -- that looked into the big NSA surveillance programs suggested that the NSA should reveal this number -- and the NSA and Clapper have ignored this recommendation. As the Reps note, they recognize that Clapper is "reluctant" to provide such information, but...

First, we understand that an exact count of how many United States persons have been swept up into Section 702 surveillance efforts may not be feasible. The leadership of the intelligence community has long held this View, and the Inspector General for the National Security Agency--who is an administrative appointee, and not an independent inspector general--has deferred to your office on this issue. We understand that limited resources and technical barriers may prevent you from making an exact count.

We are not asking you for an exact count. Today, our request is simply for a rough estimate.

You have already demonstrated that such an estimate is feasible. An October 3, 2011 opinion of the Foreign Intelligence Surveillance Court reports that the NSA, in an effort to address the court's concerns about the collection of domestic communications under certain applications of Section 702, "conducted a manual review of a random sample consisting of 50,440 Internet transactions taken from the more than 13.25 million Internet transactions acquired through upstream collection during a six month period." In that case, the court found:

NSA knows with certainty that the upstream collection . . . results in the acquisition of wholly domestic communications.

By expanding its Section 702 acquisitions to include the acquisition of Internet transactions through its upstream collection, NSA has, as a practical matter, circumvented the spirit of [the statute] with regard to that collection.

That case looked at a particular problem with "upstream" collection. A similar but broader analysis may be necessary here. We are willing to work with your office to determine the exact methodology for such a survey. We acknowledge that this estimate will be an imperfect substitute for a more precise accounting--but surely the American public is entitled to some idea of how many of our communications are swept up by these programs.

The letter also addresses another argument that the NSA made previously in response to Wyden's questions: claiming that (get ready for this one) the process to figure out how many Americans' privacy had been violated would... violate their privacy. It's a dumb argument, but perhaps not quite as dumb as it sounds. In short, the NSA wants to argue that it's not doing anything wrong in collecting this information, so long as the searches on the data are within the bounds of the law and the Constitution. Yet, because of that, they want to argue that doing the search to count the records would potentially violate the restrictions on when they can search the data. See? They can't tell you if your privacy has been violated, because to do so would violate your privacy!

In some ways, this is kind of a middle finger to the civil liberties crowd. It's the NSA's smirking response of "see? we can't tell you how much data we have because you put these privacy restrictions on how we can use that data -- and we take your privacy seriously."

But this letter addresses that concern as well, saying that basically no one thinks a "one-time" search solely for the purpose of counting violates anyone's privacy:

Second, we understand that producing an estimate might require reviewing actual communications acquired under Section 702, which could itself raise privacy concerns. On this point, we refer you to the judgment of the many civil liberties organizations that support conducting "a one-time, limited sampling of these communications," if necessary. They believe it would be "a net gain for privacy if conducted under appropriate safeguards and conditions." We agree, and we are willing to work with your office to implement those safeguards if necessary. This, too, is a problem we can solve.

And, finally, they close with a stick, reminding Clapper that this entire program is scheduled to sunset at the end of December, 2017, and if he wants the FISA 702 program (which covers both PRISM and upstream collection) to continue, he might want to actually respond.

The letter is then signed by 14 members of the House Judiciary Committee. It's not everyone, but it's a pretty good list of folks, including some of the more powerful members, including ranking member John Conyers and the author of the PATRIOT Act and the USA Freedom Act, Jim Sensenbrenner. Other signatories include Reps. Zoe Lofgren, Darrell Issa, Blake Farenthold, Jason Chaffetz, Jim Jordan, Ted Deutch, Suzan Delbene, Ted Poe, Hank Johnson, Jerry Nadler and David Cicilline. This is not just a pointless letter dashed off by one or two Reps. It's a big chunk of the Judiciary Committee (less than half, but still a significant amount).

I'm sure that Clapper will do his best to avoid actually answering, but at the very least it sets up what appears to be the next big fight on the horizon: over the renewal of Section 702.

Filed Under: estimates, james clapper, mass surveillance, nsa, numbers, ron wyden, section 702

'Trust Us With More Data,' Say Government Agencies Hacked By A 16-Year-Old

from the the-best-defense-is-calls-for-encryption-bans,-apparently dept

We live in a world where a 16-year-old who goes by the handle of "penis" on Twitter can dive into the servers of two of America's most secure federal agencies and fish out their internal files.

This 16-year-old is allegedly part of the same crew that socially engineered their way into the inboxes of CIA director John Brennan, Director of National Intelligence James Clapper and the administration's senior advisor on science and technology, John Holdren.

We also -- somehow -- live in a world where these same agencies are arguing they should be entrusted with massive amounts of data -- not just on their own employees, but on thousands of US citizens.

The DHS, FBI and NSA all want more data to flow to them -- and through them. The cybersecurity bill that legislators snuck past the public by attaching it as a rider to a "must pass" appropriations bill contains language that would allow each of these affected agencies to partake in "data sharing" with private companies. This would be in addition to the data these agencies already gather on American citizens as part of their day-to-day work.

The DHS -- one of the more recent hacking victims -- is the only agency that expressed a reluctance to partake in the new data haul. This isn't because it wouldn't like to have access to the data, but because it would be the agency responsible for "scrubbing" the data before passing it on to other agencies. DHS officials likely took a look at this requirement and saw it for what it was: a scapegoat provision. Should any legal action or public outcry have resulted from the new "sharing" demands, the DHS would have been the agency offered up to appease the masses.

Fortunately for the DHS -- but less fortunately for anyone concerned about expanding domestic surveillance efforts -- this requirement has been altered. A bit. The Attorney General will now examine the DHS's "scrubbing" efforts and determine whether or not they're Constitutionally adequate. Of course, the Attorney General is more likely to side with whatever level of scrubbing provides the maximum flow of data to underling agencies like the FBI, so that's not all that reassuring. On the other hand, it puts the AG in the crosshairs should something backfire.

This is the government that feels it can protect the nation from hackers: the government that can't protect itself from hackers.

The IRS seems to suffer from attacks almost daily, thanks to its treasure trove of social security numbers, addresses and other personally identifiable information. The OPM -- which oversees federal hiring -- coughed up plenty of the same personal info when it was hacked.

The agencies involved in the cybersecurity efforts have shrugged at the government's inability to protect personal information, arguing that these hacks only highlight how essential the new cybersecurity legislation is. More power and more data is what's needed, apparently, not an internal effort to shore up security before foisting their demands on the private sector. The government can't protect itself against politically-motivated teenagers. What chance does it have against organized criminals or state-sponsored attacks?

It's insanity. It's like hearing Wal-Mart claim -- after a large data breach -- that the best way to ensure this doesn't happen in the future is to allow it to store customer data collected by its competitors as well. Why make criminals and hackers work harder? Why not house as much data as possible in fewer locations?

To make matters worse, agencies like the FBI and NSA are pushing for greater offensive capabilities, all the while claiming they're very interested in defending the nation against cyberattacks. The two efforts are at odds. One side needs security holes to exploit. The other side needs holes closed as quickly as possible. Even without access to black book budgets, one can easily assume the offensive side will be receiving the majority of funding and manpower. When a vulnerability is discovered, who decides how it's used: the fixers or the exploiters?

The NSA thinks there's no inherent friction in playing both sides. It has decided -- against the recommendations of the President's Review Group -- to merge its defensive and offensive cybersecurity wings. The NSA is the only entity that doesn't see this as a problem. Nicholas Weaver, writing for Lawfare, explains exactly why it shouldn't be doing this.

[T]he... job of protecting US interests generally is far harder. This mission requires that the Agency work with industry as an honest broker. It cannot be seen as intent on using information gathered to sabotage industry's customers or general system security. The trust necessary for this job went up in smoke following the Snowden revelations, which revealed both the vastness of the SIGINT mission and at least one explicit betrayal of the core IA mission. NSA has a long, long way to go in rebuilding this trust.

[...]

The NSA should abandon the merger plans because—regardless of the technical merits—the offensive-defensive merger is viewed by the world as a substantially untrustworthy act. I recognize that offense is part of practicing good defense. But you don't see me writing botnets or high-speed worms. Or breaking into systems without permission. Or providing information to those who do. I manage to defend systems without offense as a core mission, and my defense is not likely to be improved by giving offense a leg up.

Defense isn't something these agencies care about. It may occasionally occur as a result of offensive efforts but it's never the focus. There are no "good guy only" exploits just as certainly as there are no "good guy only" encryption backdoors. The government will never be able to secure its own backyard as long as it believes developing weapons is more important than hardening defenses.

The FBI would rather break into servers halfway around the world and run child porn sites as honeypots than work with other entities to improve their defenses. After all, if someone is hacked, the FBI can always hunt down the perpetrator. As an investigative agency, this makes sense. But it doesn't make sense when the same agency claims it wants to be part of information sharing related to cyberdefense. It's only interested in offensive actions. It only wants evidence and leads.

The DHS, despite containing the words "Homeland Security," isn't truly interested in securing the homeland either -- at least not to the extent that it's interested in opening its own investigations. The NSA is much more in its element performing surveillance and exploiting compromised systems -- neither of which can be considered "defensive" efforts.

In fact, despite the bill's passage, there is no government body tasked solely with the defensive side of "cybersecurity" -- which would seem to be the key element. Defense is apparently meant to be folded in with the rest of their normal activities. Supporters of the legislation think the key is information sharing. It could be, but government agencies have proven over the years they're incapable (or unwilling) to share information with each other. How another layer of government non-sharing is supposed to result in better security is unexplained. Private entities are expected to believe the Cybersecurity Act will turn everyone involved into one big team, but the reality is that it will do little more than add to stores of personal information the government has already proven unable to defend.

Filed Under: cia, data, hacked, james clapper, john brennan, mass surveillance, nsa, surveillance, trust

Intelligence Director James Clapper Warmly Welcomes The Internet Of Things To The NSA's Haystacks

from the my-god...-it's-full-of-data dept

The NSA isn't too concerned about the use of encryption. Unlike the FBI, which continues to claim the sky is falling darkening thanks to the spread of math, the NSA is relatively comfortable with the march of technology in this direction.

For one thing, the NSA has made progress towards cracking some forms of encryption. On top of that, it maintains a unit that does nothing but stick implants into hardware that allows it to bypass protection schemes used by its targets.

There's no "going dark" fear at the NSA. The Director of National Intelligence -- James Clapper -- has just issued a "Worldwide Threat Assessment" and nowhere in it will you find an extensive discussion about encryption's supposed deleterious effect on national security. There is one small paragraph that notes it's likely a part of terrorists' efforts to hide their communications, but not the element that concerns his office the most.

Terrorists will almost certainly continue to benefit in 2016 from a new generation of recruits proficient in information technology, social media, and online research. Some terrorists will look to use these technologies to increase the speed of their communications, the availability of their propaganda, and ability to collaborate with new partners. They will easily take advantage of widely available, free encryption technology, mobile-messaging applications, the dark web, and virtual environments to pursue their objectives.

There are far too many options for those who'd like to keep the NSA out of their business, according to the report. There's no sense in decrying a single aspect of it -- especially one that also provides substantial security benefits to non-terrorists.

But the Internet giveth just as certainly as it taketh away. Echoing the sentiments of the recent report debunking the "going dark" fears of James Comey, certain legislators and a handful of smaller law enforcement agencies, Clapper points out that the Internet of Things will provide intelligence services with plenty of data to fill in their surveillance holes. (h/t Emptywheel)

Internet of Things (IoT). “Smart” devices incorporated into the electric grid, vehicles—including autonomous vehicles—and household appliances are improving efficiency, energy conservation, and convenience. However, security industry analysts have demonstrated that many of these new systems can threaten data privacy, data integrity, or continuity of services. In the future, intelligence services might use the IoT for identification, surveillance, monitoring, location tracking, and targeting for recruitment, or to gain access to networks or user credentials.

The tea kettle that talks to the thermostat that shares a signal with the fridge that exposes your emails to the wardriving criminal who just obtained your Wi-Fi password from the doorbell will all be sources of useful data for law enforcement and intelligence agencies. Considering much of the industry has opted to ship smart things with dumbass defaults most users will never change, the Internet of Eminently Crackable Things will be the informants government agencies always wished they had -- ones that can tell when suspects are home, what they're doing and opening up otherwise secured networks for easy intrusion.

Also worth noting is the highly dubious use of the future tense when referring to the surveillance of targets via their Smart Things. It's hard to believe the NSA isn't already on top of this. It's not as though it would need to alter its permission slips. Section 702 gives it the power to snake info from the internet from basically anywhere in the world and the government is busy arguing that people "know" their connected devices share tons of identification/location info with "the world," so there's really no expectation of privacy that might limit surveillance via smart objects.

While overseas terrorists may not be purchasing Nest thermostats in bulk at the moment, the march towards the interconnectedness of everything means it's likely one object or another will provide another surveillance vector for intelligence agencies in the near future.

Filed Under: internet of things, iot, james clapper, mass surveillance, nsa, surveillance

NY Times Gets It Right: Officials Calling For More Surveillance Are Proven Liars; Don't Listen To Them

from the don't-do-it dept

Even though the NY Times helped kick off the stupidity by publishing a nearly fact-free article (since deleted, and then replaced with an entirely different article) claiming that the Paris attackers used encryption to communicate, it appears the editorial board of the NY Times gets things exactly right with the editorial they pushed out last night: Mass Surveillance Isn't the Answer to Fighting Terrorism. Not only does it point out why expanding mass surveillance won't help much, it also points out that the people calling for it, like CIA director John Brennan and Director of National Intelligence, James Clapper, are not exactly trustworthy -- in fact, they're known liars:

It is hard to believe anything Mr. Brennan says. Last year, he bluntly denied that the C.I.A. had illegally hacked into the computers of Senate staff members conducting an investigation into the agency’s detention and torture programs when, in fact, it did. In 2011, when he was President Obama’s top counterterrorism adviser, he claimed that American drone strikes had not killed any civilians, despite clear evidence that they had. And his boss, James Clapper Jr., the director of national intelligence, has admitted lying to the Senate on the N.S.A.’s bulk collection of data. Even putting this lack of credibility aside, it’s not clear what extra powers Mr. Brennan is seeking.

This is refreshing to see, because the mainstream press has been ridiculously reticent to call these guys out for the fact that they lied. Of course, President Obama should be faulted too. In allowing both men to keep their jobs after they were caught lying, both publicly and to Congress, he set the tone that says "it's okay for you to perjure yourself before Congress and to lie to the American public about how we're violating their rights." And so, it continues.

Still, the NY Times, rightly also calls bullshit on the hand-wringing among the intelligence community with its claims about how their hands are tied if they can't get more surveillance powers:

Listening to Mr. Brennan and other officials, like James Comey, the head of the Federal Bureau of Investigation, one might believe that the government has been rendered helpless to defend Americans against the threat of future terror attacks....

In truth, intelligence authorities are still able to do most of what they did before — only now with a little more oversight by the courts and the public. There is no dispute that they and law enforcement agencies should have the necessary powers to detect and stop attacks before they happen. But that does not mean unquestioning acceptance of ineffective and very likely unconstitutional tactics that reduce civil liberties without making the public safer.

Now if only the views of the editorial board actually filtered down to the paper's reporters, who seem amazingly willing to simply act as stenographers for these officials as they lie to the public and push their agenda.

Filed Under: encryption, grandstanding, james clapper, john brennan, ny times editorial board, surveillance
Companies: ny times

US Intelligence Community's Cavalier Attitude Towards OPM Hack

from the that-old-thing... dept

We've obviously written a few times now about the big OPM hack that was revealed a few months ago, in which it appears that hackers (everyone's blaming China for this) were able to get in and access tons of very, very private records of current and former government employees -- apparently including tons of SF-86 forms. Those forms are required to be filled out for anyone in a national security job in the government, and it basically requires you to 'fess up to anything you've ever done that might, at some point, reflect badly on you. The basic idea behind it is that if you've already admitted to everything, then it makes it much harder for anyone to somehow blackmail you into revealing US national security secrets. But, of course, that also makes those documents pretty damn sensitive. And, by now of course you've heard that the Office of Personnel Management was woefully unprepared to properly protect such sensitive data.

Two recent statements made by top intelligence community leaders again should raise questions about why these guys have been put in charge of "defending" against computer attacks. First up, we have the head of the NSA, Admiral Mike Rogers. Back in August, we noted that Senator Ron Wyden had asked the National Counterintelligence and Security Center (NCSC) if it had even considered the OPM databases "as a counterintelligence vulnerability" prior to these attacks. In short: did the national security community who was in charge of protecting computer systems even realize this was a target. As Marcy Wheeler pointed out last month, Admiral Rogers more or less admitted that the answer was no:

After the intrusion, “as we started more broadly to realize the implications of OPM, to be quite honest, we were starting to work with OPM about how could we apply DOD capability, if that is what you require,” Rogers said at an invitation-only Wilson Center event, referring to his role leading CYBERCOM.

NSA, meanwhile, provided “a significant amount of people and expertise to OPM to try to help them identify what had happened, how it happened and how we should structure the network for the future,” Rogers added.

In other words, the guy who is literally in charge of the "US Cybercommand" organization that is supposed to protect us from computer-based attacks didn't realize until after the hack that this might be a relevant target.

Then, fast forward to last week, where Rogers' boss, Director of National Intelligence James Clapper, testified at a Congressional hearing about the hack. After admitting that CIA employees had to be quickly evacuated from China after the hack, he more or less said that the US shouldn't retaliate, because this was "just espionage" and that the US has basically done the same thing back to them. At least that's the implication of his "wink wink, nod nod" statement to the Senators:

Director of National Intelligence James R. Clapper Jr., testifying before the Senate Armed Services Committee, sought to make a distinction between the OPM hacks and cybertheft of U.S. companies’ secrets to benefit another country’s industry. What happened in OPM case, “as egregious as it was,” Clapper said, was not an attack: “Rather, it would be a form of theft or espionage.”

And, he said, “We, too, practice cyberespionage and . . . we’re not bad at it.” He suggested that the United States would not be wise to seek to punish another country for something its own intelligence services do. “I think it’s a good idea to at least think about the old saw about people who live in glass houses shouldn’t throw rocks.”

Now, he's actually making a totally valid point concerning what the US's response should be. Escalating this issue by hitting back at China isn't going to help anything. Rather, of course, the US government should have done a much better job protecting the information in the first place.

But when you look at these statements together, it shows the somewhat cavalier attitude of the US intelligence community towards actually protecting key US assets. And that's because the US intelligence community is -- as Clapper basically admits -- much more focused on hacking into other countries' systems. For a while now, people have questioned why the NSA should be handling both the offensive and defensive "cybersecurity" programs. The theory has long been that because the NSA is so damn good at the offensive side, it's better positioned to understand the risks and challenges on the defensive side. Yet, given that the NSA's overall mission is so focused on breaking into other systems, it seems that whenever the two conflict, the offensive side wins out and less is done to protect us. The simple fact that the US intelligence community is basically admitting that we do exactly these kinds of attacks on China, yet never considered the same might be done to us, should raise pretty serious questions about why we let the intelligence community handle protecting us against such intrusions in the first place.

Filed Under: admiral mike rogers, china, cybersecurity, james clapper, nsa, opm, opm hack, surveillance, us cyber command

James Clapper Says Intelligence Community Has 'Duty To Warn' Endangered People... Sort Of

from the exceptions-apply dept

Steven Aftergood of the Federation of American Scientists directs us to a recently-released document issued by James Clapper (DNI) that formalizes something that the US has long held in principle, but had yet to commit to paper.

Intelligence agencies that discover a threat to a person’s life or safety are obliged to alert the intended target in most cases as long as they can do so without compromising intelligence sources and methods, a new intelligence community directive instructs.

A U.S. intelligence agency “that collects or acquires credible and specific information indicating an impending threat of intentional killing, serious bodily injury, or kidnapping directed at a person or group of people shall have a duty to warn the intended victim or those responsible for protecting the intended victim, as appropriate,” the new directive states. “This includes threats where the target is an institution, place of business, structure, or location.”

The directive also covers, remarkably, non-US persons. The broad wording that pulls a lot of non-person "persons" under the "duty to warn" umbrella raises some questions about the included agencies' (FBI, NSA, CIA) duty to warn private companies about attacks of the "cyber" variety. Marcy Wheeler of emptywheel:

As I have noted, NSA has secretly defined “serious bodily harm” to include threat to property — that is, threats to property constitute threats of bodily harm.

If so, a serious hack would represent a threat of bodily harm (and under NSA’s minimization procedures they could share this data). While much of the rest of the Directive talks about how to accomplish this bureaucratically (and the sources and methods excuses for not giving notice), this should suggest that if a company like Sony is at risk of a major hack, NSA would have to tell it (and the Directive states that the obligation applies for US persons and non-US persons, though Sony is in this context a US person).

So shouldn’t this amount to a mandate for cybersharing, all without the legal immunity offered corporations under CISA?

It would appear to order the NSA and other government intelligence agencies to be forthcoming about impending (or ongoing) attacks. If interpreted in this fashion by the ODNI, it would appear to make CISA-ordained sharing redundant and ask the intelligence community to put aside its own interest in exploitables and preserving "means and methods" in favor of a "duty to warn."

Or not. There are several exceptions.

a. The intended victim, or those responsible for ensuring the intended victim's safety, is already aware of the specific threat;
b. The intended victim is at risk only as a result of the intended victim's participation in an insurgency, insurrection, or other armed conflict;
c. There is a reasonable basis for believing that the intended victim is a terrorist, a direct supporter of terrorists, an assassin, a drug trafficker, or involved in violent crimes;
d. Any attempt to warn the intended victim would unduly endanger U.S. government personnel, sources, methods, intelligence operations, or defense operations;
e. The information resulting in the duty to warn determination was acquired from a foreign government with whom the U.S. has formal agreements or liaison relationships, and any attempt to warn the intended victim would unduly endanger the personnel, sources, methods, intelligence operations, or defense operations of that foreign government; or
f. There is no reasonable way to warn the intended victim.

So, this voluntary assumption of a mostly-moral obligation to warn others of danger does not cover most criminals (apparently, the ODNI is fine with criminals killing/harming each other) or any situation where warning an entity of an impending attack would compromise intelligence agencies and their objectives. This would seem to eliminate warnings of cyberattacks, seeing as most relevant information would be hopelessly entangled in the cybersecurity efforts of multiple government agencies.

Marcy Wheeler points out that these exceptions could explain the FBI's lack of interest in warning Occupy Wall Street members of an assassination plot. Of course, the directive didn't officially take effect until July 21, 2015. At the point the FBI decided against warning certain American citizens of assassination threats, the "duty to warn" was nothing more than an altruistic ideal. It was under no legal obligation to do so, and its investigation of Occupy Wall Street probably justified its unwillingness to keep these "insurrectionists" out of harm's way.

The new directive doesn't really make this any more mandatory than it was back when it was unwritten and completely voluntary. Steven Aftergood points out the DNI's directive mentions both the National Security Act of 1947 and Executive Order 12333, but neither of these contain any wording that would legally compel intelligence agencies to honor a "duty to warn."

That being said, there's at least some anecdotal evidence that intelligence agencies have carried out their "duty to warn" in the past. Aftergood's post links to a former intelligence officer's recounting of exercising the "duty to warn" in Iraq.

A US citizen who was mixing good deeds (water supply work) with proselytizing (handing out Bibles to Iraq citizens) found himself the target of the Iranian Islamic Revolutionary Guards Corp. The IRGC implemented a Bible "buy-back" program, offering $5 for every Bible handed out by this "do-gooder." Iraqis soon turned this into a revenue stream, selling Bibles to the Guards and heading back to the missionary for fresh copies. The IRGC then decided it was sick of spending money to make money zero headway in the religious superiority game and decided to kill the Bible supplier. This news made its way back to the CIA task force, which then attempted to pass the warning on to the do-gooding Bible pusher. Incongruity ensued.

So, I get the tasking to warn Doug under the "duty to warn" policy. I gather up a few of our Kurdish guard force and another American to go to the village and pass the warning on to Doug. I can imagine his confusion. We roll into town, something like a cross between the Rat Patrol and Pancho Villa, Toyota pickups with mounted 12.7mm’s, Alanis Morissette blaring on the CD player - you get the picture.

I knocked on the door (I asked the locals, "Wayn al-Amrikan?" [Where's the American?]) and a gringo answers. I ask if he is Doug so-and-so. He says he is, but looking at our obviously loaded-for-bear entourage, asks who we are.

I reply, "We’re from the State Department."

He looks at us, AK-47’s and Browning High-Powers all over the place.

I quietly said, "Just work with us here, Doug."

"What exactly do you want?" he asks. Obviously he was not a fan of the CIA mucking around in "his" area.

I explain, "We have information that the Iranians, who believe you are proselytizing Christianity, are planning to kill you. We are advising you to leave Iraq for your own safety and that of your family (he had actually brought his Dutch wife and 10-year old son with him)."

Incredulously, he asked me, "Do you have anything more specific, more concrete than the fact they plan to kill me?"

I was a bit taken aback - "The IRGC is going to kill you - Doug so-and-so. How much more specific do we have to be?"

So, altruism exists. And inasmuch as it doesn't interfere too greatly with national security aims and/or ongoing investigations, people will be warned. But the ODNI's new "directive" doesn't add any additional obligations that weren't in place earlier. In fact, it seems to have been put down on paper mainly to explicitly list all the times the intelligence community won't be obligated to warn others of danger.

Filed Under: duty to warn, james clapper, odni, surveillance

DOJ To Court: Hey, We're Shutting Down Section 215, So We Can Probably Stop Arguing About The Legality Of Bulk Collection

from the you-sort-of-won!-what-more-do-you-want? dept

Just as James Clapper's office was officially announcing the death of the bulk phone metadata program (ending November 29th, with three months of post-wind-down wind-down for data analysts), the DOJ was filing a motion in the Second Circuit Court of Appeals basically arguing that its finding that the program was illegal really doesn't matter anymore.

According to the DOJ, there really is no program -- at least if you don't count the six months the NSA has to make the move to the more targeted USA Freedom version. So this discussion about which program isn't authorized by which PATRIOT Act provision is… well, not completely moot, but like pretty much literally weeks away from moot, so why are we wasting our time here [EXASPERATED SIGH].

Plaintiffs’ claims will be moot when the bulk collection of telephony metadata under Section 215 ends on November 29, 2015, though they are not moot right now. On that date, the statutory authority for the Section 215 bulk telephony-metadata program will expire, and the data previously collected and held under that program will not be used in the future for intelligence-gathering or law-enforcement purposes. In the meantime, however, the Court should respect Congress’s decision to create an orderly transition away from the Section 215 bulk telephony-metadata program. Especially in light of Congress’s considered judgment that this program should continue for this limited period, plaintiffs are not entitled to any of the relief they request.

In support of its argument that the court should ignore its own findings and just listen to what the FISA Court said (and what legislators didn't say, but obviously intended), the government points to its own Tumblr post (certainly a historical moment in its own right) detailing the specifics of the end of Section 215.

On July 27, 2015, the Office of the Director of National Intelligence (ODNI) issued a public statement that the NSA has determined that “analytic access to that historical metadata collected under Section 215 . . . will cease on November 29, 2015,” at the end of the transition period. See Statement by ODNI on Retention of Data Collected Under Section 215 of the USA PATRIOT Act, available at http:// icontherecord.tumblr.com/post/125179645313/ statement-by-the-odni-on-retention-of-data (ODNI July 27 Statement). Thus, after that date, no further bulk collection of telephony metadata will take place under the Section 215 program, and the historical telephony metadata will not be used for intelligence or law-enforcement purposes and will not be disseminated.

To sum up: these past abuses should no longer be of concern as the data is going to be flushed (for the most part) within the next nine months. To better enable said data flush, the Second Circuit Court might want to wrap up the ACLU's suit (and hasten the end of the EFF's) so that no data is still being "preserved" past the November 2015 dump point.

To that end, the DOJ constantly reminds the Second Circuit that the FISA Court really has a handle on these sort of things and why don't we just leave it to the pros.

The FISC was right that Congress authorized the Section 215 bulk telephony-metadata program to continue during the six-month transition period. [p. 6]

As the FISC correctly noted, Congress’s decision to delay that ban for six months is a powerful indication that it intended to permit bulk collection in the interim period. [p. 9]

The FISC was thus correct when it observed that “after lengthy public debate, and with crystal clear knowledge of the fact of ongoing bulk collection of call detail records” Congress “chose to allow a 180-day transitional period . . . .” June 29 FISC Op. at 11. This Court need not and should not determine whether Congress “ ‘ratif[ied] the FISA Court’s interpretation of ’ ” Section 215. [p. 11]

This filing, like its Tumblr statement announcing the official end of the collection, emphasizes the single aspect of the Section 215 bulk collections that has been the focus of this litigation and most legislative efforts: phone metadata. The authorization, even in its altered, post-USA Freedom Act form -- provides for much more than just this one type of collection. The DOJ goes so far as to call the USA Freedom Act a "ban" on bulk, untargeted collections, when it actually doesn't go quite that far.

Marcy Wheeler points out that the DOJ may be less interested in the outcome of this ruling as it is with the implications of the EFF's litigation. What could be uncovered if the NSA is forced to turn over relevant records from its bulk metadata collection is more illegal -- or at least unauthorized -- collection activity.

I believe both ACLU and EFF’s phone dragnet client Counsel on American Islamic Relations, had not only standing as clients of dragnetted companies, but probably got swept up in the two-degree dragnet. But CAIR probably has an even stronger case, because it is public that FISC approved a traditional FISA order against CAIR founder Nihad Awad. Any traditional FISA target has always been approved as a RAS seed to check the dragnet, and NSA almost certainly used that more back when Awad was tapped, which continued until 2008. In other words, CAIR has very good reason to suspect the entire organization has been swept up in the dragnet and subjected to all of NSA’s other analytical toys.

EFF, remember, is the one NGO that has a preservation order, which got extended from its earlier NSA lawsuits (like Jewel) to the current dragnet suit. So when I Con the Record says it can’t destroy all the data yet, it’s talking EFF, and by extension, CAIR. So this announcement — in addition to preparing whatever they’ll file to get the Second Circuit off its back — is likely an effort to moot that lawsuit, which in my opinion poses by far the biggest threat of real fireworks about the dragnet (not least because it would easily be shown to violate a prior SCOTUS decision prohibiting the mapping of organizations).

This announcement by Clapper's office, followed shortly thereafter on the same day by the filing of its response in the Second Circuit case, certainly gives the appearance that the NSA has lifted the corner of the rug and is just waiting for the signal to start sweeping any undiscovered abuses -- along with those previously exposed -- under it. That the expiration of the authority and the passage of the USA Freedom Act may have provided it with a better broom is unexpectedly fortuitous.

Filed Under: 4th amendment, bulk records, doj, james clapper, lawsuits, nsa, odni, section 215, surveillance, usa freedom act
Companies: aclu, eff

Director Of National Intelligence Hammers Final Official Nail Into Bulk Phone Records Program

from the will-still-need-six-to-nine-months-of-additional-hammering-though dept

The Office of the Director of National Intelligence has issued a statement addressing the inevitable shutdown of the Section 215 bulk phone metadata program.

NSA has determined that analytic access to that historical metadata collected under Section 215 (any data collected before November 29, 2015) will cease on November 29, 2015. However, solely for data integrity purposes to verify the records produced under the new targeted production authorized by the USA FREEDOM Act, NSA will allow technical personnel to continue to have access to the historical metadata for an additional three months.

Caveats apply. Data will still be held as required by a handful of ongoing lawsuits. With the "bulk" part of the bulk records program shut down (but not completely), the government is obviously hoping for a speedy end to the litigation resulting from the Snowden leaks. That's the other motivating factor behind this public statement that not only states an end date, but the additional restrictions past that point.

This is a pretty remarkable moment in the security v. privacy battle, but there are still reasons to be concerned. The bulk telephony metadata program has received a majority of the focus since Snowden's initial leak and the NSA, at times, has seemed almost too willing to let this program act as a scapegoat for its multiple privacy-violating surveillance programs.

Not that there haven't been seriously heated (and seriously misguided) arguments offered in support of this program, but if you take a close look at the history of the debate over Section 215, the most-spirited defenses have not been raised by the NSA, but by legislators and former intelligence officials. The program appears to have been sacrificed in order to prevent more intrusive surveillance programs from being subjected to more intense scrutiny.

And it's not even the totality of what can be collected under Section 215. The statement from the ODNI specifically addresses only one kind of "tangible thing."

The telephony metadata preserved solely because of preservation obligations in pending civil litigation will not be used or accessed for any other purpose, and, as soon as possible, NSA will destroy the Section 215 bulk telephony metadata upon expiration of its litigation preservation obligations.

We don't know what else is being collected in bulk under the PATRIOT Act provision -- the same authority that expired this year and was replaced with the stipulations of the USA Freedom Act -- but we know it's more than just "telephony metadata." "Tangible things" encompasses far more than phone metadata ("books, records, papers, documents, and other items"), but this statement -- as well as arguments it's made in court in support of the six-month wind-down period -- only address phone records.

The Second Circuit Court found that the bulk collection of records under Section 215 was likely illegal. That opinion called into question anything collected under this authority, but the government here (and in its recent filing in the Second Circuit Court) acts as though the "illegal" collection activity is limited solely to phone records.

Other NSA programs are going to be far more useful in gathering data and intelligence than the collection of phone records. Phone calls may never go away entirely, but the shift to mobile communications (followed shortly thereafter by the shift to feature phones and smartphones) has made phone calls the least used feature on these devices. Messaging programs and social media platforms now carry the bulk of everyday communications. And the NSA has programs in place to sweep up these as well, whether as content or metadata. So, all of this focus on "telephony" only serves to obscure what else it may still collect with the revamped program, as well as everything else it does under much more secretive legal authorities.

Filed Under: bulk phone records, bulk records, james clapper, nsa, odni, section 215, surveillance, usa freedom act

Latest Explanation For James Clapper Lying About 'Essential' NSA Spy Program: 'He Forgot About It'

from the you-expect-us-to-believe-that? dept

By now, one hopes, you've seen this video of James Clapper lying to Senator Ron Wyden and the American public while testifying before Congress in early 2013: Here's the key transcript:

Wyden: Does the NSA collect any type of data at all on millions or hundreds of millions of Americans?

Clapper: No sir.

Wyden: It does not?

Clapper: Not wittingly. There are cases where they could, inadvertently perhaps, collect—but not wittingly.

This was a lie. Many people believed it was a lie at the time, but that was confirmed thanks to the documents leaked by Ed Snowden, who later claimed that seeing that bit of testimony helped convince him that he needed to go through with his plan to leak this information.

James Clapper, of course, is the Director of National Intelligence, and the heads of the various intelligence agencies basically report in to him. He's still in that job, which many people argue is a complete travesty. He flat out lied to Congress and got away with it.

What's been really odd is that the story as to why Clapper lied seems to keep changing. When questioned about this, Clapper's initial response was that he thought that Wyden was asking about collection of email information, which is clearly not the case if you just listen to the actual question. Wyden, pretty clearly, says "any type of data at all." About a week later, Clapper changed his story, saying that he believed the question was an unfair "loaded question" (he compared it to the "when did you stop beating your wife" type of question -- even though it's not that at all) and then said that he gave "the least untruthful answer."

This didn't make much sense either -- and it made even less sense when Senator Wyden revealed that he didn't just spring this question on Clapper, but had sent it to Clapper's office a day ahead so he could review the question and be aware of what he was to be asked. On top of that, Wyden revealed that after Clapper's answer -- which Wyden knew was false -- Wyden staffers sent a letter to Clapper asking him if he wanted to amend his answer, and Clapper's office refused to do so.

Finally, about a month later, Clapper finally admitted that he lied, now claiming that it was all a "mistake."

"mistakes will happen, and when I make one, I correct it."

Except... he had been given the chance to correct it and he didn't. It was only after it was publicly revealed (via Snowden and Glenn Greenwald) that Clapper was outright lying that he claimed he made "a mistake." But, even then, it only came after pretending he misheard the question, then claiming that it was a loaded question (when it was not). And then, of course, months later, Clapper could pretend, with the benefit of hindsight, that he should have been more forthright about the program, but that's difficult to believe. And none of it matters, because the DOJ refuses to investigate Clapper for lying.

And yet, Clapper's story continues to keep changing. Late last year, he tried to rewrite the story, suggesting that he was sandbagged and caught off-guard, rather than lying:

“When I got accused of lying to congress because of a mistake ... I had to answer on the spot about a specific classified program in a general, unsecure setting.”

And, now, the latest is that the top lawyer in Clapper's office (ODNI), Bob Litt, is trying to rewrite the story even more, by claiming that James Clapper forgot about the metadata collection program when he answered Wyden's question:

“This was not an untruth or a falsehood. This was just a mistake on his part,” Robert Litt, the general counsel for the Office of the Director of National Intelligence, said during a panel discussion hosted by the Advisory Committee on Transparency on Friday.

“We all make mistakes.”

Litt on Friday said that Clapper merely did not have a chance to prepare an answer for Wyden and forgot about the phone records program when asked about it on the spot.

“We were notified the day before that Sen. Wyden was going to ask this question and the director of national intelligence did not get a chance to review it,” Litt said.

“He was hit unaware by the question,” Litt added. “After this hearing I went to him and I said, ‘Gee, you were wrong on this.’ And it was perfectly clear that he had absolutely forgotten the existence of the 215 program.”

Instead, Litt said, Clapper had been thinking about separate programs authorized under Section 702 of the Foreign Intelligence Surveillance Act, which the NSA has used to collect massive amounts of foreigners’ Internet data. The law explicitly prohibits the government from gathering the same kind of data about Americans, unless t is “incidental.”

“If you read his answer it is perfectly clear that he was thinking about the 702 program,” Litt said. “When he is talking about not wittingly collecting, he is talking about incidental collection.”

Litt, he said, also erred after the hearing by not sending a letter to the panel to correct the mistake.

First of all, while Litt at least is admitting that Wyden had sent the question in beforehand, he leaves out the part about Wyden asking Clapper's office the next day if it wanted to amend Clapper's answer. If it's true that Litt immediately told him that Clapper was wrong, then you would think when asked by Wyden if he wanted to amend his answer, he would have done so. He did not. So either Litt told Clapper he was wrong and Clapper said, "Hey, let's let that lie stand," or Litt is not being truthful here either. It wasn't just them not sending a letter correcting the mistake, but it was directly rejecting Wyden's staff specifically asking them if they wanted to correct the record. That shows that any claim that Clapper just "forgot" or even "misspoke" has to be a flat out lie, since he had a clear opportunity to correct the mistake and was even asked to do so, and consciously chose not to do so.

But much more importantly, considering just how much Clapper and others have been prattling on for years about how "crucial" and "important" the bulk phone records collection is in protecting the American public, it is simply unbelievable to argue that Clapper would "forget" about the program. Either that means the program is not important at all... or that someone is lying.

The fact that Clapper's story on this keeps changing suggests he still can't come to admit the obvious answer: he didn't want to reveal his beloved secret program, and so he lied. He just flat out lied. And he's still lying in failing to admit that.

Filed Under: bulk collection, james clapper, lying to congress, nsa, odni, robert litt, ron wyden, section 215, surveillance