Senator John McCain Weighs In On 'Going Dark' Debate -- Insists That He Understands Cryptography Better Than Cryptographers

from the maverick dept

Who knew that Senator John McCain understood encryption better than actual cryptographers? Late last week, he wrote an op-ed for Bloomberg View, in which he trots out all the usual talking points on how Silicon Valley just needs to nerd harder to solve the "Going Dark" problem. There's lots of cluelessness in the piece, but let's focus on the big one:

Top cryptologists have reasonably cautioned that “new law enforcement requirements are likely to introduce unanticipated, hard to detect security flaws,” but this is not the end of the analysis. We recognize there may be risks to requiring such access, but we know there are risks to doing nothing.

Actually, it kind of is "the end of the analysis" because the core element of that analysis is the fact that any attempt to backdoor encryption doesn't just make security weaker, it puts basically everyone at much greater risk. It introduces cataclysmic problems for any system that stores information that needs to be kept secure and private.

The following sentence is equally inane, in which he tries to place the "risks" of backdooring encryption on the same plane as the risk of ISIS using encryption. Let's be clear here: the risk of backdooring encryption isn't just significantly larger than the risk of ISIS using encryption, they're not even in the same universe. Even worse, by backdooring encryption, you are almost certainly increasing the risk of ISIS as well, by giving them a massive vulnerability to attack and exploit. Trying to suggest that this is an "on the one hand, on the other hand" situation is so ridiculously ignorant, one wonders who the hell is advising Senator McCain on this topic.

The fact is that there are always some risks. Tens of thousand of people die in car accidents in the US every year, yet you don't hear Senator McCain weighing the risks of driving versus the risks of banning cars. And that's a much more reasonable position to stake out, because banning cars would actually reduce automobile deaths — but it would also cripple the economy. But here's the thing: backdooring encryption has the potential to do much more damage to the economy than banning automobiles, because it would create vulnerabilities that could really completely shut down our economy. So, for McCain to pretend that there are somewhat equal risks on either side isn't just ignorant and meaningless, it's dangerous.

Some technologists and Silicon Valley executives argue that any efforts by the government to ensure law-enforcement access to encrypted information will undermine users’ privacy and make them less secure. This position is ideologically motivated and profit-driven, though not without merit. But, by speaking in absolute terms about privacy rights, they bring the discussion to a halt, while the security threat evolves.

Honestly, this is not true. I know that Comey's favorite line these days is that using strong encryption is a "business model decision," but Silicon Valley's interest in strong encryption doesn't appear to be driven by their own bottom lines, frankly. If it was, they would have adopted it much earlier. Strong encryption actually undermines some companies' business models, in that it makes it more difficult for them to collect the data that many of them rely on. The move towards stronger encryption has mostly been the result of a few things: (1) the fact that the NSA broke into their data centers and put their legitimate users at risk, (2) a better understanding of the wider risks from malicious attackers of what happens when you have weak encryption and (3) user demands for privacy. The last one may have indirect business model benefits in that it keeps users happier, but to argue that keeping users happy is somehow a purely money-driven decision, and frame it as somehow a bad thing, is pretty damn ridiculous.

And, honestly, while there are some activists who speak in absolute terms about "privacy rights," you rarely hear that from Silicon Valley companies. In fact, those who have absolute views on privacy tend to be the most critical of Silicon Valley companies for taking a much less principled view on "privacy rights." McCain pretending that this is driven by some sort of "privacy rights" advocacy suggests he's (again) woefully misinformed on this issue.

To be clear, encryption is often a very good thing. It increases the security of our online activities, provides the confidence necessary for economic growth through the Internet, and protects our privacy by securing some of our most important personal information, such as financial data and health records. Yet as with many technological tools, terrorist organizations are using encryption with alarming success.

Actually, they're not using encryption with "alarming success." There are very, very, very, very few examples of terrorists using encryption successfully. The Paris attackers? Unencrypted SMS. San Bernardino? Unencrypted social media communication.

The jihadists' followers and adherents use encryption to hide their communications within the U.S. FBI Director James Comey recently testified that the attackers in last year's Garland, Texas, shootings exchanged more than 100 text messages with an overseas terrorist, but law enforcement is still blinded to the content of those texts because they were encrypted.

Notice that this is the only example that comes up in these discussions. That's because it's the only example. And it's not even a very good one. Because, as with most encrypted communication, the metadata was still perfectly accessible. That's why they know that the attackers exchanged messages with a terrorist. Sure, they may not be able to understand the direct contents of the message, but the same thing would have been true if the attacker and the people he communicated with had worked out a code before hand. Or, you know, if they had met and talked in person. Is McCain going to ban talking in person too?

Finally, McCain's "solution" to all of this is to make a law telling Silicon Valley to nerd harder and solve the problem... or else:

As part of this effort, Congress should consider legislation that would require U.S. telecommunications companies to adopt technological alternatives that allow them to comply with lawful requests for access to content, but that would not prescribe what those systems should look like. This would allow companies to retain flexibility to design their technologies to meet both their business needs and our national security interests.

In other words, despite the fact that all of the best cryptographers in the world have said that what you're asking for is basically impossible and would make everyone less safe, just do it anyway -- and do it in a way that when it falls apart and everyone is made more vulnerable, Congressional leaders like John McCain can spin around and blame the companies rather than themselves.

We have to encourage companies and individuals who rely on encryption to recognize that our security is threatened, not encouraged, by technologies that place vital information outside the reach of law enforcement. Developing technologies that aid terrorists like Islamic State is not only harmful to our security, but it is ultimately an unwise business model.

Does John McCain seriously not employ a single knowledgeable staffer who could point out to him that basically every encrypted technology that ISIS uses is not made by an American company? Seriously, look at the list of ISIS's preferred encryption technologies: So who, exactly, is developing technologies that "aid terrorists like Islamic State" and need their encryption undermined?

Meanwhile, we haven't even touched on the biggest issue, as was highlighted in that big paper from Harvard last week. And it's this: the whole Going Dark thing is a total myth, because for the tiny, tiny, tiny bit of information that is now blocked out by strong encryption, there's a mountain of other data that is now accessible to law enforcement and the intelligence community. Things have been getting lighter and lighter and lighter for decades.

Shouldn't a sitting Senator understand these basic facts?

Filed Under: benefits, costs, cryptography, encryption, going dark, isis, john mccain, national security, risk, security, threat

Senator McCain Promises To Introduce Legislation To Backdoor Encryption, Make Everyone Less Safe

from the bad-ideas dept

Two months ago, the Obama administration came to the conclusion that mandating backdoors to encryption through legislation was a non-starter. They seemed to recognize that it was mostly a bad idea and (more importantly) that Congress would not approve such legislation. Almost immediately, we noted that intelligence officials (almost gleefully) noted that they really just needed to wait for the next terrorist attack to restart the campaign. Here was Robert Litt, the top lawyer in the intelligence community:

Although “the legislative environment is very hostile today,” the intelligence community’s top lawyer, Robert S. Litt, said to colleagues in an August e-mail, which was obtained by The Post, “it could turn in the event of a terrorist attack or criminal event where strong encryption can be shown to have hindered law enforcement.”

There is value, he said, in “keeping our options open for such a situation.”

Given all that, it was disappointing that the Obama administration then took the cowardly way out, and refused to take an official public stance against backdooring encryption.

Either way, with the attacks in Paris last week, it almost seems like the anti-encryption crowd was somewhat gleeful in their response. Why, here was the exact terrorist attack they needed to push their agenda.

And, of course, the idea of mandated backdoors is back on the table, with Senator John McCain announcing plans to introduce just such legislation:

“In the Senate Armed Services we're going to have hearings on it and we're going to have legislation,” Sen. John McCain (R-Ariz.), who chairs the committee, told reporters Tuesday, calling the status quo “unacceptable.”

Of course, that legislation was ready to go, sitting in a top drawer just waiting for this kind of situation. And now we have to waste all sorts of time responding to this idiocy even though just months ago we went through this whole debate all over again, during which it was pretty clear that backdooring encryption makes us all much less safe. It puts everyone at greater risk, not less.

So the question remains: why do officials and politicians like Senator McCain want to undermine our safety and security? And, even more bizarrely, how is this the same John McCain who was on the other side during the last crypto wars?

Filed Under: backdoors, encryption, going dark, john mccain

Insanity Rules: Disgusting Politicians Push For More Surveillance And Less Encryption... Based On Nothing

from the make-it-stop dept

Yesterday we noted that the surveillance state supporters were quick to rush in and blame Ed Snowden and call for undermining encryption in response to the attacks in Paris last week -- and they did so based on no factual information whatsoever. There was, briefly, a NY Times article quoting anonymous "officials" claiming that the attackers had communicated via encrypted channels. That article eventually disappeared entirely (with no explanation from the NY Times). If that's true, it would not be surprising, because terrorist groups have long used encryption -- as have tons and tons and tons of law abiding folks. Blaming encryption seems particularly dumb.

And, indeed, on Monday it was made clear that no one actually has any idea how the planning was done and there isn't yet known evidence of encryption:

A U.S. security official said there is no evidence yet demonstrating that the Paris attackers used a particular method for communicating, or whether any technology they used was encrypted in a particular way.

Of course, that statement is as meaningless as the one from the anonymous official claiming they did use encryption, because it's just a random namely "official." And, of course, it wouldn't be surprising at all if they did use encryption, because that's how people communicate safely. And it's not because of Snowden. As we noted yesterday, terrorists have known to use encrypted communications for well over a decade.

Still, none of this has stopped the insane grandstanding on the issue. CIA Director John Brennan kicked it off by taking a potshot at Snowden along with privacy advocates and tech companies -- again, based on nothing:

"In the past several years, because of a number of unauthorized disclosures and a lot of handwringing over the government’s role in the effort to try to uncover these terrorists, there have been some policy and legal and other actions that are taken that make our ability collectively, internationally to find these terrorists much more challenging," he said. "I do hope that this is going to be a wake-up call particularly in areas of Europe where I think there has been a misrepresentation of what the intelligence security services are doing by some quarters that are designed to undercut those capabilities."

Brennan also ridiculously claimed that the terrorists had "gone to school" based on the Snowden disclosures, which again, defies all logic and historical reporting of how widely encrypted communications were used prior to this.

And then all the usual fear mongerers started to pile on. Let's start with the surveillance state's number one defender, Senator Dianne Feinstein:

Senator Dianne Feinstein, the California Democrat, said she’s asked Silicon Valley companies to help law enforcement and intelligence agencies access communications that have been encrypted -- or scrambled to evade surveillance -- if terrorists are using the tools to plan attacks.

“I have asked for help. And I haven’t gotten any help,” Feinstein said Monday in an interview with MSNBC. “If you create a product that allows evil monsters to communicate in this way, to behead children, to strike innocents, whether it’s at a game in a stadium, in a small restaurant in Paris, take down an airliner, that’s a big problem.”

But that's idiotic. Does she feel the same way about the telephone? Or paper? Or cars? These are all tools that terrorists use as well, but she's not calling for them to be broken. Blaming the tools is a ridiculous move -- especially for a politician who should know better.

But, of course, she wasn't the only one. Senator John McCain -- who once was a strong defender of encryption in the late 90's, has apparently gone to the other side as he's been taken by unrealistic fears:

Senator John McCain, an Arizona Republican and chairman of the Senate Armed Services Committee, said on MSNBC Monday that "it’s time we had another key that would be kept safe and only revealed by means of a court order."

Except, of course, that doesn't work. And McCain has been told that won't work and will make everyone less safe... and yet he's still pushing for it.

Rep. Michael McCaul, chair of the House Homeland Security Committee got in on the stupid game as well:

“The dark space of the Internet is becoming a breeding ground for terrorist communications, recruitment and plotting,” said McCaul, a Texas Republican. “Our inability to monitor encrypted messages on social media apps, and the terrorists’ awareness of that, compounds the danger America and the West face.”

You know what would put us in even greater danger? Undermining encryption and giving up our keys.

NYPD Commissioner Bill Bratton also repeated the nonsensical claim that tech companies, in better protecting users from hackers, were somehow helping the terrorists:

Technology has been "purposefully designed by our manufactures so that even they claim they cannot get into their own devices after they’ve built them," Bratton said on MSNBC’s Morning Joe.

"They need to work with us right now," Bratton said. "In many respects, they’re working against us."

All of this is based on a weird kind of idiocy. It's wrong on so many levels: (1) strong encryption helps protect citizens, not harm them; (2) terrorists already know how to use strong encryption and they have for years; (3) backdooring encryption won't stop people from using non-backdoored encryption; (4) there's still little to no evidence that snooping on everyone's communications actually stops any terrorist plots. But a big tragedy happened and thus, politicians feel like they need to "do something" and that "doing something" seems to be to attack the technology that actually makes us safer. It's insanity on a massive level.

And the press is playing right into it. The NY Times may have dropped that original story, but came back with one claiming that the attacks had "reopened the debate on encryption." No, they did not. The debate is over. Undermining encryption is dangerous and bad news for everyone. As we noted, the intelligence community's top lawyer, Robert Litt, flat out said just a few weeks ago that he and his friends were waiting for the next terrorist attack in order to push for backdoors in encryption. This is the playbook that was planned all along and most of the press is falling for it.

Thankfully, there are a few exceptions. Kim Zetter at Wired pointed out how the whole narrative is wrong and that backdooring encryption won't help at all. And Alex Howard at the Huffington Post put up a similar story. But for much of the mainstream press, they're playing right into the surveillance state's game plan, repeating the stupid talking points on encryption, based on zero actual facts, and then insisting that the debate is somehow open again.

There is no debate. Yes, the surveillance state supporters want to undermine our security and undermine encryption, but there's no actual debate here. Actual experts know that this is a bad move and a dangerous one that will put many more people at risk. Exploiting an attack in Paris (right after France expanded its own surveillance efforts) is hardly a good excuse for undermining the safety of basically everyone.

Filed Under: bill bratton, dianne feinstein, encryption, going dark, john brennan, john mccain, michael mccaul

Question To Ask Anyone Who Supports CISA: What Breach Would It Have Stopped?

from the simple-questions dept

We've asked this before and no one answered. But with the faux "cybersecurity" CISA bill back on track for another vote, it's time to ask the question again: Can defenders of CISA explain what data breach it would have stopped? This is important, because many of the defenders of CISA keep pointing to things like the OPM hack as an example of why we need "cybersecurity regulations." Just yesterday, Senator John McCain used various recent high profile hacks as proof of why we need such a bill:

The chairman of the joint chiefs of staff is uncomfortable about the cyberthreats to this nation -- which just took place where millions -- MILLIONS! -- of Americans had their privacy hacked into. God only knows what the consequences of that are. And the other side has decided to object to proceeding with a bill that passed through the Intelligence Committee by a vote of 14 to 1. This is disgraceful.

But as policy counsel at the Open Technology Institute, Robyn Greene, recently noted on Twitter, none of the recent hacks would have been stopped if CISA was law.

When will Senators realize that NONE of the breaches (OPM, Sony, Anthem, Home Depot, etc.) would have been stopped is #CISA was law?

— Robyn Greene (@Robyn_Greene) August 4, 2015

It seems like a fairly important question, especially when politicians are pointing to those and similar hacks or data breaches as examples of why we must pass CISA. Yet they can't explain how the law would have stopped those breaches (because they can't, because it wouldn't have).

John McCain wants to talk about "disgraceful"? Isn't it more disgraceful to point to an attack that this bill would not have helped with as a key argument for why this bill needs to pass?

This is some pretty serious hand-waving on the part of the politicians. Of course, the truth is that they simply don't understand the details enough to know what they're doing. They just hear from surveillance/law enforcement types saying that we "need cybersecurity legislation" and then they hear about these breaches and they immediately connect the two. Yet, they don't know what the law really does or why it's needed, and certainly don't understand how breaches happen or what it would take to prevent them (if that were even possible). So they just say "well, cybersecurity!" as if that's good enough.

It's not.

The changes brought about by CISA could have a pretty serious impact on our privacy and security and if Congress is going to pass it by pointing to these breaches, they should first be required to explain how the law would have helped to stop any of those breaches. We'll wait.

Filed Under: breach, cisa, cybersecurity, hack, john mccain

Two Of The Most Ridiculous Statements From Senators At Yesterday's Encryption Hearings

from the these-people-are-in-charge? dept

We already wrote a bit about the two Senate hearings that FBI Director James Comey participated in yesterday, concerning his alleged desire to have a "discussion" about the appropriateness of backdooring encryption. The phrase tossed around at the hearings was about the FBI's fear of "going dark" in trying to track down all sorts of hypothetical bad guys (and it always was hypothetical, since no actual examples were given). However, not all of the crazy statements came from Comey. There was plenty of nuttiness from Senators as well. It is, of course, difficult to pick out the most ridiculous, so here are two that stood out to me, personally. And, to avoid any charges of bias, I'll include one from each hearing and one from a Democrat and one from a Republican.

Let's start with the first hearing, the one before the Senate Judiciary Committee, where Senator Sheldon Whitehouse decides to add his bizarrely ignorant statements (starting around 1 hour, 18 minutes into the recording). Whitehouse starts out with a hypothetical (again!) story of a girl being kidnapped outside of her home ("taken into a van"), but having her phone left inside. He claims that in the past, law enforcement could get a warrant for the phone "to help locate the girl." And now "they cannot do that." This hypothetical makes no sense for a variety of reasons. First, the number of actual abductions like that is pretty rare. But, more importantly, if the phone is at home then it's not exactly going to help law enforcement locate her any more. He's mixing up a variety of different things involving location versus stored data encryption. It's just a scare story that has little to do with the issue of stored data encryption, which is what the hearing is supposed to be about.

But, from there, he goes on to make an even more bizarre statement, claiming that companies pushing encryption are doing so solely for their own corporate benefit, creating harm for the public. In fact, he compares encryption to pollution, and then argues that there could be civil liability because encrypted phones make it difficult to find hypothetical kidnapped girls:

It strikes me that one of the balances that we have in these circumstances, where a company may wish to privatize value -- by saying "gosh, we're secure now, we got a really good product, you're gonna love it" -- that's to their benefit. But for the family of the girl that disappeared in the van, that's a pretty big cost. And, when we see corporations privatizing value and socializing costs, so that other people have to bear the cost, one of the ways that we get back to that and try to put some balance into it, is through the civil courts. Through the liability system. If you're a polluter and you're dumping poisonous waste into the water rather than treating it properly somebody downstream can bring an action and can get damages for the harm they sustained, can get an order telling you to knock it off.

This appears to be a thing that Senator Sheldon Whitehouse does. He makes up ridiculous hypotheticals of situations that aren't happening and then jumps to flat out wrong arguments based on those hypotheticals.

Here, he's just wrong that companies employing encryption are "privatizing value and socializing costs." In fact, as many, many, many people will argue, companies that are putting in place end-to-end encryption actually can make it more difficult for them to make money, since they close off avenues such as targeted advertising, since they lose access to the information being transmitted. But, even more to the point, this entire argument is based on the simply wrong (and completely ignorant) argument that the there's a "cost" to the public of greater encryption. That's not just wrong, it's so wrong as it should call into question the career choices of whatever clueless staffer fed that line to Senator Whitehouse. The whole crux of the argument, as has been explained over and over again, is that greater encryption better protects the public from cyberattacks, from those seeking to violate their privacy and from other potential malicious actors.

In other words, the actual scenario that Whitehouse should be concerned about is not the mythical girl being abducted into a van (again, a scenario that rarely happens), but the malicious online actors who are seeking to break into the girl's bank account or other online accounts in order to cause all sorts of actual problems for her in real life. That's the much more likely threat, and it's the one that strong encryption helps protect. The whole idea that strong encryption is the equivalent of pollution is hilariously wrong. Pollution is a negative externality. But strong encryption is not a negative externality. It better protects the public. It's a public benefit.

Senator Whitehouse's argument is based on a near total misunderstanding of what encryption does and how it protects people, and is devoid of any understanding of actual threats that people face in the world -- both the low likelihood of random abduction and the high likelihood of having your online accounts under attack. It's so far from reality that it feels like Senator Whitehouse ought to issue an apology.

On to the second hearing before the Intelligence Committee. In this case, the Senator we'll pick on is Senator John McCain. His part starts a little after the 1 hour and 15 minute mark into that video. And he's focused on the worst kind of political grandstanding, hyping up FUD around ISIS, followed by a "but we must do something!" argument that ignores the simple fact that the plan he supports actually makes the problem worse, not better. As you'll see, Senator McCain doesn't care about that. He just wants something done. This one involves some back and forth with Comey, starting with the scare stories to start things out:

McCain: Is it true that, you have stated on several occasions, that ISIS poses over time a direct threat to the United States of America?

Comey: Yes.

McCain: And that is the case today?

Comey:: Yes. Everyday they're trying to motivate people here to kill people on their behalf.

McCain: And every day that they take advantage of this use of the internet, which you have described by going to unbreakable methods of communicating, the more people are recruited and motivated to, here in the United States and other countries to attack the United States of America. Is that true.

Comey: Yes sir.

Okay, let's just cut in here first of all to note that it's not actually true. I mean, it's possible that this is happening, but there still has yet to be a single credible story about ISIS successfully "recruiting" people in the US to perform an attack in the US. All of the ISIS "arrests" so far have been part of the FBI's own plots, where it's an FBI informant doing the "recruiting and motivating."

McCain: So this is not a static situation. This is a growing problem, as ISIS makes very effective use of the internet. Is that correct?

Comey: That's correct sir.

McCain: So with all due respect to your opening comments, this is more than a conversation that's needed. It's action that's needed. And, isn't it true that, over time, the ability of us to respond is diminished as the threat grows and we maintain the status quo?

Comey: I think that's fair.

Actually, it's not fair. It's wrong. I mean, it depends on what kind of "action" we're talking about -- but since the entire hearing focused on backdooring encryption, it's difficult to argue that the "ability to respond diminishes" over time because any plan to backdoor encryption wouldn't be an actual response that matters. ISIS would quickly just switch to encrypted systems that aren't backdoored by the US government, and there are plenty to choose from.

McCain: So, we're now -- and I've heard my colleagues, with all due respect talking about attacks on privacy and our Constitutional rights etcetera -- but it seems to me that our first obligation is the protection of our citizenry against attack. which you agree is growing. Is that a fact?

Comey: I agree that is our first responsibility. But I also...

McCain: So the status quo is not acceptable if we support the assertion that our duty is to protect the lives and property of our fellow citizenry. That is our first priority. You agree with that?

Okay, first off, you should really watch this point to see the dismissive way he shrugs off the part about "privacy" and "our Constitutional rights etcetera." It's really quite disturbing, frankly. And that's because the next line is just wrong. The Oath of Office given to Senators is that they will "support and defend the Constitution of the United States against all enemies, foreign and domestic." It does not say anywhere that they are to "protect our citizenry against attack." And it especially does not say that the role of a Senator is to protect the citizenry from attack over protecting the Constitution. It says the exact opposite. It says that his sole job is to protect the Constitution.

That a Senator who has been in office as long as McCain is flat out ignoring the Oath he's taken many times, and actually arguing for a policy that he is admitting violates that oath is somewhat stunning. He is flat out saying, in violation of his oath, that his job is to undermine the Constitution if he believes it will protect the American people from attack.

And, just to highlight how incredibly stupid this statement is, pushing for backdoors on encryption doesn't even do what he thinks it does. It actually makes Americans more open to attack by making their digital information less safe and secure. So even if we took McCain's argument at face value and ignored that it's directly in contrast to his oath of office, he's still wrong, because he's putting more Americans at risk, rather than "protecting" them.

As for Comey agreeing that this is a first priority, he's wrong about that too. Some might think that is the first priority for the FBI, even if it isn't for Congress, but it's not. The FBI's oath is also to "support and defend the Constitution against all enemies, foreign and domestic."

McCain then drags out a bunch of leading questions in which he continues to try to make it out like "something must be done to stop this nasty encryption" stuff, getting Comey to (mostly) agree, even to completely bogus statements.

Comey: I agree that this is something that we have to figure out what to do about.

McCain: So now we have a situation where the major corporations are not cooperating and saying that if we give the government access to their internet, that somehow, it will compromise their ability to do business. Is that correct also?

Comey: (Shakes his head back and forth in a way suggesting he disagrees, but then says): That's a fair summary of what some have said.

McCain: So we're discussing a situation in which the US government -- i.e., law enforcement and the intelligence community -- lack the capability to do that which they have the authority to do. Is that correct?

Comey: Certainly with respect to the interception of encrypted communications and accessing locked devices, yes.

McCain: So we're now in an interesting situation where your obligation is to defend the country, and at the same time, you're unable to do so, because these telecommunications... these organizations are saying that you can't, and are devising methodology that prevents you from doing so, if it's the single key, only used by the user. Is that correct?

Comey: I wouldn't agree, Senator, that I'm unable to discharge my duty to protect the country. We're doing it every single day using all kinds of tools...

McCain: Are you able to have access to those systems that only have one key?

Comey: No, we can't break strong encryption.

McCain: So, you can't break it. And that is a mechanism which is installed by the manufacturer prevent you [sic] from using... that there's only one key that is available to them... to you.

Comey: That's correct.

Now, to his very slight credit, after this misleading back and forth, Comey eventually plays a slight devil's advocate here, and at least attempts to channel the views of all of those computer security experts who have pointed out that backdooring encryption makes people less safe.

McCain: So suppose that we had legislation which required two keys. One for the user and one that, given a court order, requiring a court order, that you would be able to -- with substantial reason and motivation for doing so -- would want to go into that particular site. What's the problem with that?

Comey: Well, a lot of smart people, smarter than I, certainly, say that would have a disastrous impact on broader security across the internet, which is also part of my responsibility.

McCain: Do you believe that?

Comey: I'm skeptical that we can't find a solution that overcomes that harm. But a lot of serious people say "ah, you don't realize, you'll rush into something and it'll be a disaster for your country. Because it'll kill your innovation, it'll kill the internet." That causes me to at least pause and say "well, okay, let's talk about it."

At which point McCain totally ignores that point to go back to his but we need to do something! mantra.

McCain: But, we've just established the fact that ISIS is rushing in to trying... attempting... to harm America and kill Americans. Aren't we?

Comey: They are.

McCain: So I say with respect to my colleagues, and their advocacy for our constitutional obligations and rights, that we're facing a determined enemy who is, as we speak -- according to you and the director of Homeland Security -- seeking to attack America, destroy America and kill Americans. So it seems to me that the object should be here, is to find a way not only to protect Americans' rights, but to protect American lives. And I hope that you will devote some of your efforts -- and I hope that this Committee... and I hope the Congress will -- understand the nature of this threat. And to say that we can't protect Americans' Constitutional rights in the same time protect America, is something that I, simply, won't accept.

Except, we can protect Americans' Constitutional rights and, at the same time, protect America: by enabling strong encryption that better protects the security and privacy of everyone, without adding unnecessary vulnerabilities in the form of government backdoors. McCain completely ignored the rebuttal point that his position actually makes America less safe by opening things up to those who wish to attack us.

Don't we deserve Senators who don't spout pure ignorance, focused on scaring the American public in ways that make us both less safe and take away the Constitutional rights they've sworn to defend?

There were plenty of other ridiculous claims made by Senators in both hearings, but these were the two nutty ones that stuck out for me. We deserve better elected officials.

Filed Under: congress, constitution, encryption, going dark, james comey, john mccain, senate, sheldon whitehouse

These Clueless Politicians Are The Ones Determining If The NSA Gets To Keep Spying On All Of Us

from the we-deserve-better dept

On Thursday, the 2nd Circuit appeals court delivered a huge win for people who believe in the 4th Amendment and civil liberties, even if the court didn't make it all the way to a 4th Amendment analysis. It still showed that the big metadata collection program that the NSA (and its defenders) claim is authorized by Section 215 of the PATRIOT Act clearly was not so authorized. The law is pretty clear that you can't do what the NSA is doing, but thanks to an ever-compliant rubber-stamp-wielding FISA Court, the program got a quick rubber stamp with little real thought. However, that's now changing (thanks to Ed Snowden...).

But the really incredible thing has been the reaction to this ruling by the politicians who are about to vote on surveillance reform. The claims are so ridiculous and so wrong that it makes you wonder how the hell these are the people in charge of determining the future of NSA surveillance. Let's start with Senator John McCain. Rather than discuss the specific reasoning in the ruling and the failures of the NSA and Congress that the case pointed out, McCain went with the kneejerk "But 9/11!" response even though it makes absolutely no sense at all in this context:

“It’s pretty clear that 9/11 could have been prevented if we had known about some of the communications that were linked to those who committed the terrible atrocity of 9/11.”

McCain added that the government has to balance that capacity with privacy and admitted that it has overstepped from “time to time.” While he called for a public debate to come to an agreement that balances privacy with security, he said it’s integral that Americans “understand” the threat.

“People seem to have forgotten 9/11,” he said.

“People don’t understand that there are thousands of young people all over the world who are motivated by this radical brand of Islam, which is our enemy.”

First of all, no, 9/11 would not have been prevented if this info had been available. While some have claimed that such a program would have allowed officials to track a phone call from Khalid al-Midhar, that story has since been debunked, as it was noted that federal officials were already tracking such info -- they just failed to put the information together in time. Meanwhile, as for all these repeats of "9/11, 9/11," it's worth remembering that even the leaders of the 9/11 Commission have said the surveillance program goes too far.

And, of course, none of that touches on what was actually in the ruling itself, which makes a really strong argument as to why the bulk phone records program is bogus and a violation of the 4th Amendment (no, it doesn't go all the way there, but lays all the groundwork for such a ruling). And, really, it's incredibly hypocritical to argue that because of an attack 14 years ago, we should completely give up our fundamental Constitutional freedoms. Is McCain seriously arguing that a single terrorist attack should wipe out the 4th Amendment?

Next up on the parade of cluelessness: Senate Majority Leader Mitch McConnell who not only continues to defend the bulk phone records collection, but is more adamant than ever that Section 215 of the PATRIOT Act must be renewed to keep that program going -- even though the court just clearly said that the law does not authorize such a program. But, even worse, McConnell still doesn't seem to understand even the most basic facts about the program he thinks it's urgent to renew. His main complaint about the alternative "USA FREEDOM Act" is this:

"The USA Freedom Act would replace Section 215 with an untested, untried, and more cumbersome system. It would not end bulk collection of call data," McConnell said, referring to the provision of the Patriot Act that the NSA says justifies its bulk data sweeps. "Instead, it would have untrained corporate employees with uncertain supervision and protocols do the collecting. So it switches this responsibility from the NSA, with total oversight, to corporate employees with uncertain supervision and protocols.

Except, he's 100% wrong. As in totally wrong. The data he's talking about are the phone records that every phone company already has and already keeps for a certain period of time. The bulk phone records program just makes sure that the same info is also given to the NSA. So, get rid of the program and the same employees at the same telcos with the same experience and training will still have access to it. Nothing changes on that front, no matter what insane thing McConnell says.

But that also doesn't stop Senator Tom Cotton from making the same absolutely incorrect claim:

"One alternative offered by opponents of this program is to have phone companies retain control of all call data and provide the NSA only the data responsive to searches phone companies would run on the NSA's behalf. This is not technologically feasible."

Uh, sure it's technically feasible. It's how plenty of other programs already function.

Seriously: how are these the people voting on this?

Or how about Marco Rubio? He also plays the stupid, wrong, debunked "would have stopped 9/11 card":

"Here's the truth. If this program had existed before 9/11, it is quite possible that we would have known that the 9/11 hijacker Khalid al-Mihdhar was living in San Diego and making phone calls to an al-Qaida safehouse in Yemen. There's no guarantee we would have known. Theres no way we can go back in time and prove it, but there is a probability that we would have known and there's a probability that American lives could have been saved."

Except, as already noted above, that claim was debunked by multiple people, including in a detailed ProPublica piece.

Rubio also went further in misrepresenting the program:

"The next time that any politician—senator, congressman, talking head, whatever it may be—stands up and says that the U.S. government is listening to your phone calls or going through your phone records, they're lying. It just is not true."

Rubio is setting up a strawman here. No one is saying that they're listening to your calls or "going through" your phone records (though they are doing that for some people. But everyone (now) openly admits that the NSA collects those phone records -- and that's the thing people are concerned about.

Finally, we have Senator Richard Burr, the head of the Senate Intelligence Committee, who's supposed to understand these programs. Yet he screwed up so badly that his office had to issue a correction and go back and literally rewrite the official transcript, after Burr claimed that the same program sucked up IP addresses in addition to phone numbers.

Either way, there's a lot of pure FUD going on out there right now, almost all of it in the service of trying to let the NSA keep its toys and continue to undermine the 4th Amendment. Don't let them get away with it.

But, even more importantly, people should be asking: why are we letting these idiots make the decision on this stuff when they either don't understand it or are outright lying to the American public?

Filed Under: bulk collection, john mccain, marco rubio, mitch mcconnell, nsa, patriot act, richard burr, section 215, senators, surveillance, tom cotton, usa freedom act

Maximum Orwell: Ending The War Without End, By Enabling A New War Without End... And Less Oversight

from the 60-words dept

If you haven't yet come across it, you should listen to the recent Radiolab episode entitled "60 Words." It's a bit different from the standard Radiolab fare, instead presenting a somewhat chilling look into the infamous 60 words in the AUMF -- the "Authorization to Use Military Force" that was written immediately after the September 11, 2001 attacks, and whereby Congress basically gave the President the "authority" to use the military to go after terrorists, no matter where they lived. The Radiolab episode was done in partnership with Gregory Johnsen of Buzzfeed, who had written up a similar piece a few months earlier, "60 Words And A War Without End." It talks about the history and importance of those 60 words -- and also how the interpretation of those 60 words changed over time, in a very dangerous manner.

By now, after having followed the whole NSA debacle for quite some time, we're getting used to how words are twisted by the executive branch to mean something Congress clearly did not intend, and here the amazing thing is the story of how the Defense Department suddenly started inserting "associated forces" into its explanation of who they were targeting. You see, those short 60 words were as follows:

That the President is authorized to use all necessary and appropriate force against those nations, organizations or persons he determines planned, authorized, committed or aided the terrorist attacks that occurred on September 11, 2001, or harbored such organizations or persons in order to prevent any future acts of international terrorism against the United States by such nations, organizations or persons.

Note that it appears to be focused just on those who planned the September 11th attacks. But, the executive branch has conveniently reinterpreted it to mean "anyone we consider to be a terrorist" by repeatedly claiming that it applies to "associated forces." You'll note, of course, that "associated forces" does not appear anywhere in the statement, but it hasn't stopped the Pentagon from reading that into the agreement. While a judge, John Bates -- whose name you might recognize from various FISA court rulings -- questioned this obvious expansion of the AUMF, eventually he rubber stamped this broad interpretation. From there, the government has just assumed that anyone they classify as a terrorist organization is an "associated force" and can be targeted.

What was supposed to be a rather routine Senate hearing early in Obama’s second term provided a glimpse into just how expansively the administration had been interpreting the sentence at the heart of the AUMF. On May 16, 2013, the Defense Department sent a quartet of officials to the Capitol to answer questions about the AUMF and the current state of the war against al-Qaeda. In the course of their joint testimony, Michael Sheehan and Robert Taylor, who were speaking for the four, both claimed that the 2001 AUMF and its 60 words were “adequate” for the administration’s needs.

Sheehan, a balding former counterterrorism official with the New York Police Department who looked like he had forgotten to shave that morning, spoke first. The administration, he told the senators, was “comfortable” with the AUMF as it was currently structured because it didn’t “inhibit us from prosecuting the war against al-Qaeda and its affiliates.”

Sen. John McCain was incredulous. Shuffling through some papers, the 76-year-old senator pulled out a copy of the AUMF and started reading. Twenty-four seconds later he finished the 60-word sentence, and then he started to lecture. “This authorization was about those who planned and orchestrated the attacks of September 2001,” McCain said, staring down toward the witness table. “Here we are, 12 years later, and you’re telling us that you don’t think it needs to be updated,” he continued. “Well, clearly it does.”

Following that, Senator Angus King finally asked about this repeated claim of "associated forces" by noting it's not anywhere in the AUMF:

“The AUMF is very limited, and you keep using the term ‘associated forces’ — you use it 13 times in your statement — that is not in the AUMF,” King said, before adding, “I assume [the AUMF] does suit you very well because you’re reading it to cover anything and everything.”

That happened a year ago, and more or less woke up a bunch of people -- including experts who didn't realize it before -- that the administration had totally reinterpreted the AUMF from a narrowly constructed, limited authorization for military intervention into one that was broad, all-encompassing, and never-ending.

Oh, and then it gets worse, because the US government refuses to identify what it believes the AUMF actually covers -- and, in fact, it has a secret, classified list of "associated forces." You may recall that, at about the same time as this hearing happened, the Chelsea Manning trial was happening -- and we pointed out that among the charges was that he was aiding the enemy... but the "enemy" was classified. We thought that was crazy. How can you be accused of aiding an enemy when the enemy itself is not named. Even worse, just the idea of having "classified" enemies raises serious questions about what sort of expansive war the government has created. It out-Orwells even Orwell.

And, of course, soon after that, President Obama talked about finally closing the door on the AUMF, but hadn't done anything to actually do that. That finally brings us to today, where Congress is finally talking about revisiting the AUMF. Unfortunately, as we've seen with the NSA as well, when some people talk about "revisiting" the AUMF -- or even when they talk about "limiting" it, the reality may be that they're looking for ways to expand and broaden it. As Adam Sewer at MSNBC notes:

But again, those who want to revisit the AUMF don’t necessarily want the Obama administration or future presidents to pursue Al-Qaeda less aggressively, they just want to make sure that aggression has the force of law behind it. Crafting legislation that appears to narrow the 2001 authorization, while in effect expanding it, would not be too difficult.

And while Senator McCain has criticized the government's interpretation of the AUMF, saying he didn't believe it gave the President authority to fight terrorism in places like Yemen and Somalia, it appears he's willing to authorize those kinds of wars anyway.

“It does not need to be repealed, but it is hard for me to understand why you would oppose a revision of the Authorization to Use Military Force in light of the dramatically changed landscape that we have in this war on Muslim extremism and al Qaeda and others.”

Perhaps the most chilling part in any of these stories comes towards the end of the Radiolab episode, right after they cover President Obama talking about ending the AUMF -- and "ending the war." From there, the President then talks about the rules for drone strikes, which we've covered here as well, in which he appears to indicate the power to do that... without the AUMF. From the Radiolab episode:

Jad Abumrad: How do you end a war when the vast amount of the people that you're calling "the enemy," haven't stopped fighting?

Benjamin Wittes: So, what he does, in the May speech, and it's extremely clever -- and, by the way, it's really well lawyered -- is he announces a set of rules, going forward, for drone strikes.

President Obama (giving the speech): America does not take strikes to punish individuals. We act against terrorists who pose a continuing and imminent threat to the American people.

Wittes: ... that he's only going to use drone strikes when there's an imminent threat.

Abumrad: And it's well understood, by people who understand this kind of stuff, that in the Constitution and also in international law, the President is allowed to act unilaterally, in self-defense, when there is an imminent threat. Meaning, it's urgent and you can't feasibly capture that person. Ben fears that what President Obama was doing there, by stressing that word...

Obama speech: ... an imminent threat to the American people...

Abumrad: ... is that he was laying a new foundation. He was saying, 'when the AUMF ends -- and I want it to end -- I do have another way of justifying all these things.'

Wittes: ... maybe they wouldn't change.

Abumrad: So the drone strikes, and the raids would continue.

Wittes: As long as you have a capacious enough understanding of what the word "imminent" means, you might be able to continue a lot of this stuff. And then you don't have to go to Congress at all. And you can say you ended the war. And the human rights groups will cheer for you. And we'll mysteriously find that there are a whole lot of "imminent threats."

Obama speech: ... for freedom!

Right. So, while it's nice to see Congress talking about finally revisiting the AUMF, none of this may end.

Filed Under: 60 words, angus king, associated forces, aumf, barack obama, drones, imminent threat, john mccain, terrorism, war without end

Senator McCain Says Snowden Is Working For Putin Based On 'Timing' Of News Reports Snowden Has Nothing To Do With

from the our-elected-officials dept

It appears that Senator John McCain is the latest to insist that Ed Snowden is working for the Russians. And while Mike Rogers has been pushing that line for quite some time (despite no evidence to support it, and the fact that the DOJ, the FBI and even Senator Dianne Feinstein have said there is no evidence of it being true), McCain has an even more ridiculous reason for claiming it's true: the "timing" of the news reports based on the documents Snowden gave to reporters:

McCain said he believed Snowden was working with Russia, “because of the timing of his releases of this information. If you look at the timing it’s when certain issues have been before us.”

There's just one huge glaring problem with that. Snowden has absolutely nothing to do with the timing. Snowden gave a large pile of documents to Glenn Greenwald, Laura Poitras and Barton Gellman. Some of those documents have been shared with certain publications, including reporters at The Guardian, the NY Times and Der Spiegel. But as everyone who's been reporting on these issues has noted, Snowden has had zero input in what was being reported on and when. The "timing" has always been up to the various publications. So, based on McCain's claims, he is actually suggesting that the NY Times and The Guardian, among others, are actually "working for Russia" and taking orders from Putin on when to publish certain news. I would think that even among the wacky conspiracy theorists out there, such a contention is plainly idiotic.

Filed Under: ed snowden, john mccain, journalism, reporting, russians

John McCain Proposes A New Senate Committee To Do What The Intelligence Committee Is Supposed To Do

from the don't-we-have-that-already dept

The Senate Select Committee on Intelligence came out of the Church Committee, which was set up to explore abuses by the intelligence community, and to create a more functioning oversight of the intelligence community. Of course, as we've seen over the years, what started out as an effort to rein in abuses and to make sure the intelligence community plays by the rules, has instead turned into a committee to basically be complicit in many of those abuses and to try to run interference in Congress against any attempt to stop them. Either way, it seems somewhat ironic that Senator John McCain, who is not currently a member of the Intelligence Committee, has now proposed a brand new "select committee" to explore Congress's oversight of the intelligence community. Think of it as a shadow intelligence committee.

The full resolution even notes:

Whereas senior officials in the intelligence community may have misled Congress or otherwise obfuscated the nature, extent, or use of certain intelligence-collection programs, operations, and activities of the National Security Agency, including intelligence-collection programs affecting Americans;

Whereas the provision of incomplete or inaccurate information by officials of the intelligence community has inhibited effective congressional oversight of certain intelligence-collection programs, operations, and activities of the National Security Agency, including intelligence- collection programs affecting Americans, and undermined congressional and public support of these programs;

That said, I wouldn't think of this so much as a new Church Committee at all. While the above sections do suggest some interest in reining in a rogue intelligence community, much of the other aspects of the proposed committee are focused on things like exploring how the Snowden leak happened in the first place, whether or not the NSA should stop using contractors, and whether or not the Snowden leaks "harmed" US spying methods (note that they don't seem to want to explore whether or not informing the public may actually help).

So, yes, this proposed committee seems more like the status quo, but at the same time, something of a slap in the face to the existing Intelligence Committee and the fact that it doesn't seem to have done its job.

Filed Under: congress, ed snowden, intelligence committee, john mccain, leaks, select committee, surveillance

John McCain Now Pretends He Didn't Say Keith Alexander Should Resign; Gives Nonsensical Explanation

from the accountability-how? dept

We just wrote about Senator John McCain calling for NSA boss Keith Alexander to either be fired or resign -- though for the exact wrong reasons. Specifically, he wants him fired for letting little people like Ed Snowden and Chelsea Manning have access to important documents and also for having embarrassing facts (like that we spy on McCain's friends in high places, like Angela Merkel) revealed. Let's be clear. Here is McCain's exact quote:

SPIEGEL: Should Keith Alexander, head of the NSA, resign?

McCain: Of course, they should resign or be fired.

While a bit odd that McCain would refer to Alexander as plural, it's hard to say that he didn't say that. But, guess what? His press people are now trying to walk this back, and saying that McCain did not say what he actually said.

“Senator McCain believes that there needs to be accountability for the Snowden leaks, but he is not calling for the resignation of General Alexander, who is retiring soon,” McCain spokesman Brian Rogers told POLITICO. < ?i>

Actually, he did call for his resignation (or firing). Quite directly, as noted above. Separately, just what kind of "accountability" is he calling for? In the interview, he clearly said those responsible should be fired or resign. Of course, perhaps someone reminded him that Alexander is an "important person" like himself, Merkel and other top politicians, and he realized that "accountability" only applies to the little people.

Filed Under: accountability, ed snowden, john mccain, keith alexander