President Obama To Encourage Cybersecurity Information Sharing, Highlighting Why We Don't Need CISPA

from the don't-destroy-privacy-in-the-name-of-cybersecurity dept

There's a big "White House Cybersecurity Summit" down the road at Stanford today, where the President will release the details of a new executive order promoting "a framework for sharing information about cyber threats" which the administration hopes will lead organizations to better protect their data from malicious hacks.

The new executive order encourages businesses to form "information sharing and analysis organizations," or ISAOs, which would gather data about hacking attacks and share it with companies and the government.

And, of course, a bunch of companies are going to announce that they're doing just that:

A number of companies will announce Friday that they are incorporating the administration's cybersecurity framework, which was created after a 2013 executive order, into their companies. The framework helps businesses decide how to use cybersecurity investments, ways to implement cybersecurity for new companies and measure their programs against others. Intel, Apple and Bank of America use framework and will announce that they will require all vendors to use it. Both QVC and Walgreens will say they will employ the framework in their risk management practices, while Kaiser Permanente will commit to using it as well.

Of course, if you've been following the big fights over the past few years on cybersecurity legislation, you'll know that such "information sharing" has been a key component in most of the proposed bills, none of which have become law. Most of the bills have focused on one key thing: giving companies liability protection, so that they can't be sued over the information they share. From the beginning, however, we've asked a pretty simple question that no one has answered: what is currently preventing companies from sharing such threat information?

The answer, as reinforced by this move today by the White House, is absolutely nothing. Companies can (and in some cases already do) share "threat" information, and having them do so in a more organized fashion to prevent malicious attacks is, in fact, a good idea. What's not needed is a law that basically gives blanket immunity for companies to share almost any information to any government agency. That's been the problem with CISPA, CISA and similar bills: they're not about truly making information sharing about threats easier, since that can be done already. They're about giving blanket cover for companies to share even more information with government agencies such as the NSA.

With this new executive order and companies adopting the suggested framework, many of the "benefits" backers of cybersecurity legislation talk about will happen without the need for any new legislation. True threat information can be shared and companies can get wiser about protecting their information. But it doesn't give them blanket immunity if they start handing over other information to the government for other purposes, such as surveillance. That's important.

Yes, working together to prevent the growing number of online attacks is important. But that should never be used as a backdoor process to enable greater surveillance. Doing it this way, rather than by passing a questionable law, seems like a much more reasonable first step.

Filed Under: cisa, cispa, cybersecurity, cybersecurity summit, cyberthreat information, dhs, executive order, information sharing, obama administration, president obama, white house

If The DOJ Gets Its Way, Tweeting Out A List Of The 'Worst Passwords On The Internet' Will Be A Felony

from the because-our-prisons-aren't-at-maximum-capacity dept

Retweet if you want to go to jail! And not regular county jail, but federal prison!

Under the DOJ's CFAA proposal, this article (and this tweet linking to it) could be a 10 year felony. That's insane. http://t.co/njE8368lxU

— Nate Cardozo (@ncardozo) January 20, 2015

In case you can't read/see the tweet, it says:

Under the DOJ's CFAA proposal, this article (and this tweet linking to it) could be a 10 year felony. That's insane.

(The link goes to a Techcrunch article featuring SplashData's list of the "worst passwords on the internet.")

The DOJ has offered up its preferred version [pdf link] of the CFAA (Computer Fraud and Abuse Act) -- under the ridiculous name of "Updated Law Enforcement Tools" -- and it indeed would make this sort of thing an instant felony.

Here's the wording change that does it [strikethrough for deletions; bold for additions]:

(6) knowingly and with intent to defraud willfully traffics (as defined in section 1029) in any password or similar information, or any other means of access, knowing or having reason to know that a protected computer would be accessed or damaged without authorization in a manner prohibited by this section as the result of such trafficking; if—

(A) such trafficking affects interstate or foreign commerce; or

(B) such computer is used by or for the Government of the United States;

The DOJ removes intent and replaces it with feelings. Sharing a list of common (and stupid) passwords could be construed as "willfully trafficking" passwords while "knowing" a "protected computer" could be "accessed without authorization."

And that thing about federal prison I opened the post with? That's the way the DOJ wants it. The CFAA currently allows for misdemeanor charges under certain circumstances. But this proposal does away with that. Instead of a misdemeanor-to-3 year sentence range, punishments start at 3 years and escalate to a 10-year cap. Unless, of course, your hacking is part of the commission of another felony, in which case the government proposes it should get to double dip (at minimum). Here's Orin Kerr's take on that part of the proposal:

Under the proposal, breaching a written restriction is a crime if the user violated the written condition in furtherance of a state or federal felony crime, “unless such violation would be based solely on obtaining the information without authorization or in excess of authorization.” On one hand, this might seem kind of harmless, or at least redundant: The proposal makes it a felony to break a promise on a computer in furtherance of a felony. One wonders what the point is: Why not just punish the underlying felony?

But the real problem is the double-counting issue. Federal and state law is filled with overlapping crimes. Congress might enact three crimes that do the same basic thing, giving prosecutors the choice of which to charge or allowing them to charge all three. State criminal codes often mirror the federal criminal code. That raises a question: If Congress makes it a crime to commit an act “in furtherance of” a different crime, does the existence of overlapping crimes mean that a person’s conduct violates the first crime because it was “in furtherance of” the second? This is a particular problem because every state has unauthorized access crimes a lot like the CFAA. We saw this in the Auernheimer case, where prosecutors argued that the misdemeanor federal unauthorized access alleged in that case should be a felony because it was “in furtherance of” New Jersey’s nearly identical state unauthorized access law.

As if we didn't have enough people in prison already, the DOJ proposal mandates felony charges and provides prosecutorial options to ensure very few defendants walk away with short sentences.

The proposal also asks users to perform mind-reading when accessing anything computer-based.

(6) “exceeds authorized access” means to access a computer with authorization and to use such access to obtain or alter information in the such computer—

(A) that the accesser is not entitled so to obtain or alter; or

(B) for a purpose that the accesser knows is not authorized by the computer owner;

Going back to the Weev case, Andrew Auernheimer obviously knew AT&T would not "authorize" his access of supposedly private information, even if all he did was alter URL components to achieve this. Now, companies' security failures can be weaponized against those who discover them -- making it highly unlikely that flaws and holes will be pointed out to those who can actually close them. Why risk a few years in federal prison (remember: no misdemeanors) just because some entity decided to shoot the messenger rather than thank them for their help?

Filed Under: cfaa, doj, felony, obama administration, passwords

President Obama's Plan For 'Securing Cyberspace' Has A Lot Of Problems

from the not-the-public's dept

On Monday, President Obama gave a speech kicking off his big push on cybersecurity, with many of the details being released on Tuesday, and they don't look very good. There are a lot of different pieces, but we'll just highlight the two that concern us the most.

First up: information sharing/"cybersecurity." The key issue here: is it the return of CISPA? CISPA, of course, is the cybersecurity "information sharing" bill that is introduced each year, but which is really about giving the NSA a tool to pressure companies into sharing their information (by granting immunity from liability to those companies). In 2012, President Obama rejected the CISPA approach as not having enough protections for privacy and civil liberties. And, indeed, contrary to what some have said, the official proposal is not "endorsing CISPA." The approach is definitely more limited and the most major concern is addressed. Rather than giving the information to the NSA (or the FBI), Homeland Security gets it. DHS isn't wonderful, but it's better than the other two alternatives. Companies can still give the info to the NSA or FBI (or others), but won't get full immunity from lawsuits if they do.

But, where the new proposal falls woefully short is in its lack of privacy protections. It basically handwaves its way through the privacy question, saying there will be guidelines, but the guidelines aren't written yet, and they're fairly important here. Instead, there's just a plan to make them:

The Attorney General, in coordination with the Secretary of Homeland Security and in consultation with the Chief Privacy and Civil Liberties Officers at the Department of Homeland Security and Department of Justice, the Secretary of Commerce, the Director of National Intelligence, the Secretary of Defense, the Director of the Office of Management and Budget, the heads of sector-specific agencies and other appropriate agencies, and the Privacy and Civil Liberties Oversight Board, shall develop and periodically review policies and procedures governing the receipt, retention, use, and disclosure of cyber threat indicators by a Federal entity obtained in connection with activities authorized in this Act.

Yes, it promises that those guidelines will limit the "acquisition, interception, retention, use and disclosure" of information, but it's still not entirely clear what the final guidelines will be. The second problem, still not addressed in all of this, is explaining why this is needed. People keep saying that we need "information sharing" because of "cyberthreats," but no one argues why that information sharing can't happen today, or points out what regulations today get in the way. That's because they don't. Companies can share information today, but the focus of this bill is to try to grant them broad immunity in case they share the wrong (private) info and it gets out.

The second concerning proposal is with the update to the CFAA (the Computer Fraud and Abuse Act). The CFAA, of course, is the widely misused "anti-hacking" law that has been stretched and twisted by law enforcement and prosecutors over time to argue that merely disobeying a terms of service could be seen as "hacking." While some courts have limited that ridiculous interpretation, the changes here seem fairly messy and could bring back that possibility. The language involves a lot of careful picking through to interpret it, and it appears that it may fix some small issues with the CFAA, but opens up other massive holes that are seriously problematic. The White House claims this fix would "enhance [the CFAA's] effectiveness against attacks on computers and computer networks."

But that's not the problem with the CFAA. The problem is that it's already seriously overbroad and used in dangerous ways. That's barely addressed. The main "fix" is that if you "intentionally exceed authorized access," there are conditions necessary to meet to trip the CFAA wire -- and a key one is that the value of the information obtained must "exceed $5,000." But, of course, with the way the gov't inflates the value of information... that seems like a pretty small hurdle. The really big problem, though, comes in section (e)(6) which adds in a troubling definitional change to "exceeds authorized access." This is the whole bit that's been used as evidence of "terms of service" violations. The key case that rejected this theory is the Nosal case and that seems to be completely wiped out with this little addition to exceeding authorized access:

for a purpose that the accesser knows is not authorized by the computer owner;

This is likely to be interpreted to mean that if a terms of service bans a certain type of use, they have "knowledge" and thus violating that kind of use is back to being a problem under the CFAA. As Orrin Kerr argues, this could be read to mean that if your employer says you can only use a computer for work reasons, and you surf for personal reasons, you've broken the law. It is also possible to read this section to mean that using someone else's Netflix or HBO GO password... could violate the law. Yikes!

Of course, one hopes that law enforcement wouldn't go after those types of violations, but a more serious concern may be the impact on security research. Finding a hole in a website online, allowing you to access data that was publicly exposed could be seen as exceeding access, on the basis that whoever finds it "knows [it] is not authorized by the computer owner." Basically, it requires the government to argue that whoever they're going after should have known that the computer owner "wouldn't like" it. That... opens up a big can of worms that the DOJ will abuse like crazy.

The new bill also says that you can be charged with racketeering related to CFAA violations, so long as the government can tie you to other people and claim that it's an "organized crime group." It also ups the penalties for things that might be considered "actual hacking" (i.e., getting around technological barriers to access a computer) -- making it automatically a felony with up to 10 years in jail (rather than the existing law, under which it could be a misdemeanor or a felony and the limit is 5 years in jail). And, of course, it expands civil forfeiture procedures so that law enforcement can seize (and likely keep) all your computer equipment if it thinks you're violating the CFAA. Looks like law enforcement can now go "shopping" for computers.

Once again, we seem to be facing a situation where the administration is more focused on what law enforcement wants, while paying lip service to the protections of the public from likely law enforcement and intelligence community abuse.

That's really unfortunate. A massive missed opportunity to actually do something productive here.

Filed Under: cfaa, cispa, cybersecurity, obama administration

White House Responds To Petition About Aaron Swartz By Saying Absolutely Nothing

from the that's-a-response? dept

Soon after the unfortunate suicide of Aaron Swartz, a lot of anger was directed at Carmen Ortiz, the US Attorney who was the key figure behind the ridiculous prosecution of Swartz for daring to download too many documents (that he had legal access to, as did anyone connecting to MIT's network). Ortiz showed no concern at all that either she or her office had done anything improper in threatening Swartz with over 30 years in jail for downloading (legally) some academic papers. As a result some people set up one of those "We the People" White House petitions, asking the Obama administration to remove Ortiz from her job.

This petition had no chance. Petitions are supposed to be used to get the White House to discuss or commit to policy positions. Specific personnel decisions seem way outside the scope. Besides, as bad a job as we may think Ortiz did in handling the Swartz situation, frankly, it's not the kind of thing the White House will ever come out and say directly. That's just not how it works.

Similarly, while at times the "We the People" petitions have been useful in forcing the White House's hand on things, for the most part, the administration seems to ignore most of them, even if they got the required 100,000 signatures demanding a response.

So I'm at a total loss as to why the White House suddenly decided -- two years later -- to respond to the petition to remove Ortiz from her job, and to basically say... absolutely nothing in response:

Aaron Swartz's death was a tragic, unthinkable loss for his family and friends. Our sympathy continues to go out to those who were closest to him, and to the many others whose lives he touched.

We also reaffirm our belief that a spirit of openness is what makes the Internet such a powerful engine for economic growth, technological innovation, and new ideas. That's why members of the Administration continue to engage with advocates to ensure the Internet remains a free and open platform as technology continues to disrupt industries and connect our communities in ways we can't yet imagine. We will continue this engagement as we tackle new questions on key issues such as citizen participation in democracy, open access to information, privacy, intellectual property, free speech, and security.

As to the specific personnel-related requests raised in your petitions, our response must be limited. Consistent with the terms we laid out when we began We the People, we will not address agency personnel matters in a petition response, because we do not believe this is the appropriate forum in which to do so.

If that's the answer, why bother responding at all? Even the opening statement expressing concern for Swartz's family and friends rings hollow. While I know, for a fact, that some in the White House absolutely do understand what Swartz meant to the internet, this response is incredibly weak. Of course, even though they couldn't do anything or say anything about Ortiz, an announcement like this (two years later) could have been tied to some sort of program on internet openness, or increasing access to public domain works, or any of a number of projects and campaigns that Swartz was close to. There was no real reason to pick up this thread now, but having decided to answer the petition now, the White House certainly could have done something a lot more productive with it.

Filed Under: aaron swartz, carmen ortiz, obama administration, petition, we the people, white house

In Another Meaningless Gesture, Administration Smacks North Korea With Sanctions Over Sony Hack

from the US-Government-steadies-finger,-points dept

Never doubt the power of motion picture studios. The US government is moving ahead with plans to smack around North Korea for the Sony Pictures hack. That this is seemingly based on nothing more than a strong hunch by the FBI doesn't seem to matter. The wheels are rolling and the scapegoat will be properly chastised.

Symbolic actions and symbolic words are being handed down by the administration, under the unlikely moniker of "a proportionate response." Sanctions are being levied against ten North Korean officials, even as other unnamed administration officials admit there's no evidence those named were behind the attacks in any form. Let's all enjoy this quote, which shows the US government is willing to defend the honor of Sony Pictures even at the expense of its own reputation.

“It’s a first step,” one of the officials said. “The administration felt that it had to do something to stay on point. This is certainly not the end for them.”

There you have it. There will be more symbolic stupidity in the future, if only for consistency's sake. The next question is: if the goal is to deliver a knockout blow, how effective are continued head punches when the target has already lost consciousness?

The actions may well turn out to be more symbolic than substantive: North Korea already faces some of the heaviest sanctions of any country.

The North Korean government doesn't really care if more sanctions are handed down. It hasn't made many attempts to ingratiate itself with the US. It is resolutely its own evil empire and appears to be happy being one of the world's villains.

Once you get beyond the futile administrative shouting, there's the reality of the situation: there's really not much evidence pointing to North Korea's involvement in the Sony hack. So, even if the sanctions are effective, they're likely misguided.

The link between the hacking and the North Korean government's public damnation of "The Interview" is extremely tenuous. The hackers behind the attack never linked their actions to the film until after the press did. Additional information points in various directions, but nothing directly at the North Korean government. The evidence the FBI was willing to part with only indicates that the malware used resembles malware used in previous NK hackings -- which is really just saying malware that works well tends to resemble other malware that works well. It's not a smoking gun. It's not even a gun in a safe with the clip removed. It's a finger in a coat pocket -- something that only looks slightly dangerous/damning when hidden, but completely ridiculous when out in the open.

But the US government has decided North Korea is to blame and the North Korean government is only too happy to alternate between evil empire and unfairly besmirched world citizen. The question is: who is the administration scoring points for by pursuing sanctions against an entity that hacked a private corporation? Even if the administration is privy to information that definitively indicates North Korea's involvement, why is it throwing its weight behind an incident that was more embarrassing than damaging? Countless American businesses have been hacked over the past several years, leaving millions of Americans' personal information exposed… and little to no response from the US government. But spring loose a few thousand internal emails dealing with celebrity squabbling, MPAA/state AG collusion and other internal issues, and suddenly, it's time for America to go to (cyber)war.

Filed Under: north korea, obama administration, sanctions, sony hack
Companies: sony

DOJ Secretly Helped Kill FOIA Transparency Bill That Was Based On Its Own Public Policy

from the most-transparent-administration-in-history dept

We've long known the Justice Department's stance on transparency has been hypocritical and disingenuous. But they've really outdone themselves this time. Last week, the agency secretly helped kill a bipartisan Freedom of Information Act (FOIA) reform bill that was based word-for-word on its own policy.

First, a little background: In a surprise to some, the very modest FOIA Improvements Act died in Congress last Thursday, despite virtually unanimous support in both houses. The bill was completely uncontroversial. It merely would have upgraded agencies' ability to accept FOIAs electronically and codified existing policy—mainly President Obama's now infamous January 20, 2009 memo in which he ordered federal agencies to operate under a "presumption of openness."

All Speaker John Boehner had to do on the last day before Congress adjourned for the year was bring the bill up for a vote, and it would've been whisked through to the President's desk. A similar bill had already passed the House unanimously earlier in the year.

Yet for some unknown reason at the time, he didn't. On Tuesday, the Washington Post reported on the inside story behind the last-minute death of the bill, and the blame centers on the Justice Department:

According to House aides, some lawmakers balked at the legislation because several agencies, including the Justice Department, warned that those making information requests would use the "foreseeable harm" requirement as the basis for frequent lawsuits.

The "foreseeable harm" section referred to by the Post would force federal agencies to justify withholding information if they wished to do so. Essentially, they would have to show the information would cause "foreseeable harm" if released. Not exactly a tall order. But what makes the Justice Department's objection so shocking is that this "foreseeable harm" provision would not deviate at all from the Justice Department's own policy. In fact, it was based on it.

In a March 19, 2009 memo to all federal agencies, Attorney General Eric Holder himself wrote that the Justice Department would carry out Obama's aforementioned transparency order by rescinding the Bush DOJ's more restrictive FOIA rules and designating new ones. From that moment on, Holder declared:

[T]he Department of Justice will defend a denial of a FOIA request only if (1) the agency reasonably foresees that disclosure would harm an interest protected by one of the statutory exemptions, or (2) disclosure is prohibited by law.

Now read full text of the provision in the just-killed FOIA reform bill that the Justice Department allegedly objected to:

An agency shall withhold information under this section only if a) the agency reasonably foresees that disclosure would harm an interest protected by an exemption described in subsection or other provision of law; or b) disclosure is prohibited by law

As can be seen, the two passages are virtually identical. How does the Justice Department think this provision will lead to more lawsuits it would have to defend if they're not supposed to be defending those lawsuits in the first place?

The Justice Department is objecting to making its own supposed policy the law, and confirms what many have long believed: the agency does not want to—or have to—comply with its own FOIA rules.

The DOJ has repeatedly been criticized for failing to enforce, and downright ignoring its own FOIA guidance for years, and their stance on transparency in general has been incredibly hypocritical. For example, Holder has claimed he wanted the torture report to be public as soon as possible, meanwhile fighting in court to prevent the release of any documents on its own torture investigation. Likewise, he's claimed the Justice Department supports a federal shield law so reporters can protect their sources, while at the same time destroying the already-existing reporter's privilege in the Fourth Circuit

But this most recent development is just beyond the pale.

We had a feeling that the Justice Department was behind the initial delay in getting the bill passed months ago after receiving a tip from a knowledgeable source. In July we filed a FOIA request for emails between the Justice Department and the offices of the FOIA bill's co-sponsors John Cornyn and Patrick Leahy that discuss the agency's position on the bill. We've been waiting six months and still have gotten no response.

Now we know why.

Reposted from Freedom of the Press Foundation

Filed Under: doj, foia, obama administration, transparency

Obama Administration Has Put Media Leakers In Jail For Nearly 50 Times As Long As All Other Administrations In History

from the ouch dept

We've been among those who have pointed out that the "most transparent administration in history," the Obama administration, has prosecuted media leakers more than all other Presidents in history combined (eight prosecutions in this administration, compared to three total in all previous administrations). Gabe Rottman, over at the ACLU, decided to dig into another stat: how much time has the Obama administration been able to lock up media leakers in jail compared to all other administrations. The answer? The Obama administration has put folks who leaked info to the media in jail for 526 months as compared to 24 months for all other Presidents combined. Admittedly, 420 of those months went to Chelsea Manning, but even if you take that out, we're still talking 106 months for other leakers in cases from this one administration vs. 24 months for all other administrations.

It once again has to make you wonder why the Obama Administration is so focused on punishing anyone who leaks information to the media (even as it likes to "unofficially" leak information all the time). In the end, I keep going back to the speculation I heard from Daniel Ellsberg nearly four years ago (which is also where I first heard the stat about the number of Obama prosecutions against leakers -- at that time, it was just five prosecutions, rather than eight).

Ellsberg's theory was that while President Bush abused the power of the Presidency in the surveillance realm, he was actually proud of it. And while people were upset about secrets leaking, they didn't find it embarrassing. President Obama, on the other hand, came into office claiming to be different -- arguing against those kinds of abuses and promising changes and protections for civil rights. Instead, it appears that the process started under President Bush continued and expanded under President Obama and -- Ellsberg speculated years ago -- the President is somewhat embarrassed by this, leading him and his administration to react negatively to the leaks. Not because of any legitimate security concern, but to try to silence those who seek to reveal that the administration and the President have not come close to living up to their ideals but rather went the other way entirely.

Putting those who leaked info to the media in jail for 526 months -- nearly 44 years -- says a lot about the way the administration truly views whistleblowing, and it's not a saying anything good.

Filed Under: chelsea manning, espionage act, free speech, leak prosecutions, leaks, obama administration, reporting, transparency, whistleblowing

White House Says Its Rules Limiting Drone Attacks To Avoid Civilians Don't Apply In Syria

from the rules?-fuck-the-rules dept

When the US finally set up some "rules" for its extrajudicial killing-via-drones (after years of no rules at all, which allowed the CIA to "acquire a taste for killing people with drones"), one of the "rules" was that drone bombs wouldn't be used unless there was a "near-certainty that no civilians will be killed or injured." As President Obama noted, this was "the highest standard we can set" to avoid civilian casualties via drones. This high standard upset some bloodthirsty hawks like Rep. Mike Rogers, who saw things like actually trying to prevent civilian casualties as unnecessary "red tape." And, in fact, soon after the rules were in place, the Obama administration itself started realizing that it didn't really like the restrictions it put on itself.

So it's just going to ignore them. Last week, we wrote about how the administration has been redefining pretty much everything to justify the attacks on Syria, including what is meant by "civilian." However, even with that new definition, they've run into some very obvious problems: namely that there's increasing evidence that (despite repeated denials) the bombings did, in fact, kill civilians.

No problem, apparently, for the Obama administration, which has now decided that the very rules it set up in the past to avoid killing civilians with drones... no longer matter. Basically, it looks like the Obama administration just added a big fat asterisk to the "near-certainty" standard for civilian deaths, whereby those rules can be ignored... because the Obama administration says "this is different."

At the same time, however, Hayden said that a much-publicized White House policy that President Obama announced last year barring U.S. drone strikes unless there is a “near certainty” there will be no civilian casualties — "the highest standard we can meet," he said at the time — does not cover the current U.S. airstrikes in Syria and Iraq.

The “near certainty” standard was intended to apply “only when we take direct action ‘outside areas of active hostilities,’ as we noted at the time,” Hayden said in an email. “That description — outside areas of active hostilities — simply does not fit what we are seeing on the ground in Iraq and Syria right now.”

It's not much of a rule when you can exempt it based on... deciding to exempt it.

Filed Under: civilians, drones, extrajudicial killing, obama administration, rules, syria

Obama Administration Learns: If You Redefine Every Word In The Dictionary, You Can Get Away With Just About Anything

from the words-mean-something dept

We've written before about how the NSA uses its own definitions of some fairly basic English words, in order to pretend to have the authority to do things it probably... doesn't really have authority to do. It's become clear that this powergrab-by-redefinition is not unique to the NSA when it comes to the executive branch of the government. Earlier this year, we also wrote about the stunning steady redefinition of words within the infamous "Authorization to Use Military Force" (AUMF) that was passed by Congress immediately after September 11, 2001. It officially let the President use "all necessary and appropriate force" against those who "planned, authorized, committed or aided the terrorist attacks that occurred on September 11, 2001." But, over time, the AUMF was being used to justify efforts against folks who had nothing to do with September 11th, leading to this neat sleight of hand in which the military started pretending that the AUMF also applied to "associated forces." That phrase appears nowhere in the AUMF, but it's a phrase that is regularly repeated and claimed by the administration and the military.

But, it goes beyond that. As Trevor Timm highlights over at The Guardian, pretty much the entire drone bombing (drones, by the way, are also apparently "authorized" by the AUMF) of Syria involves the administration conveniently redefining basic English to suit its purposes. Let's start with the authorization for the bombing itself:

For instance, in his Tuesday statement that US airstrikes that have expanded into Syria, Obama studiously avoided any discussion about his domestic legal authority to conduct these strikes. That dirty work was apparently left up to anonymous White House officials, who told the New York Times’s Charlie Savage that both the Authorization of Use of Military Force (AUMF) from 2001 (meant for al-Qaida) and the 2002 war resolution (meant for Saddam Hussein’s Iraq) gave the government the authority to strike Isis in Syria.

In other words: the legal authority provided to the White House to strike al-Qaida and invade Iraq more than a dozen years ago now means that the US can wage war against a terrorist organization that’s decidedly not al-Qaida, in a country that is definitely not Iraq.

It's amazing what you can accomplish when you pretend words mean something entirely different than they do. Hell, if you can just make words mean whatever the hell you want them to mean, there's no such thing as a limitation on what you can do. It's all fair game. Who needs laws when the law is basically a mad libs for you to fill in what you want?

Moving on. The definitional jujitsu covers the people who were killed by the bombing as well. Civilians? What civilians?

Buzzfeed’s Evan McMorris-Santoro reported that the Pentagon is “confident” that no civilians were killed in any of the initial airstrikes in Syria, despite a credible report to the contrary. But we have no idea what that actually means either. The White House previously embraced a re-definition of “civilian” so it could easily deny its drone strikes were killing anyone than “militants” in Yemen, Pakistan, and elsewhere, according to a New York Times report in 2012:

It in effect counts all military-age males in a strike zone as combatants, according to several administration officials, unless there is explicit intelligence posthumously proving them innocent.

So any casualties, if they’re men, might well be tallied as “militants” even if the actual dead people were not.

Kill anyone you want, just as long as they're men of a certain age. Thank you Pentagon dictionary. You just wiped out civilian deaths.

But why stop there? How about "imminent threats"? Because that sounds pretty scary, right? It sure is -- especially when it can mean whatever the hell the administration wants:

In addition to conducting airstrikes against Isis is Syria on Tuesday, the Obama administration also announced it had also targeted the “Khorasan Group”, a separate al-Qaida-linked terrorist organization. They justified it by claiming that the group was plotting an “imminent” attack on the US. Before last week, hardly anyone had heard of the Khorasan Group (in fact, even their name was classified), so it’s difficult to judge from public information just how threatening their alleged plot really was. But when you add in the administration’s definition of “imminent,” it becomes impossible.

Take, for example, this definition from a Justice Department white paper, which was leaked last year, intended to justify the killing of Americans overseas:

[A]n “imminent” threat of violent attack against the United States does not require the United States to have clear evidence that a specific attack on U.S. persons will take place in the immediate future.

To translate: “imminent” can mean a lot of things … including “not imminent”.

This is pretty neat. Anything else you've got for us? How about "combat" or "ground troops"? They're not what you think they are either, because a malleable language can do anything:

As the New York Times’s Mark Landler detailed over the weekend, White House has “an extremely narrow definition of combat … a definition rejected by virtually every military expert.” According to the Obama administration, the 1600 “military advisers” that have steadily been flowing in Iraq fall outside this definition, despite the fact that “military advisers” can be: embedded with Iraqi troops; carry weapons; fire their weapons if fired upon; and call in airstrikes. In the bizarro dictionary of war employed by this White House, none of that qualifies as “combat”.

Yes, the English language changes over time and that's generally a good thing. But we're not talking about the way the word "decimate" once meant to lop off 10% and now means "destroy everything." This is a deliberate misrepresentation of things.

Hell, this seems to go further than Orwell even imagined with his authoritarian use of language and rewriting of history. In this case, rather than just saying "we were always at war with Eurasia," he could have just changed the definition of "we," "were," "always," "at," "war," "with," and "Eurasia," and it would have been that much more powerful.

Filed Under: aumf, authorization to use military force, civilians, combat, definitions, english, fud, imminent, language, obama administration, terror, war