After Endless Demonization Of Encryption, Police Find Paris Attackers Coordinated Via Unencrypted SMS

from the anonymous-sources-say dept

In the wake of the tragic events in Paris last week encryption has continued to be a useful bogeyman for those with a voracious appetite for surveillance expansion. Like clockwork, numerous reports were quickly circulated suggesting that the terrorists used incredibly sophisticated encryption techniques, despite no evidence by investigators that this was the case. These reports varied in the amount of hallucination involved, the New York Times even having to pull one such report offline. Other claims the attackers had used encrypted Playstation 4 communications also wound up being bunk.

Yet, pushed by their sources in the government, the media quickly became a sound wall of noise suggesting that encryption was hampering the government's ability to stop these kinds of attacks. NBC was particularly breathless this week over the idea that ISIS was now running a 24 hour help desk aimed at helping its less technically proficient members understand encryption (even cults help each other use technology, who knew?). All of the reports had one central, underlying drum beat implication: Edward Snowden and encryption have made us less safe, and if you disagree the blood is on your hands.

Yet, amazingly enough, as actual investigative details emerge, it appears that most of the communications between the attackers was conducted via unencrypted vanilla SMS:

"...News emerging from Paris — as well as evidence from a Belgian ISIS raid in January — suggests that the ISIS terror networks involved were communicating in the clear, and that the data on their smartphones was not encrypted.

European media outlets are reporting that the location of a raid conducted on a suspected safe house Wednesday morning was extracted from a cellphone, apparently belonging to one of the attackers, found in the trash outside the Bataclan concert hall massacre. Le Monde reported that investigators were able to access the data on the phone, including a detailed map of the concert hall and an SMS messaging saying “we’re off; we’re starting.” Police were also able to trace the phone’s movements.

The reports note that Abdelhamid Abaaoud, the "mastermind" of both the Paris attacks and a thwarted Belgium attack ten months ago, failed to use any encryption whatsoever (read: existing capabilities stopped the Belgium attacks and could have stopped the Paris attacks, but didn't). That's of course not to say batshit religious cults like ISIS don't use encryption, and won't do so going forward. Everybody uses encryption. But the point remains that to use a tragedy to vilify encryption, push for surveillance expansion, and pass backdoor laws that will make everybody less safe -- is nearly as gruesome as the attacks themselves.

Filed Under: clear text, encryption, going dark, isis, overreaction, paris attacks, sms, surveillance, terrorism

Senator Cotton Introduces Bill To Extend Unconstitutional NSA Surveillance

from the how-nice-of-him dept

I happen to be in Washington DC this week for some events and meetings -- and it's a... ridiculous week to be here, apparently (of course, that could be true of just about any week here). Earlier this week, we noted the pathological ridiculousness of surveillance state apologists like former NSA top lawyer Stewart Baker arguing that the Paris attacks are evidence for why the NSA should not roll back its Section 215 collection. The 215 collection is, of course, the completely unconstitutional (as declared by both an appeals court and the White House's own civil liberties board) program by which the NSA slurped up basically all phone records, claiming that Section 215 of the PATRIOT Act allowed this.

Of course, the primary sponsor of the PATRIOT Act, Rep. Jim Sensenbrenner, has flat out said that Section 215 was written to prevent that kind of mass surveillance, not to enable it. And so, earlier this year, Congress finally pushed through the USA Freedom Act, which was far from perfect, but still did put an end to the Section 215 collection as it stands (while still leaving open ways for the NSA to effectively get the same data). There was a six-month "transition period" which is about to close, meaning that we're officially mere days away from ending the specific 215 bulk collection.

Or, maybe not. As Baker hinted at, the surveillance state apologists are gleefully exploiting the Paris attacks to try to claw back this very, very minor victory against mass surveillance. Senator Tom Cotton quickly rushed out a bill to "postpone" indefinitely the transition away from the 215 program, because of the Paris attacks.

"The terrorist attacks in Paris last week are a terrible reminder of the threats we face every day. And it made clear that the President’s empty policy of tough talk and little action isn’t working against ISIS. Regrettably, these policy follies also extend to the Intelligence Community, whose hands were tied by the passage of the USA FREEDOM ACT. This legislation, along with President Obama’s unilateral actions to restrict the Intelligence Community’s ability to track terrorist communications, takes us from a constitutional, legal, and proven NSA collection architecture to an untested, hypothetical one that will be less effective. And this transition will occur less than two weeks from today, at a time when our threat level is incredibly high.

"If we take anything from the Paris attacks, it should be that vigilance and safety go hand-in-hand. Now is not the time to sacrifice our national security for political talking points. We should allow the Intelligence Community to do their job and provide them with the tools they need to keep us safe. Passing the Liberty Through Strength Act will empower the NSA to uncover threats against the United States and our allies, help keep terrorists out of the United States, and track down those responsible in the wake of the Paris terrorist attacks."

Almost everything in Cotton's statement is a lie. First of all, the FREEDOM Act hasn't even gone into effect yet, so even if it did "tie the hands" of the intelligence community, it had not done so yet. Second, the program has been declared unconstitutional by multiple courts and the administration's own review board. For him to call it constitutional suggests he has no problem flat out lying. Also the idea that it's "proven"? Need we remind you of two facts? (1) To date, the Section 215 program has never -- not even once -- been shown to have been useful in stopping a terrorist attack. (2) It clearly didn't make a difference in dealing with the Paris attacks (and, again, notably the US has even greater surveillance powers overseas, as do the French). So to claim that this one unconstitutional and proven useless program is necessary is just... weird.

Sensenbrenner was at an event I attended last evening and said that he didn't think Cotton's ridiculous bill had much of a chance, but did note that it was hardly the end of surveillance state apologists from trying to expand unconstitutional surveillance powers. Cotton's is just the first attempt, but expect there to be many more.

Filed Under: bulk collection, nsa, paris attacks, section 215, surveillance, tom cotton

France Already Expanded Surveillance Twice In The Past Year -- Perhaps Expanding It Again Is Not The Answer?

from the maybe-it's-time-to-think-a-little-differently? dept

I've been having this discussion on Twitter and a few other places over the past few days, so it seemed only right to put it into a blog post. For all the ridiculous talk with politicians grandstanding and using the attacks in Paris last week as an excuse to expand surveillance powers, it seems worth noting that France actually expanded its surveillance state powers twice in the last year -- and the first time it didn't stop the Charlie Hebdo attacks, and the second time obviously failed to stop the attacks last week. Already, before all of this, French intelligence had powers that were so similar to the NSA's that it was obvious that there had been some coordination. Then, late last year (actually on Christmas Eve), France quietly enacted a new surveillance law relating to data retention and requiring internet companies to cough up info on users.

That went into effect just shortly before the Charlie Hebdo attacks. And, of course, with that new law failing to prevent those attacks, the French government did the kneejerk thing and expanded its surveillance powers even more, claiming it needed to do so to protect against the next attack. That law, which allowed authorities to monitor communications of suspected terrorrists without a judge's approval, went into effect in July, with supporters, including Prime Minister Manuel Valls declaring: "France now has a secure framework against terrorism." Yeah, how did that work out?

Maybe, instead of calling for greater and greater surveillance, we should take a step back and think if there isn't a better approach that doesn't involve continually tossing civil liberties in the trash, for no clear benefit.

Filed Under: france, isis, kneejerk reactions, paris attacks, privacy, reactions, surveillance

US Official Admits That Following Terrorist Attacks, It Starts Arresting People Based On Ideology To 'Get Them Off The Streets'

from the police-state dept

CNN has one of those useless filler stories concerning the Paris attacks where it notes that the FBI will be ramping up wiretapping of suspected ISIS "sympathizers" in the wake of the attacks. That's sort of a dog bites man story if you think about it. What else are they going to do? However, as Adam Johnson notes, the article has a bizarre statement by an "anonymous" law enforcement official at the end. The story mostly talks about how the FBI similarly ramped up its wiretapping following the shootings in Garland, Texas, and then admits that law enforcement will then use that information to arrest people based on non-terrorism charges just to "get them off the street."

The Garland attack ushered in several months of stepped-up use of 24/7 monitoring on suspected ISIS supporters. FBI Director James Comey has described the period between May and July as one that stretched the FBI's resources, and that isn't sustainable. Dozens of arrests were made, in many cases not for terrorism-related charges if the FBI couldn't gather enough evidence of a plot.

"In some cases we just needed to get people off the streets," one senior law enforcement official said.

In other words, the wiretapping becomes a pretense to find anything to lock up people based on their ideological views, even if they're doing nothing related to terrorism. That seems like the very definition of a police state.

Filed Under: arrests, doj, fbi, ideology, isis, paris attacks, wiretapping

Pathological: Surveillance State Defenders Use Their Own Failure In Paris To Justify Mass Surveillance

from the shut-up-jackasses dept

We already wrote a bit about the absolutely ridiculous attempts to connect the Paris attacks of last week with Ed Snowden and encryption. But, of course, the surveillance state sees successful terrorist attacks -- which often demonstrate their own failings -- as a way to double down on getting more power. Take, for example, our old friend and former NSA General Counsel Stewart Baker.

As pointed out by Marcy Wheeler, Baker used the Paris attacks to argue that it was evidence that the NSA should not shut down its Section 215 bulk collection of phone records.

NSA's 215 program was designed to detect a Mumbai/Paris-style attack. https://t.co/UelhvrlNPp Maybe this is the wrong month to drop it.

— stewartbaker (@stewartbaker) November 14, 2015

There are so many problems with this level of idiocy that it's difficult to know where to start, but let's go with the basics... (1) the NSA program is still on and still working for another few weeks before it shifts to a slightly modified version. (2) France has its own equivalent program that is still in operation. In fact, France famously expanded its surveillance laws late last year prior to both the Charlie Hebdo and Paris attacks. (3) Outside of the US, the NSA relies on Executive Order 12333, which allows the NSA to collect a hell of a lot more information than the somewhat limited Section 215 program. (4) None of those programs appears to have discovered the Paris attacks (or, if they did, they clearly failed in stopping the attacks). (5) In other words, these programs did not work and yet the knee-jerk surveillance state defenders are using them as proof that the programs work.

What the actual fuck, Stewart?

Look, it's one thing to use horrible tragedies to promote your own political desires. It's another thing entirely to use the out and out failure of these intelligence programs to argue that they're proof of why those programs work and/or should be expanded.

Filed Under: bulk surveillance, executive order 12333, mass surveillance, nsa, paris attacks, section 215, stewart baker, surveillance state